mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -27,12 +27,34 @@
  * messages BP, which also handles tool_result accumulation and per-call
  * task/event data while isolating volatile text from stable prefix BPs.
  *
- * Non-breakpoint providers:
- *   - OpenAI (public): prompt_cache_key plus model-specific retention when
- *     response storage is enabled (30m cache options or 24h retention).
- *   - OpenAI OAuth: prompt_cache_key only; the Codex backend keeps the
- *     prompt cache at least 30 minutes on GPT-5.6+ models, refreshed on use
- *     (the openai-oauth auto-clear window matches it)
+ * Lead class vs agent class: the Lead class is every Lead session — a coding
+ * Lead (incl. a task session a bot creates with `session create`, which is a
+ * coding Lead with agent 'lead'), raw/CLI callers without an agent, and every
+ * agent-mode Lead (a bot's home thread `sess_home_*` incl. Mixy and routine
+ * turns in it, a room member session, a schedule/webhook run). Sub-agents a
+ * Lead or home thread spawns (owner:'agent') and hidden roles are the agent
+ * class (isLeadCacheClass).
+ *
+ * OpenAI caching (https://developers.openai.com/api/docs/guides/prompt-caching,
+ * checked 2026-10-21):
+ *   - OpenAI (public API key): prompt_cache_key plus model-specific lifetime
+ *     when response storage is enabled. GPT-5.6+ Responses take
+ *     prompt_cache_options.ttl: "30m" (default, writes 1.25x input) or "12h"
+ *     (writes 2.5x); reads 0.1x (0.05x on GPT-6.1 Sol) either way. Earlier
+ *     models keep prompt_cache_retention '24h' on the extended-retention list.
+ *     The request ttl is "30m" (moving tail); Lead-class sessions add one
+ *     explicit "12h" breakpoint at the end of the stable prefix (tools +
+ *     instructions + environment developer item; top-level instructions
+ *     cannot carry a breakpoint). Break-even: the 12h write costs
+ *     (2.5-1.25)=1.25x the prefix once per 12h window, every gap > 30m saves
+ *     a 1.25x rewrite for a 0.1x read (1.15x), so it pays from ~1.09 long gaps
+ *     per 12h — an hourly routine or a returning user pays it back many times;
+ *     a short sub-agent never sees one, so agents stay on "30m".
+ *   - OpenAI OAuth (Codex/ChatGPT login): prompt_cache_key only, request body
+ *     unchanged. Since 2026-10-20 OpenAI keeps the cache of logged-in Codex
+ *     users indefinitely ("we keep cache forever … guaranteed to hit the
+ *     cache", https://x.com/thsottiaux/status/2112712984644784534), so the
+ *     tail never expires: no cache-driven idle clear or compaction.
  *   - Gemini: provider-managed explicit cachedContents with 5m default TTL, plus
  *     implicit caching as a fallback when the prefix is below cache minimums.
  *   - xAI: conversation routing for chat; Responses omits prompt_cache_key
@@ -46,6 +68,8 @@
 import { createHash } from 'node:crypto';
 import { stableHashStringify } from '../stable-hash-stringify.mjs';
 import { getHiddenAgent } from '../internal-agents.mjs';
+import { isAgentOwner } from '../agent-owner.mjs';
+import { isAgentModeSession } from '../session/agent-mode.mjs';
 import { cleanString } from '../../../shared/clean.mjs';
 import { nonNegativeInt, positiveInt } from '../../../shared/numbers.mjs';
 
@@ -63,6 +87,20 @@ function isOneShotMaintenanceAgent(agent) {
   return Boolean(hidden && hidden.kind === 'maintenance' && hidden.toolSchemaProfile === 'none');
 }
 
+/**
+ * Whether a session gets the Lead cache class (see the header): the Lead,
+ * raw callers without an agent, and agent-mode Leads (a bot's home thread,
+ * a room member session, a schedule/webhook run) whose `agent` is the bot's
+ * id. `session` is the record or create options (`id`, `owner`,
+ * `sessionMode`, `ownerAgentId`); a delegated sub-agent (owner:'agent') and
+ * hidden roles are always the agent class.
+ */
+export function isLeadCacheClass(agent, session = null) {
+  if (getHiddenAgent(agent) || (session && isAgentOwner(session))) return false;
+  if (!agent || agent === 'lead') return true;
+  return Boolean(session) && isAgentModeSession(session);
+}
+
 /**
  * Lead-session BP4 (messages tail) TTL, linked to the autoClear idle-sweep
  * config (config.mjs `autoClear: { enabled, idleMs }`, normalized via
@@ -94,7 +132,9 @@ export function resolveLeadMessagesTtl(autoClear) {
  * warm window survives per-session gaps. The volatile message tail (BP4) is
  * per-session.
  *
- * Lead sessions are linked to the user's autoClear idle-sweep config (see
+ * Lead-class sessions (isLeadCacheClass — incl. bot home threads, whose
+ * hourly routine turns otherwise re-wrote the whole chat on a 5m tail) are
+ * linked to the user's autoClear idle-sweep config (see
  * resolveLeadMessagesTtl); its Anthropic default is 1h, while explicit
  * shorter overrides retain the shorter-sweep behavior. The 2026-07-16 6.8h
  * trace supports the 1h Lead tail: 24/25 Lead intra-session gaps over 5m were
@@ -109,8 +149,10 @@ export function resolveLeadMessagesTtl(autoClear) {
  * shouldCompactForExpiredAgentCache), so the cold request rewrites the
  * compacted transcript instead of the whole accumulated tail. Replayed agent
  * cost vs a 1h tail: -24.6% with that compaction, +2.7% without it.
- * (Tail TTL only affects explicit-breakpoint providers — Anthropic; no-op
- * elsewhere.)
+ * (These tiers only drive explicit-breakpoint providers — Anthropic. OpenAI's
+ * lifetimes are resolveOpenAiPrefixCacheTtl / providerTailCacheLifetimeMs;
+ * the 5m-vs-1h reasoning does not apply to openai-oauth, whose cache does
+ * not expire.)
  *
  * Exception: one-shot LLM-only maintenance roles are asked once on a fresh
  * session and closed, so their per-call message tail is never read back and
@@ -120,7 +162,7 @@ export function resolveLeadMessagesTtl(autoClear) {
  * Anthropic's minimum cacheable length is simply not written, so the marker
  * costs nothing there.
  */
-export function resolveCacheStrategy(agent, { autoClear } = {}) {
+export function resolveCacheStrategy(agent, { autoClear, session = null } = {}) {
   if (isOneShotMaintenanceAgent(agent)) {
     return { tools: 'none', system: '1h', tier3: '1h', messages: 'none' };
   }
@@ -137,18 +179,60 @@ export function resolveCacheStrategy(agent, { autoClear } = {}) {
     }
     return strategy;
   };
-  if (getHiddenAgent(agent) || (agent && agent !== 'lead')) {
-    // Hidden and public agents use a flat 5m tail that pre-send compaction
-    // rebuilds once it expires — only the Lead session's tail is linked to
-    // autoClear.
+  if (!isLeadCacheClass(agent, session)) {
+    // Hidden roles and sub-agents use a flat 5m tail that pre-send
+    // compaction rebuilds once it expires — only Lead-class tails are linked
+    // to autoClear.
     return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: '5m' });
   }
-  // Lead session (agent === 'lead', or no agent — raw/CLI callers default
-  // to Lead behavior): message tail TTL is linked to autoClear (see
+  // Lead class (Lead, raw/CLI callers, bot home threads and other
+  // agent-mode Leads): message tail TTL is linked to autoClear (see
   // resolveLeadMessagesTtl).
   return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: resolveLeadMessagesTtl(autoClear) });
 }
 
+// OpenAI public API, GPT-5.6+ Responses: the moving tail rides the request
+// ttl "30m"; Lead-class sessions pin their stable prefix with one "12h"
+// breakpoint (header: break-even). Earlier models' typical retention is
+// ~30 min as well.
+export const OPENAI_TAIL_CACHE_TTL = '30m';
+export const OPENAI_LEAD_PREFIX_CACHE_TTL = '12h';
+const ANTHROPIC_TAIL_LIFETIME_MS = Object.freeze({ '5m': 5 * 60_000, '1h': 60 * 60_000 });
+const OPENAI_TAIL_LIFETIME_MS = 30 * 60_000;
+
+/** The OpenAI (API key) stable-prefix TTL for a session: '12h' for the Lead
+ *  class, null (request default "30m" only) for sub-agents and hidden roles. */
+export function resolveOpenAiPrefixCacheTtl(agent, session = null) {
+  return isLeadCacheClass(agent, session) ? OPENAI_LEAD_PREFIX_CACHE_TTL : null;
+}
+
+/**
+ * Single source of truth for how long a session's message-tail cache stays
+ * readable, per provider, in ms. null = no expiring tail to act on: the cache
+ * does not expire (openai-oauth — logged-in Codex cache is kept indefinitely),
+ * or the provider exposes no tail lifetime. Any "compact or clear because the
+ * tail cache expired" rule must read this.
+ *   - openai-oauth → null (permanent; never compact for cache reasons)
+ *   - openai       → 30m (request ttl "30m"; the Lead's 12h prefix survives)
+ *   - Anthropic    → the session cacheStrategy.messages tier (5m / 1h)
+ */
+export function providerTailCacheLifetimeMs(provider, cacheStrategy = null) {
+  const key = cleanString(provider).toLowerCase();
+  if (key === 'openai-oauth') return null;
+  if (key === 'openai') return OPENAI_TAIL_LIFETIME_MS;
+  if (cacheCapabilityForProvider(key) === 'explicit-breakpoint') {
+    return ANTHROPIC_TAIL_LIFETIME_MS[cacheStrategy?.messages] ?? null;
+  }
+  return null;
+}
+
+/** Whether `session`'s message tail expired since its last model call. */
+export function sessionTailCacheExpired(session, now = Date.now()) {
+  const lifetime = providerTailCacheLifetimeMs(session?.provider, session?.providerCacheOpts?.cacheStrategy);
+  const lastSendAt = Number(session?.lastProviderSendAt);
+  return lifetime !== null && lastSendAt > 0 && now - lastSendAt > lifetime;
+}
+
 // Provider cache capability kinds:
 //   'explicit-breakpoint' — explicit provider-side cache_control writes
 //   'key-prefix'          — provider-managed shard keyed by cache key/session
@@ -482,22 +566,26 @@ function oneShotPromptCacheOpts(agent) {
 
 /**
  * Cache send options for a role's requests on `provider`: the breakpoint
- * strategy on explicit-breakpoint providers plus the one-shot shared scope.
- * Session and session-less callers use this one resolution.
+ * strategy on explicit-breakpoint providers, the Lead-class 12h prefix TTL on
+ * the OpenAI public API, plus the one-shot shared scope. Session and
+ * session-less callers use this one resolution; `options.session` (record or
+ * create options) classifies agent-mode Leads such as bot home threads.
  */
 export function roleProviderCacheOpts(provider, agent, options = {}) {
-  if (cacheCapabilityForProvider(provider) !== 'explicit-breakpoint') return oneShotPromptCacheOpts(agent);
   return buildProviderCacheOpts(provider, null, agent, options);
 }
 
 export function buildProviderCacheOpts(provider, _sessionId, agent, options = {}) {
-  const ttls = resolveCacheStrategy(agent, options);
   const capability = cacheCapabilityForProvider(provider);
-  if (capability === 'explicit-breakpoint') {
-    // 2026-03-06 Anthropic dropped default TTL 1h→5m. We request 1h via
-    // cache_control ttl:"1h"; no beta header is required.
-    // Verified 2026-04-17 (ephemeral_1h_input_tokens=4722).
-    return { cacheStrategy: ttls, ...oneShotPromptCacheOpts(agent) };
+  if (provider === 'openai') {
+    // Read by applyOpenAIDirectCachePolicy (GPT-5.6+ Responses only).
+    const prefixTtl = resolveOpenAiPrefixCacheTtl(agent, options.session);
+    const opts = { ...(prefixTtl ? { promptCachePrefixTtl: prefixTtl } : {}), ...oneShotPromptCacheOpts(agent) };
+    return Object.keys(opts).length ? opts : null;
   }
-  return {};
+  if (capability !== 'explicit-breakpoint') return oneShotPromptCacheOpts(agent);
+  // 2026-03-06 Anthropic dropped default TTL 1h→5m. We request 1h via
+  // cache_control ttl:"1h"; no beta header is required.
+  // Verified 2026-04-17 (ephemeral_1h_input_tokens=4722).
+  return { cacheStrategy: resolveCacheStrategy(agent, options), ...oneShotPromptCacheOpts(agent) };
 }

package/src/runtime/agent/orchestrator/agent-runtime/maintenance-route.mjs

@@ -1,4 +1,5 @@
 import { configuredAgentRouteCandidates, isAgentDisabled } from '../../../shared/agent-route-config.mjs';
+import { normalizeContextTokens } from '../../../shared/llm/default-context-window.mjs';
 import { loadConfig } from '../config.mjs';
 import { getHiddenAgent } from '../internal-agents.mjs';
 
@@ -13,6 +14,13 @@ function normalizeMaintenanceCandidate(candidate) {
     effort: String(candidate.effort || '').trim() || undefined,
     fast: candidate.fast === true,
     ...(candidate.autoEffort === false ? { autoEffort: false } : {}),
+    ...(candidate.modelParameters && typeof candidate.modelParameters === 'object'
+      ? { modelParameters: { ...candidate.modelParameters } }
+      : {}),
+    ...(Number(candidate.contextPercent) > 0 ? { contextPercent: Number(candidate.contextPercent) } : {}),
+    ...(normalizeContextTokens(candidate.contextTokens)
+      ? { contextTokens: normalizeContextTokens(candidate.contextTokens) }
+      : {}),
   };
 }
 

package/src/runtime/agent/orchestrator/agent-runtime/room-supervisor-completion.mjs

@@ -20,7 +20,8 @@ export function createRoomSupervisorCompletion(deps = {}) {
   const log = deps.log || ((line) => process.stderr.write(line));
 
   /** The decision for one step (parseRoomDecision), null for an unusable
-   *  reply; throws when the route or provider is unavailable. */
+   *  reply, `{ action: 'unmanaged' }` when no Maintainer model is configured;
+   *  throws when the configured provider is unavailable. */
   return async function decideRoomTurn(input = {}) {
     const members = (Array.isArray(input?.members) ? input.members : [])
       .filter((member) => member && typeof member.id === 'string' && member.id)
@@ -32,12 +33,12 @@ export function createRoomSupervisorCompletion(deps = {}) {
     if (!members.length) return null;
     const config = load();
     // The Maintainer's own route only: a step runs after every turn, so it
-    // never falls back to the default (Lead) model the user pays most for;
-    // without one the room keeps its rule-based picks.
+    // never falls back to the default (Lead) model the user pays most for.
+    // Without one the room is unmoderated: the members called answer once.
     const route = resolveRoute({ agent: 'cycle1-agent', config, includeDefault: false });
     const providerName = String(route?.provider || '').trim();
     const model = String(route?.model || '').trim();
-    if (!providerName || !model) throw new Error('The room supervisor has no Maintainer route.');
+    if (!providerName || !model) return { action: 'unmanaged' };
     const signal = AbortSignal.timeout(TIMEOUT_MS);
     await initialize(config.providers || {}, { signal });
     const provider = providerFor(providerName);

package/src/runtime/agent/orchestrator/agent-trace.mjs

@@ -237,6 +237,8 @@ function traceAgentUsage({
   chainContinuous,
   continuationResetReason,
   inputTokensInclusive,
+  // Anthropic: per-block prefix hashes of the request (providers/lib/anthropic-prefix-trace.mjs).
+  prefixBlocks,
 }) {
   const identity = currentUsageContext();
   provider = identity?.provider || provider;
@@ -291,6 +293,7 @@ function traceAgentUsage({
       service_tier: resolvedServiceTier,
       raw_usage: rawUsage || null,
       ...chainFields,
+      ...(prefixBlocks ? { prefix_blocks: prefixBlocks } : {}),
     },
   });
 }

package/src/runtime/agent/orchestrator/cache-break-trace.mjs

@@ -51,6 +51,8 @@ export function buildCacheBreakPayload(record = {}) {
     input_prefix_mismatch_expected_hash: cleanHash(record.inputPrefixMismatchExpectedHash),
     input_prefix_mismatch_actual_type: cleanText(record.inputPrefixMismatchActualType),
     input_prefix_mismatch_actual_hash: cleanHash(record.inputPrefixMismatchActualHash),
+    changed_blocks: cleanText(record.changedBlocks),
+    system_markers_changed: typeof record.markersChanged === 'boolean' ? record.markersChanged : null,
   };
   return Object.fromEntries(Object.entries(payload).filter(([, value]) => value !== null));
 }
@@ -77,6 +79,8 @@ function formatCacheBreakLine(record = {}) {
     ['previousCachedPrefixTokens', payload.previous_cached_prefix_tokens],
     ['idleMs', payload.idle_ms],
     ['noGuardBaseline', payload.missing_prefix_guard_baseline],
+    ['changedBlocks', payload.changed_blocks],
+    ['systemMarkersChanged', payload.system_markers_changed],
   ].filter(([, value]) => value !== null && value !== undefined);
   return `[cache-break] ${fields.map(([key, value]) => (typeof value === 'string' ? `${key}=${JSON.stringify(value)}` : `${key}=${value}`)).join(' ')}`;
 }

package/src/runtime/agent/orchestrator/config-presets.mjs

@@ -144,6 +144,8 @@ export function normalizePreset(preset) {
   // Auto effort is on unless the preset opts out; only the off state is kept.
   if (preset.autoEffort === false) out.autoEffort = false;
   out.tools = ['full', 'readonly', 'mcp'].includes(preset.tools) ? preset.tools : 'full';
+  // The Lead preset's fallback models (validated when written, by the route normalizer).
+  if (Array.isArray(preset.fallbacks) && preset.fallbacks.length) out.fallbacks = preset.fallbacks;
   return out;
 }
 

package/src/runtime/agent/orchestrator/config-storage.mjs

@@ -127,9 +127,16 @@ function canonicalizeAutoClearStorage(value) {
     const provider = String(key || '')
       .trim()
       .toLowerCase();
-    const duration = Number(candidate);
-    if (!provider || !Number.isFinite(duration) || duration <= 0) continue;
-    providerIdleMs[provider] = Math.max(60_000, Math.round(duration));
+    // 0 (also 'unlimited' / 'never') is the stored "never auto-clear" value
+    // (runtime-core/config-helpers.mjs AUTO_CLEAR_UNLIMITED).
+    const text = typeof candidate === 'string' ? candidate.trim().toLowerCase() : null;
+    let duration;
+    if (text === 'unlimited' || text === 'never') duration = 0;
+    else if (text === '') duration = Number.NaN;
+    else duration = Number(candidate);
+    if (!provider || candidate === null || typeof candidate === 'boolean' || !Number.isFinite(duration) || duration < 0)
+      continue;
+    providerIdleMs[provider] = duration === 0 ? 0 : Math.max(60_000, Math.round(duration));
   }
   delete next.thresholdMs;
   delete next.idleMillis;

package/src/runtime/agent/orchestrator/config.mjs

@@ -4,6 +4,7 @@ import { mergeStoredProviders } from './config-providers-merge.mjs';
 import { normalizeExtensionScopes } from '../../shared/extension-scopes.mjs';
 import { applyConfigPatch, diffConfig } from '../../shared/config-patch.mjs';
 import { normalizeWorkflowSelection } from '../../shared/orchestration.mjs';
+import { AUTO_EFFORT_BASE, autoEffortBase } from './providers/auto-effort.mjs';
 import { DEFAULT_INSTRUCTION_FILES_MODE, normalizeInstructionFilesMode } from '../../shared/instruction-files-mode.mjs';
 import {
   DEFAULT_DISABLED_AGENT_ROSTER,
@@ -205,6 +206,13 @@ function storedInstructionFiles(agent) {
   return mode === DEFAULT_INSTRUCTION_FILES_MODE ? {} : { instructionFiles: mode };
 }
 
+// `autoEffortBase` (providers/auto-effort.mjs): only a valid non-default level
+// is kept; absent means medium.
+function storedAutoEffortBase(agent) {
+  const base = autoEffortBase(agent?.autoEffortBase);
+  return base === AUTO_EFFORT_BASE ? {} : { autoEffortBase: base };
+}
+
 export function loadConfig(options = {}) {
   const includeSecrets = options.secrets !== false;
   // `secrets: 'presence'`: credentials are detected (env, OAuth files, which
@@ -269,6 +277,7 @@ export function loadConfig(options = {}) {
         disabledAgents: legacyDisabledAgents ? disabledAgentIds(raw) : effectiveDisabledAgents(raw),
         ...(raw.memoryTools && typeof raw.memoryTools === 'object' ? { memoryTools: { ...raw.memoryTools } } : {}),
         ...storedInstructionFiles(raw),
+        ...storedAutoEffortBase(raw),
         ...normalizeWorkflowSelection(raw),
         profile: normalizeProfileConfig(raw.profile),
         skills: normalizeSkillsConfig(raw.skills),
@@ -463,6 +472,8 @@ function buildAgentSaveBuilder(config) {
     else delete next.aiSessionTitles;
     delete next.instructionFiles;
     Object.assign(next, storedInstructionFiles(config));
+    delete next.autoEffortBase;
+    Object.assign(next, storedAutoEffortBase(config));
     delete next.workflowRoutes;
     // Defaults live in code: values equal to the current default are not stored.
     return storedAgentForm(removeRetiredAgentFields(next));

package/src/runtime/agent/orchestrator/context/role-instructions.mjs

@@ -375,6 +375,14 @@ function agentManifest(agent) {
   return {};
 }
 
+/** The name a bot goes by (its manifest name, Mixy's display name), else its id. */
+export function agentDisplayName(agent) {
+  if (agent === 'lead') return mixyDisplayName();
+  if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return String(agent || '');
+  const name = agentManifest(agent).name;
+  return (typeof name === 'string' ? name.replace(/\s+/g, ' ').trim() : '') || agent;
+}
+
 export function agentModeIdentityLine(agent) {
   if (agent === 'lead') return `You are ${mixyDisplayName()}, the user's assistant in Mixdog.`;
   if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
@@ -489,7 +497,7 @@ export function composeSystemPrompt(opts) {
   //    variants, AGENT_MODE.md, the sub-agent catalog (the same for every
   //    agent other than Mixy);
   // 3. Mixy only — MIXY.md and its contact-agent catalog;
-  // 4. per session or agent, last — routine line, identity, caller prompt,
+  // 4. per session or agent, last — identity, caller prompt,
   //    role, persona, instruction files and core memory (changes most).
   const sessionMarkerCore = joinPromptSlices([
     trimmedPromptSlice(opts.workflowContext),
@@ -500,7 +508,6 @@ export function composeSystemPrompt(opts) {
     trimmedPromptSlice(opts.agentCatalogContext),
     opts.mixyRules || '',
     trimmedPromptSlice(opts.contactCatalogContext),
-    opts.routineRules || '',
     opts.identityContext || '',
     opts.userPrompt || '',
     roleInstructionContext,

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -2,6 +2,7 @@
 // or a project may use. Every installed connector is on by default for every
 // agent and project, existing and future ones; a policy only switches some off:
 //   agents/<id>/agent.json   connectors: { off: [serverId…], tools?: { [serverId]: { [tool]: permission } } }
+//                            (bots/<id>/ for a store bot; Mixy — runtime id `lead` — in her identity folder)
 //   <data>/project-connectors.json   { projects: { [projectRoot]: { off: [serverId…] } } }
 // `tools` keeps per-tool overrides (auto | needs_approval | disabled); a tool
 // without one is auto, except a catalog connector's high-risk tools, which
@@ -12,11 +13,16 @@
 // connected tool, so the schema and the BP2 manifest stay shared.
 import { readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { holdsNoData, parseJsonText, readJsonStateSync } from '../../../shared/atomic-file.mjs';
+
+const NO_DATA = new Error('the file holds no data');
 import { cwdWithinProjects } from '../../../shared/extension-scopes.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
-import { userDefinitionDir } from '../../../shared/agent-store.mjs';
+import { mixyIdentityDir, userDefinitionDir } from '../../../shared/agent-store.mjs';
 import { isSelfMcpToolName, parseMcpToolName } from '../../../shared/tool-primitives.mjs';
 import { connectorToolDefault } from '../../../shared/connector-catalog.mjs';
+import { MIXY_AGENT_ID } from '../session/agent-home.mjs';
+import { AGENT_MODE, sessionModeOf } from '../session/agent-mode.mjs';
 import { serverConnector } from './server-connectors.mjs';
 
 export const CONNECTOR_PERMISSIONS = Object.freeze(['auto', 'needs_approval', 'disabled']);
@@ -127,9 +133,25 @@ function readJson(path, parse) {
     return error?.code === 'ENOENT' || error?.code === 'ENOTDIR' ? null : unreadable(path, error);
   }
   try {
-    return parse(JSON.parse(text));
+    if (holdsNoData(text)) throw NO_DATA;
+    return parse(parseJsonText(text));
   } catch (error) {
-    return unreadable(path, error);
+    return recoverDamaged(path, parse, error);
+  }
+}
+
+// A damaged policy (empty, NUL-filled, torn, invalid) must never fail open.
+// With a valid last good copy `<file>.bak` the damaged file is kept aside and
+// the copy restored, so the user's deny list survives. Without one the file
+// stays where it is (`keepWithoutBackup`) and every connector stays off until
+// the policy is saved again — moving it aside would make the next read "no
+// policy" (all on). A busy recovery lock also answers deny-all.
+function recoverDamaged(path, parse, error) {
+  try {
+    const value = readJsonStateSync(path, { validate: parse, fallback: DENY_ALL_CONNECTORS, keepWithoutBackup: true });
+    return value === DENY_ALL_CONNECTORS ? unreadable(path, error) : value;
+  } catch (recoveryError) {
+    return unreadable(path, recoveryError);
   }
 }
 
@@ -146,11 +168,22 @@ export function readConnectorsFile(path) {
   return readJson(path, (manifest) => parseConnectorPolicy(manifest?.connectors));
 }
 
-/** The agent's saved policy under `dataDir`, or null when it has none. */
+/** The agent's saved policy under `dataDir`, or null when it has none. Mixy's
+ *  runtime id is `lead`: her policy is in her identity folder (bots/mixy once
+ *  the bot store is active, agents/lead before), the file her profile writes. */
 export function agentConnectors(agentId, dataDir = resolvePluginData()) {
   const id = clean(agentId);
   if (!id || !AGENT_DIR_ID.test(id)) return null;
-  return cachedRead(join(userDefinitionDir(dataDir, id), 'agent.json'), readConnectorsFile);
+  const dir = id === MIXY_AGENT_ID ? mixyIdentityDir(dataDir) : userDefinitionDir(dataDir, id);
+  return cachedRead(join(dir, 'agent.json'), readConnectorsFile);
+}
+
+/** The agent whose connector policy `session` runs under. A coding Lead shares
+ *  Mixy's runtime id `lead` but is not her: the policy her profile edits is
+ *  hers alone, so a coding Lead has none ('') and only its Project's applies. */
+export function connectorPolicyAgentOf(session) {
+  const agent = clean(session?.agent);
+  return agent === MIXY_AGENT_ID && sessionModeOf(session) !== AGENT_MODE ? '' : agent;
 }
 
 /** Uncached: the project policy file → `[{ root, off }]`, null without one,
@@ -186,6 +219,65 @@ export function connectorToolPermission(policy, toolOrName) {
   return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
+const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
+
+/** Whether replacing the stored policy `before` (a stored value, a parsed
+ *  policy or null) with `after` (`{ off, tools }` or null) could give any
+ *  tool more authority, judged on EFFECTIVE permissions: a connector switched
+ *  back on, a tool allowed, or an override removed (the tool then runs on its
+ *  default, which is `needs_approval` for a catalog connector's high-risk
+ *  tools and `auto` otherwise). A legacy allow list or an unreadable policy is
+ *  not compared: it counts as widening. */
+export function connectorPolicyWidens(before, after) {
+  let old;
+  try {
+    old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);
+  } catch {
+    return true;
+  }
+  if (old.allow) return true;
+  const next = after == null ? { off: [], tools: {} } : after;
+  const offBefore = new Set(old.off);
+  const offAfter = new Set(next.off || []);
+  for (const server of offBefore) if (!offAfter.has(server)) return true;
+  const toolsBefore = old.tools || {};
+  const toolsAfter = next.tools || {};
+  for (const server of new Set([...Object.keys(toolsBefore), ...Object.keys(toolsAfter)])) {
+    const tools = new Set([...Object.keys(toolsBefore[server] || {}), ...Object.keys(toolsAfter[server] || {})]);
+    for (const tool of tools) {
+      // No override: at least asks / at most runs freely.
+      const was = offBefore.has(server) ? 0 : (PERMISSION_RANK[toolsBefore[server]?.[tool]] ?? 1);
+      const now = offAfter.has(server) ? 0 : (PERMISSION_RANK[toolsAfter[server]?.[tool]] ?? 2);
+      if (now > was) return true;
+    }
+  }
+  return false;
+}
+
+/** Throws NO_WIDEN_MESSAGE when `after` could widen `before` (see connectorPolicyWidens). */
+export function assertConnectorPolicyNotWidened(before, after) {
+  if (connectorPolicyWidens(before, after)) throw new Error(NO_WIDEN_MESSAGE);
+}
+
+let toolPermissionWriter = null;
+/** The host attaches the one writer of an agent's per-tool permission (the
+ *  agent editor keeps every other agent.json key). */
+export function setConnectorToolPermissionWriter(write) {
+  toolPermissionWriter = typeof write === 'function' ? write : null;
+}
+
+/** Save `permission` for the connector tool `toolOrName` under `agentId`'s own
+ *  policy. False when it is no connector tool or no writer is attached. */
+export async function writeAgentMcpToolPermission(agentId, toolOrName, permission) {
+  const mcp = parseMcpToolName(toolOrName);
+  if (!toolPermissionWriter || !mcp || isSelfMcpToolName(toolOrName) || !CONNECTOR_PERMISSIONS.includes(permission)) {
+    return false;
+  }
+  await toolPermissionWriter(agentId, mcp.server, mcp.tool, permission);
+  return true;
+}
+
 /** The permission `agentId` has for the MCP tool `toolOrName`. */
 export function agentMcpToolPermission(agentId, toolOrName) {
   if (!parseMcpToolName(toolOrName)) return 'auto';

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -117,14 +117,11 @@ async function enumerate({ strict = false } = {}) {
  *  names and (POSIX) process groups. Rejects instead of returning a partial
  *  table, so callers can tell "nothing found" from "could not look".
  *
- *  `shared: true` (pre-kill captures) joins a read already in flight, so many
- *  jobs promoted together do not each spawn an enumerator; a capture taken
- *  while its root runs is valid whenever that read began. An observation after
- *  a kill or exit must see a table taken AFTER it asked: a read that began
- *  before the kill would report the killed tree alive and defer the
- *  confirmation by a whole re-check. Such a caller starts a read when none
- *  runs, else joins the one queued to begin when the running read settles —
- *  every observer asking meanwhile shares it. At most one enumerator runs at
+ *  Every caller sees a table from a read begun after it asked: an earlier
+ *  read may miss newly spawned descendants before a kill, or report a killed
+ *  tree alive afterwards. A caller starts a read when none runs, else joins
+ *  the one queued to begin when the running read settles — every caller
+ *  asking meanwhile shares it. At most one enumerator runs at
  *  a time, however many shells settle or watch at once (each one is a
  *  PowerShell process on Windows; one per settle and watch pass compounded
  *  machine load into multi-second daemon stalls). */
@@ -137,8 +134,7 @@ function startTableRead() {
   tableInFlight = read;
   return read;
 }
-export function readProcessTable({ shared = false } = {}) {
-  if (shared && tableInFlight) return tableInFlight;
+export function readProcessTable() {
   if (nextTable) return nextTable;
   if (!tableInFlight) return startTableRead();
   const settled = () => {};

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -1,5 +1,6 @@
 import { setMaxListeners } from 'node:events';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync } from 'node:fs';
+import { writeFileAtomicSync } from '../../../shared/atomic-file.mjs';
 import { writeFile } from 'node:fs/promises';
 import {
   MAX_ATTACHMENT_BLOB_BYTES,
@@ -772,9 +773,11 @@ function spillMcpBinary(buffer, extension) {
   const path = join(dir, `mcp-${hash}.${extension}`);
   try {
     mkdirSync(dir, { recursive: true });
-    writeFileSync(path, buffer, { flag: 'wx' });
-  } catch (err) {
-    if (err?.code !== 'EEXIST') return null;
+    // Named by its content hash: whole-file create-if-absent (a crash never
+    // leaves a torn file under the name that would be trusted as the content).
+    writeFileAtomicSync(path, buffer, { createOnly: true });
+  } catch {
+    return null;
   }
   return path;
 }