mixdog 1.3.1 → 1.3.3

package/src/runtime/shared/projects.mjs

@@ -8,9 +8,9 @@
  * Data shape: { projects: [{ name, path, addedAt, lastSelectedAt? }] }
  */
 import { homedir } from 'node:os';
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { basename, isAbsolute, join, resolve } from 'node:path';
-import { withFileLockSync, writeJsonAtomicSync } from './atomic-file.mjs';
+import { holdsNoData, readJsonStateSync, updateJsonAtomicSync, writeFileAtomicSync } from './atomic-file.mjs';
 
 const MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
 const PROJECTS_FILE = process.env.MIXDOG_PROJECTS_FILE
@@ -30,47 +30,57 @@ function normalizeKey(absPath) {
   return process.platform === 'win32' ? text.replace(/[\\/]+$/, '').toLowerCase() : text.replace(/\/+$/, '');
 }
 
+// The registry document as a store. A strict read (permission checks and
+// mutations) drops entries without an absolute path: they can never grant
+// anything, and the replaced file survives as projects.json.bak.
+function normalizeStore(parsed, strict) {
+  const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
+  return {
+    projects: projects
+      .filter(
+        (entry) => entry && typeof entry.path === 'string' && entry.path.trim() && (!strict || isAbsolute(entry.path))
+      )
+      .map((entry) => ({
+        name: String(entry.name || basename(entry.path) || entry.path),
+        path: String(entry.path),
+        addedAt: Number(entry.addedAt) || 0,
+        ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
+      })),
+  };
+}
+
+// A damaged registry file (NUL, truncated, malformed) is kept aside as
+// projects.json.corrupt-<ts> and the last good projects.json.bak is restored
+// when there is one, else the registry starts empty: a damaged file never
+// blocks adding, removing or selecting a project. Strict callers still see a
+// real I/O failure (EACCES, EIO) as an error — an unreadable registry is not
+// an empty one; the tolerant listing reads it as empty.
 function readStore(strict = false) {
   try {
-    if (!strict && !existsSync(PROJECTS_FILE)) return { projects: [] };
-    const raw = readFileSync(PROJECTS_FILE, 'utf8');
-    const parsed = JSON.parse(raw);
-    if (
-      strict &&
-      (!Array.isArray(parsed?.projects) ||
-        parsed.projects.some(
-          (entry) => !entry || typeof entry.path !== 'string' || !entry.path.trim() || !isAbsolute(entry.path)
-        ))
-    )
-      throw new TypeError('Project registry is invalid.');
-    const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
-    return {
-      projects: projects
-        .filter((entry) => entry && typeof entry.path === 'string' && entry.path.trim())
-        .map((entry) => ({
-          name: String(entry.name || basename(entry.path) || entry.path),
-          path: String(entry.path),
-          addedAt: Number(entry.addedAt) || 0,
-          ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
-        })),
-    };
+    return normalizeStore(readJsonStateSync(PROJECTS_FILE), strict);
   } catch (error) {
-    if (strict && error?.code !== 'ENOENT') throw error;
+    if (strict) throw error;
     return { projects: [] };
   }
 }
 
 // Serialize the entire read/modify/write across cooperating processes, not
-// just publication. Unlike the generic JSON updater, a corrupt registry must
-// never be repaired into an empty document. Preserve synchronous return values
-// and no-op behavior; failed reads, lock acquisition and writes propagate.
+// just publication: the file is read under the registry lock. Preserve
+// synchronous return values and no-op behavior (an unchanged store is not
+// written); failed reads, lock acquisition and writes propagate. Each write
+// keeps the replaced version as projects.json.bak.
 function mutateStore(mutator) {
-  return withFileLockSync(`${PROJECTS_FILE}.lock`, () => {
-    const store = readStore(true);
-    const { value, changed } = mutator(store);
-    if (changed) writeJsonAtomicSync(PROJECTS_FILE, store, { lock: false });
-    return value;
-  });
+  let outcome;
+  updateJsonAtomicSync(
+    PROJECTS_FILE,
+    (current) => {
+      const store = normalizeStore(current, true);
+      outcome = mutator(store);
+      return outcome.changed ? store : undefined;
+    },
+    { backup: true }
+  );
+  return outcome.value;
 }
 
 /**
@@ -78,7 +88,8 @@ function mutateStore(mutator) {
  * selection store and memory project_id classification (resolveProjectId)
  * agree. Rules:
  *   - Never overwrite an existing marker (user may have set 'common' or a
- *     custom id — respect it).
+ *     custom id — respect it). A marker holding no data (empty or NUL, what a
+ *     crash leaves) is no id: it is rewritten.
  *   - Only act when absPath is a real directory on disk; never create the
  *     project folder itself (addProject does NOT create the directory).
  *   - Marker value = provided name, else basename(absPath). Skip when the
@@ -97,14 +108,12 @@ function ensureProjectIdMarker(absPath, name) {
       return; // missing / unstattable → silently skip
     }
     const markerPath = join(absPath, '.mixdog', 'project.id');
-    if (existsSync(markerPath)) return; // preserve existing value
+    const present = existsSync(markerPath);
+    if (present && !holdsNoData(readFileSync(markerPath))) return; // preserve existing value
     const value = String(name || basename(absPath) || '').trim();
     if (!value || value.toLowerCase() === 'common') return;
-    const markerDir = join(absPath, '.mixdog');
-    mkdirSync(markerDir, { recursive: true });
-    const tmp = `${markerPath}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${value}\n`, 'utf8');
-    renameSync(tmp, markerPath);
+    // A missing marker is created only if still missing (a concurrent creator's wins).
+    writeFileAtomicSync(markerPath, `${value}\n`, { createOnly: !present });
   } catch {
     /* best-effort marker; never throw */
   }

package/src/runtime/shared/provider-accounts.mjs

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { parseJsonText, updateJsonAtomic } from './atomic-file.mjs';
+import { readJsonStateSync, unsupportedState, updateJsonAtomic } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 export const ACCOUNT_PROVIDERS = Object.freeze([
@@ -34,12 +33,19 @@ function requireAccountId(id) {
 
 function validate(raw) {
   if (raw == null) return { version: 1, providers: {} };
+  // A newer build's roster is left in place: reads see no accounts and writes
+  // refuse, so a downgrade never discards it.
+  if (Number.isSafeInteger(raw.version) && raw.version > 1) {
+    throw unsupportedState(`Provider account settings version ${raw.version} is newer than this build.`);
+  }
   if (raw.version !== 1 || !raw.providers || typeof raw.providers !== 'object') {
     throw new Error('Provider account settings are unreadable.');
   }
   for (const [provider, pool] of Object.entries(raw.providers)) {
-    requireAccountProvider(provider);
-    if (!Array.isArray(pool.accounts) || pool.accounts.length > MAX_ACCOUNTS) {
+    // A provider a newer build added is carried as is: this build never reads
+    // or writes its pool, and treating it as damage would discard it.
+    if (!ACCOUNT_PROVIDERS.includes(provider)) continue;
+    if (!Array.isArray(pool?.accounts) || pool.accounts.length > MAX_ACCOUNTS) {
       throw new Error('Invalid provider account list.');
     }
     const ids = pool.accounts.map((row) => requireAccountId(row.id));
@@ -48,13 +54,11 @@ function validate(raw) {
   return raw;
 }
 
+// Every OAuth provider's init reads the roster, so a damaged one (crash
+// leftovers, truncation, a shape this build rejects) must never throw: it is
+// kept aside and the last good copy, which every write keeps, is restored.
 function read(dataDir) {
-  try {
-    return validate(parseJsonText(readFileSync(file(dataDir), 'utf8')));
-  } catch (error) {
-    if (error.code === 'ENOENT') return validate(null);
-    throw error;
-  }
+  return readJsonStateSync(file(dataDir), { validate, fallback: validate(null), secret: true });
 }
 
 // Labels an earlier build assigned automatically. They read as a different
@@ -106,7 +110,8 @@ export function readProviderAccountPool(provider, dataDir = resolvePluginData())
 
 async function update(provider, mutate) {
   requireAccountProvider(provider);
-  // Read failures must not be interpreted as an empty account roster.
+  // A roster that parses yet fails validation is recovered here first; the
+  // mutator's validate would otherwise refuse every write. I/O failures throw.
   read();
   const result = await updateJsonAtomic(
     file(),
@@ -117,7 +122,7 @@ async function update(provider, mutate) {
       state.providers[provider] = pool;
       return validate(state);
     },
-    { mode: 0o600, secret: true, fsyncDir: true }
+    { mode: 0o600, secret: true, fsyncDir: true, backup: true }
   );
   return normalizePool(result.providers[provider]);
 }

package/src/runtime/shared/redact-directories.mjs

@@ -0,0 +1,18 @@
+import { pathToFileURL } from 'node:url';
+
+/**
+ * `text` with every mention of the given directories taken out (and the
+ * separator after it), whether written as a native path, with forward slashes
+ * or as a file URL, so an error never discloses a private scratch location.
+ */
+export function redactDirectories(text, directories) {
+  let out = String(text ?? '');
+  for (const directory of directories) {
+    if (!directory) continue;
+    const forms = new Set([directory, directory.replaceAll('\\', '/'), pathToFileURL(directory).href]);
+    for (const form of [...forms].sort((a, b) => b.length - a.length)) {
+      out = out.split(`${form}\\`).join('').split(`${form}/`).join('').split(form).join('');
+    }
+  }
+  return out;
+}

package/src/runtime/shared/remove-directory.mjs

@@ -0,0 +1,28 @@
+import { rm } from 'node:fs/promises';
+
+export const REMOVE_RETRY_MS = 100;
+const REMOVE_ATTEMPTS = 6;
+const RETRYABLE_REMOVE_CODES = new Set(['EBUSY', 'EPERM', 'ENOTEMPTY', 'EACCES']);
+
+/**
+ * Removes a private scratch folder. A process that just exited can still hold
+ * its files for a moment on Windows, so a busy folder is retried briefly; a
+ * failure that persists is logged (never swallowed) and does not throw.
+ */
+export async function removeDirectoryWithRetry(
+  dir,
+  { remove = rm, log = (line) => process.stderr.write(line), retryMs = REMOVE_RETRY_MS } = {}
+) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await remove(dir, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      if (attempt >= REMOVE_ATTEMPTS || !RETRYABLE_REMOVE_CODES.has(error?.code)) {
+        log(`scratch folder ${dir} could not be removed: ${error?.message || error}\n`);
+        return;
+      }
+      await new Promise((resolve) => setTimeout(resolve, retryMs * attempt));
+    }
+  }
+}

package/src/runtime/shared/routine-trigger.d.mts

@@ -4,7 +4,12 @@ export interface RoutineTrigger {
   event?: string;
 }
 
-export declare function routineTriggerHeader(input: { kind: string; name: string; project?: string }): string;
+export declare function routineTriggerHeader(input: {
+  kind: string;
+  name: string;
+  project?: string;
+  now?: Date | number;
+}): string;
 export declare function stripRoutineTriggerHeader(text: unknown): string;
 export declare function normalizeRoutineTrigger(value: unknown): RoutineTrigger | null;
 export declare function routineTriggerField(value: unknown): { routineTrigger?: RoutineTrigger };

package/src/runtime/shared/routine-trigger.mjs

@@ -4,18 +4,26 @@
 // carries (live, persisted in meta.transcript, restored) so a chat paints it
 // as a routine marker instead of a user bubble.
 
+import { localTimestampParts } from './time-format.mjs';
+
 const HEADER_PREFIX = '[Routine trigger]';
 const KINDS = new Set(['schedule', 'webhook']);
 
-/** The first line of a routine turn's prompt: which routine fired and how to
- *  treat the turn. Only the turn's content carries it, never the system
- *  prompt, so the thread's prompt cache is untouched. */
-export function routineTriggerHeader({ kind, name, project = '' }) {
+/** The first line of a routine turn's prompt: which routine fired, when (local
+ *  time and zone: the turn gets no other date), and how to treat the turn.
+ *  It is the routine's only conduct text. Only the turn's content carries it,
+ *  never the system prompt, so the thread's prompt cache is untouched. */
+export function routineTriggerHeader({ kind, name, project = '', now = new Date() }) {
   const what = kind === 'webhook' ? 'webhook' : 'schedule';
+  const at = localTimestampParts(now);
   return [
     `${HEADER_PREFIX} Your ${what} "${String(name)}" fired.`,
-    'Carry out its instructions below now, yourself or by delegating; nobody is watching this turn, so approvals wait for the user.',
-    'Reply in this chat with the result.',
+    ...(at ? [`Local time: ${at.date} ${at.time.slice(0, 5)} ${at.timeZone} (${at.offset}).`] : []),
+    'Carry out its instructions below now, yourself or by delegating.',
+    'Nobody is watching this turn and nothing asks for approval: act within your permissions.',
+    'Payments and permanent deletes are refused here: report that and suggest doing it from the chat.',
+    'If a sign-in, code or CAPTCHA blocks you, stop and say which site needs the user.',
+    'Reply in this chat in plain words, without tool names; if you handed work off, say it started — its result arrives here later.',
     ...(project ? [`Project folder: ${project}`] : []),
   ].join(' ');
 }

package/src/runtime/shared/run-child.d.mts

@@ -0,0 +1,3 @@
+import type { ChildProcess } from 'node:child_process';
+
+export function killChildTree(child: ChildProcess): void;

package/src/runtime/shared/run-child.mjs

@@ -8,6 +8,29 @@
 // maxBytes, or the spawn error itself.
 import { spawn } from 'node:child_process';
 
+/** Kills `child` with everything it started. On Windows a plain kill ends only
+ *  the child itself: `git` there is a launcher whose git.exe (and the alias,
+ *  hook or filter it runs) would live on, still holding the output pipes. */
+export function killChildTree(child) {
+  if (process.platform === 'win32' && child.pid && child.exitCode === null) {
+    const taskkill = `${process.env.SystemRoot || 'C:\\Windows'}\\System32\\taskkill.exe`;
+    const fallback = () => {
+      try {
+        child.kill();
+      } catch {}
+    };
+    spawn(taskkill, ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true })
+      .once('error', fallback)
+      .once('exit', (code) => {
+        if (code !== 0) fallback();
+      });
+    return;
+  }
+  try {
+    child.kill();
+  } catch {}
+}
+
 export function runChild({ command, args, cwd, input, env, timeoutMs, maxBytes, stdoutEncoding = 'utf8' }) {
   return new Promise((resolvePromise, rejectPromise) => {
     const hasInput = (typeof input === 'string' || ArrayBuffer.isView(input)) && input.length > 0;
@@ -35,9 +58,7 @@ export function runChild({ command, args, cwd, input, env, timeoutMs, maxBytes,
         ? setTimeout(() => {
             const error = new Error(`${command} ${args.join(' ')} timed out after ${timeoutMs}ms`);
             error.code = 'ETIMEDOUT';
-            try {
-              child.kill();
-            } catch {}
+            killChildTree(child);
             finish(error);
           }, timeoutMs)
         : null;

package/src/runtime/shared/session-baseline-store.mjs

@@ -809,8 +809,14 @@ export function _unsavedBytesForTest(sessionId) {
 async function readBlob(sessionId, entry) {
   if (!entry?.blob) return undefined;
   try {
-    const bytes = await readFile(join(blobDir(sessionId), entry.blob));
-    return digest(bytes) === entry.blob ? bytes : undefined;
+    const path = join(blobDir(sessionId), entry.blob);
+    const bytes = await readFile(path);
+    if (digest(bytes) === entry.blob) return bytes;
+    // A torn blob (unflushed write cut by a crash). Blobs are published whole
+    // and never replaced, so a mismatch is damage: drop it, or the create-only
+    // write of a later capture of the same content would skip over it.
+    await rm(path, { force: true });
+    return undefined;
   } catch {
     return undefined;
   }

package/src/runtime/shared/session-sidebar-host.d.mts

@@ -1,4 +1,13 @@
-export type SessionSidebarChange = { favorite: boolean } | { archived: boolean };
+export type SessionSidebarChange =
+  | { favorite: boolean }
+  | { archived: boolean }
+  | { archived: true; cascade: false }
+  | { forgotten: true };
 export type SessionSidebarHost = (sessionId: unknown, change: unknown) => unknown;
-export function registerSessionSidebarHost(host: SessionSidebarHost): () => void;
+export type SessionSidebarState = { archived: Record<string, number> };
+export function registerSessionSidebarHost(
+  host: SessionSidebarHost,
+  options?: { state?: (() => SessionSidebarState | Promise<SessionSidebarState>) | null }
+): () => void;
 export function applySessionSidebarChange(sessionId: string, change: SessionSidebarChange): Promise<void>;
+export function readSessionSidebarState(): Promise<SessionSidebarState | null>;

package/src/runtime/shared/session-sidebar-host.mjs

@@ -15,11 +15,15 @@ function hosts() {
 
 /**
  * Register a desktop host. `host(sessionId, change)` applies one change:
- * `{ favorite: boolean }` or `{ archived: boolean }`.
+ * `{ favorite: boolean }`, `{ archived: boolean }` (an archive takes the
+ * session's sub-agent sessions with it, a restore brings back the ones it took),
+ * `{ archived: true, cascade: false }` (that session alone)
+ * or `{ forgotten: true }` (a session the store deleted: its records go).
+ * `state()` answers the archive flags: `{ archived }`, session id → stamp.
  * @returns {() => void} Unregister.
  */
-export function registerSessionSidebarHost(host) {
-  const entry = { host };
+export function registerSessionSidebarHost(host, { state = null } = {}) {
+  const entry = { host, state: typeof state === 'function' ? state : null };
   hosts().push(entry);
   return () => {
     const list = hosts();
@@ -36,3 +40,12 @@ export async function applySessionSidebarChange(sessionId, change) {
   if (!active) throw new Error('no desktop app is attached to this runtime');
   await active.host(sessionId, change);
 }
+
+/** The active desktop's flags, `{ archived }` (session id → epoch-ms stamp);
+ *  null when no desktop (or one without a state reader) is attached. */
+export async function readSessionSidebarState() {
+  const active = hosts().at(-1);
+  if (!active?.state) return null;
+  const state = await active.state();
+  return { archived: { ...state?.archived } };
+}

package/src/runtime/shared/singleton-owner.mjs

@@ -1,6 +1,6 @@
-import { mkdirSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { rmdirSync, rmSync, statSync } from 'node:fs';
 import { readFile, rename, rm, rmdir, stat, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { writeJsonAtomicSync } from './atomic-file.mjs';
 import { withFileLock, withFileLockSync } from './file-lock.mjs';
 import { readJsonSafe } from './json-file.mjs';
 import { isPidAlive } from './pid-liveness.mjs';
@@ -19,11 +19,12 @@ const CLAIM_LOCK_STALE_MS = 5000;
 const CLAIM_LOCK_OPTS = Object.freeze({ timeoutMs: CLAIM_LOCK_TIMEOUT_MS, staleMs: CLAIM_LOCK_STALE_MS });
 const BUSY = Symbol('claim lock busy');
 
+// A claim or handoff is flushed before it is published. The heartbeat's async
+// refresh below is not: it rewrites the record every few seconds, and a record
+// a crash leaves NUL reads as "no owner" (readJsonSafe), so the next claim
+// simply takes over.
 function writeJsonAtomic(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
-  renameSync(tmp, path);
+  writeJsonAtomicSync(path, value);
 }
 
 // Held by another live process or this one's async holder ('busy'). Any other

package/src/runtime/shared/skill-tool-dependencies.mjs

@@ -1,8 +1,9 @@
 // Explicit skill dependencies. Imported manifests are read, never rewritten.
-import { createHash, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { parseDocument } from 'yaml';
+import { writeFileAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const MAX_METADATA_BYTES = 64 * 1024;
@@ -119,12 +120,5 @@ export function saveSkillToolDependencies(filePath, dependencies) {
   const tools = normalizeSkillToolDependencies(dependencies, { strict: true });
   const content = `${JSON.stringify({ dependencies: { tools } }, null, 2)}\n`;
   if (Buffer.byteLength(content) > MAX_METADATA_BYTES) throw new Error('Skill dependency metadata is too large.');
-  mkdirSync(dirname(path), { recursive: true });
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
-    renameSync(temporary, path);
-  } finally {
-    rmSync(temporary, { force: true });
-  }
+  writeFileAtomicSync(path, content);
 }

package/src/runtime/shared/staged-update.mjs

@@ -50,7 +50,7 @@ import { resolvePluginData } from './plugin-paths.mjs';
 import { isPidAlive as pidAlive } from './pid-liveness.mjs';
 import { sleepSync } from './sleep.mjs';
 import { detachedSpawnOpts, hiddenSpawnOpts } from './spawn-flags.mjs';
-import { renameWithRetrySync } from './atomic-file.mjs';
+import { renameWithRetrySync, writeJsonAtomicSync } from './atomic-file.mjs';
 import {
   isDevInstall,
   localPackageVersion,
@@ -295,7 +295,9 @@ export async function runStagedInstall(version) {
 
     if (!existsSync(join(pkgDir, 'src', 'cli.mjs'))) return { ok: false, error: 'staged cli.mjs missing' };
     // Marker written LAST — its presence is the completion signal for the swap.
-    writeFileSync(markerPath(verDir), JSON.stringify({ version: v, pkgDir, stagedAt: Date.now() }), 'utf8');
+    // Published whole and flushed: a NUL marker would read as "not staged" and
+    // force a full re-install.
+    writeJsonAtomicSync(markerPath(verDir), { version: v, pkgDir, stagedAt: Date.now() }, { compact: true });
     return { ok: true, version: v, dir: pkgDir };
   } catch (err) {
     return { ok: false, error: err?.message || String(err) };

package/src/runtime/shared/statusline/statusline-segments.mjs

@@ -197,11 +197,11 @@ async function refreshShellJobsStatus(ownerPid) {
       }
       // A killed command whose processes are not confirmed gone has already
       // reported its result, so its tool card is closed: it is listed until
-      // its owner retires the record. Its root pid may be gone while a
-      // descendant lives, so the owner's liveness decides, not the root's.
+      // its owner retires the record. An incomplete observation can leave no
+      // known survivors even after the owner session closes; only the owning
+      // runtime can confirm termination, so its liveness decides, not the root's.
       const unconfirmed = detail?.terminationUnconfirmed === true;
-      if (unconfirmed ? !isHeldShellJobAlive(detail, ownerByJob.get(id)) : !(await isShellJobAlive(detail, p, dir, id)))
-        continue;
+      if (unconfirmed ? !isPidAlive(ownerByJob.get(id) || 0) : !(await isShellJobAlive(detail, p, dir, id))) continue;
       // A foreground command is awaited in its own tool card; listing it here
       // made every short command flash in and out of the shell list. Only
       // backgrounded jobs (including promoted ones) are background work.
@@ -327,17 +327,6 @@ function summarizeShellJobs({ count, oldestMs, jobs, bySession }) {
   return { count, elapsedLabel, jobs, sessions };
 }
 
-// A held record lives while its owner process does. Once its owner session
-// has closed, it also needs a process left to hold: the root or a survivor
-// its termination watch last reported. Without one it is an orphan whose
-// processes are gone, and it resolves instead of staying unconfirmed.
-function isHeldShellJobAlive(detail, ownerPid) {
-  if (!isPidAlive(ownerPid || 0)) return false;
-  if (detail?.ownerSessionClosed !== true) return true;
-  const survivors = Array.isArray(detail?.survivorPids) ? detail.survivorPids : [];
-  return [detail?.pid, ...survivors].some((pid) => isPidAlive(positiveInt(pid)));
-}
-
 async function isShellJobAlive(detail, detailPath, dir, id) {
   const pid = positiveInt(detail?.pid);
   if (!pid) return false;

package/src/runtime/shared/tool-execution-contract.mjs

@@ -1,4 +1,5 @@
 import { clean } from './clean.mjs';
+import { hopOf } from './bot-hops.mjs';
 import {
   parseTaskNotification,
   renderTaskCompletionEnvelope,
@@ -113,6 +114,8 @@ export function normalizeToolNotifyContext(context = {}) {
     callerSessionId: callerSessionId || null,
     routingSessionId: routingSessionId || null,
     clientHostPid,
+    // The bot-chain hop of the turn that launched the work (bot-hops.mjs).
+    ...(hopOf(context.hop) ? { hop: context.hop } : {}),
   };
 }
 
@@ -133,6 +136,7 @@ function toolCompletionMeta({ surface = 'tool', id, status, resultType, instruct
       ? { routing_session_id: ctx.routingSessionId }
       : {}),
     ...(ctx.clientHostPid ? { client_host_pid: String(ctx.clientHostPid) } : {}),
+    ...(ctx.hop ? { hop: ctx.hop } : {}),
   };
 }
 
@@ -236,6 +240,12 @@ export function isTranscriptHiddenToolItem(item) {
 // stopped, and the restored transcript must keep that row
 // (scripts/turn-checkpoint-crash-test.mjs).
 const INTERNAL_TRANSCRIPT_INTERRUPT_RE = /^\[request interrupted by user(?: for tool use)?\]$/i;
+// Every runtime control row written as a user turn when a turn is cut short
+// (including the bare "[Request interrupted]" a kept Stop prompt gets). One
+// pattern for "not real conversation": realTurnCount and the preview/title
+// noise filter both use it.
+export const CONTROL_MARKER_RE =
+  /^\[(?:truncated|request interrupted(?: by user(?: for tool use)?| by process restart)?)\]$/i;
 const TRANSCRIPT_CANCELLED_STATUS_RE = /^\[request interrupted(?: by process restart)?\]$/i;
 
 // Crash/implicit interruption markers remain in model-visible history for

package/src/runtime/shared/tool-work-units.mjs

@@ -573,6 +573,15 @@ function gitStageUnit(a) {
   });
 }
 
+function gitWorktreeUnit(a) {
+  return unitDescriptor('Git', {
+    active: 'Managing',
+    done: 'Managed',
+    noun: 'worktree',
+    effect: String(a.worktree_action || '').toLowerCase() !== 'list',
+  });
+}
+
 function cwdUnit(a) {
   const action = String(a.action || a.type || '').toLowerCase();
   // A bare `path` selects that Project even when action is omitted.
@@ -604,14 +613,6 @@ function cwdUnit(a) {
     const [active, done] = words;
     return unitDescriptor('Setup', { active, done, noun: 'session', effect: true });
   }
-  if (action.endsWith('-worktree') || action.endsWith('-worktrees')) {
-    return unitDescriptor('Setup', {
-      active: 'Managing',
-      done: 'Managed',
-      noun: 'worktree',
-      effect: !action.startsWith('list'),
-    });
-  }
   if (action === 'status') {
     return unitDescriptor('Setup', { active: 'Checking', done: 'Checked', noun: 'session' });
   }
@@ -715,7 +716,9 @@ const TOOL_UNITS = new Map([
     (a) =>
       a.action === 'stage'
         ? gitStageUnit(a)
-        : unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' }),
+        : a.action === 'worktree'
+          ? gitWorktreeUnit(a)
+          : unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' }),
   ],
   ['github', githubUnit],
   // Preserve the staging work unit when rendering historical transcripts.