mixdog 1.4.0 → 1.4.1

package/src/runtime/shared/session-scratch.mjs

@@ -0,0 +1,37 @@
+// Per-session scratch directory under Mixdog's data directory. Processes the
+// `shell` tool starts see it as TEMP/TMP/TMPDIR, so scratch files never land in
+// the project, and it is removed with its session (session-delete.mjs).
+import { mkdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolvePluginData } from './plugin-paths.mjs';
+
+const SESSION_ID = /^[A-Za-z0-9_-]+$/;
+
+/** The session's scratch path (not created), or '' for an unusable id. */
+export function sessionScratchDir(sessionId) {
+  const id = typeof sessionId === 'string' ? sessionId : '';
+  return SESSION_ID.test(id) ? join(resolvePluginData(), 'scratch', id) : '';
+}
+
+/** Create the session's scratch directory if absent; returns its path ('' without a session id). */
+export function ensureSessionScratchDir(sessionId) {
+  const dir = sessionScratchDir(sessionId);
+  if (dir) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+export function removeSessionScratchDir(sessionId) {
+  const dir = sessionScratchDir(sessionId);
+  if (dir) rmSync(dir, { recursive: true, force: true });
+}
+
+/** Point an env's temp variables at the session's scratch directory. */
+export function applySessionScratchEnv(env, sessionId) {
+  const dir = ensureSessionScratchDir(sessionId);
+  if (dir) {
+    env.TEMP = dir;
+    env.TMP = dir;
+    env.TMPDIR = dir;
+  }
+  return env;
+}

package/src/runtime/shared/tool-card-model/agent-surface.mjs

@@ -38,9 +38,7 @@ function agentNameFromResult(resultText) {
 // The agent identity a card shows: the call's own fields, else the result
 // envelope when the call only carried a tag/task id.
 function agentDisplayName(args, resultText = '') {
-  return (
-    titleizeAgentName(args?.agent || args?.subagent_type || args?.name || '') || agentNameFromResult(resultText)
-  );
+  return titleizeAgentName(args?.agent || args?.subagent_type || args?.name || '') || agentNameFromResult(resultText);
 }
 
 function agentModelLabel(args) {

package/src/runtime/shared/tool-card-model/card-status.mjs

@@ -7,13 +7,26 @@ import { backgroundTaskFailureStatusLabel } from '../err-text.mjs';
 import { agentTerminalDetail, isAgentTool } from './agent-surface.mjs';
 import { backgroundTaskElapsed, backgroundTaskFailureDetail, isBackgroundTaskTool } from './background-task.mjs';
 import { shellDisplayStatus } from './shell-surface.mjs';
-import { normalizeTerminalStatus, resultControlStatus, resultEnvelopeStatus, shellResultElapsed } from './terminal-status.mjs';
+import {
+  normalizeTerminalStatus,
+  resultControlStatus,
+  resultEnvelopeStatus,
+  shellResultElapsed,
+} from './terminal-status.mjs';
 import { mediaTerminalStatus } from './media-result.mjs';
 import { gitTerminalStatus } from './git-result.mjs';
 import { isUserControlCancellation } from '../tool-status.mjs';
 
 // Tools whose result opens with a task/bridge envelope that reports the call's status.
-const ENVELOPE_STATUS_TOOLS = new Set(['agent', 'bridge', 'task', 'web_search', 'search_query', 'image_query', 'web_search_call']);
+const ENVELOPE_STATUS_TOOLS = new Set([
+  'agent',
+  'bridge',
+  'task',
+  'web_search',
+  'search_query',
+  'image_query',
+  'web_search_call',
+]);
 
 function shellFragments(base, display, isShellSurface) {
   if (!isShellSurface) return { shellStatus: '', shellElapsed: '' };

package/src/runtime/shared/tool-result-summary.mjs

@@ -648,7 +648,7 @@ const summarizeAskUserResult = ({ text, translate }) => {
 
 const TOOL_RESULT_SUMMARIZERS = new Map(
   [
-    [['ask_user'], summarizeAskUserResult],
+    [['ask_user', 'handoff_user'], summarizeAskUserResult],
     [['read', 'view_image', 'read_mcp_resource'], summarizeReadResult],
     [['apply_patch'], summarizePatchResult],
     [['grep'], summarizeGrepResult],

package/src/runtime/shared/tool-surface.mjs

@@ -151,6 +151,7 @@ export function displayToolName(name, args = {}) {
     case 'request_user_input':
       return 'Ask User';
     case 'ask_user':
+    case 'handoff_user':
       return 'Question';
     case 'update_plan':
       return 'Plan';
@@ -239,6 +240,8 @@ export function summarizeToolArgs(name, args, { max = DEFAULT_SUMMARY_MAX } = {}
       return summarizeGithub(a, max);
     case 'goal':
       return compactParts([String(a.action || ''), truncateToolText(a.objective, max)]);
+    case 'handoff_user':
+      return '';
     case 'ask_user':
       return truncateToolText(
         (Array.isArray(a.questions) ? a.questions : [])

package/src/runtime/shared/tool-work-units.mjs

@@ -91,6 +91,7 @@ const TOOL_CATEGORY = new Map([
   ['goal', 'Setup'],
   ['request_user_input', 'Setup'],
   ['ask_user', 'Setup'],
+  ['handoff_user', 'Setup'],
   ['update_plan', 'Setup'],
   ['skill', 'Skill'],
   ['skill_execute', 'Skill'],
@@ -734,6 +735,7 @@ const TOOL_UNITS = new Map([
   ['code_graph', codeGraphUnit],
   ['request_user_input', () => unitDescriptor('Setup', { active: 'Asking', done: 'Asked', noun: 'user' })],
   ['ask_user', () => unitDescriptor('Setup', { active: 'Asking', done: 'Asked', noun: 'user' })],
+  ['handoff_user', () => unitDescriptor('Setup', { active: 'Asking', done: 'Asked', noun: 'user' })],
   ['update_plan', () => unitDescriptor('Setup', { active: 'Updating', done: 'Updated', noun: 'plan' })],
   ['list_mcp_resources', () => unitDescriptor('Setup', { active: 'Listing', done: 'Listed', noun: 'MCP resource' })],
   [

package/src/runtime/shared/turn-snapshot-store.mjs

@@ -117,16 +117,23 @@ function recordPath(sessionId) {
 function chain(sessionId, task) {
   const previous = writeChains.get(sessionId) || Promise.resolve();
   const next = previous.then(task, task);
-  writeChains.set(
-    sessionId,
-    next.then(
-      () => undefined,
-      () => undefined
-    )
+  const settled = next.then(
+    () => undefined,
+    () => undefined
   );
+  writeChains.set(sessionId, settled);
+  // A settled chain with nothing queued behind it holds no order to keep.
+  void settled.then(() => {
+    if (writeChains.get(sessionId) === settled) writeChains.delete(sessionId);
+  });
   return next;
 }
 
+/** Sessions with a write chain still held (tests). */
+export function _turnSnapshotWriteChainCountForTest() {
+  return writeChains.size;
+}
+
 async function readRecordFile(path) {
   try {
     const parsed = JSON.parse(await readFile(path, 'utf8'));

package/src/runtime/shared/worktrees/contract.mjs

@@ -27,6 +27,7 @@ const WORKTREE_ENTRY_STATES = Object.freeze(['creating', 'ready', 'deleting', 'r
 export const WORKTREE_ERROR_CODES = Object.freeze({
   WORKTREE_BUSY_JOBS: 'WORKTREE_BUSY_JOBS',
   WORKTREE_BRANCH_OCCUPIED: 'WORKTREE_BRANCH_OCCUPIED',
+  WORKTREE_DEFAULT_BRANCH: 'WORKTREE_DEFAULT_BRANCH',
   WORKTREE_DISK_INSUFFICIENT: 'WORKTREE_DISK_INSUFFICIENT',
   WORKTREE_LARGE_REPO_CONFIRM: 'WORKTREE_LARGE_REPO_CONFIRM',
   WORKTREE_DIRTY: 'WORKTREE_DIRTY',
@@ -54,6 +55,8 @@ export const WORKTREE_ERROR_CODES = Object.freeze({
 const DEFAULT_ERROR_MESSAGES = Object.freeze({
   WORKTREE_BUSY_JOBS: 'The session has running jobs; wait for them or stop them before changing its workspace.',
   WORKTREE_BRANCH_OCCUPIED: 'The branch is checked out in another worktree.',
+  WORKTREE_DEFAULT_BRANCH:
+    "The repository's default branch can't be opened in a worktree: the project folder could not switch to it while the worktree exists. Check it out in the project folder, or create a new branch for the worktree.",
   WORKTREE_DISK_INSUFFICIENT: 'Not enough free disk space to create the worktree.',
   WORKTREE_LARGE_REPO_CONFIRM: 'The repository is large; confirm before creating a worktree.',
   WORKTREE_DIRTY: 'The worktree has uncommitted changes.',
@@ -193,7 +196,7 @@ function record(value, name) {
  * @property {string|null} worktreeId Managed worktree id; null when running in the project folder.
  * @property {string|null} branch Checked-out branch at `cwd`; null when detached or not a repository.
  * @property {string|null} baseCommit Commit the worktree branch was created from.
- * @property {string|null} mergeTarget Branch the worktree merges into (the project folder's branch).
+ * @property {string|null} mergeTarget Branch the worktree merges into (the project folder's branch); null for an existing branch until a merge records it.
  * @property {number} revision Monotonic; advances on every committed workspace change.
  * @property {WorkspaceTransition} transition In-flight transition marker.
  */

package/src/runtime/shared/worktrees/git.mjs

@@ -186,6 +186,21 @@ export async function localBranches(cwd, { signal, prefix = '' } = {}) {
   return lines(result.stdout);
 }
 
+/** The local branch names the repository's remotes declare as their default (`refs/remotes/<remote>/HEAD`). */
+export async function remoteDefaultBranches(cwd) {
+  const result = await runGit(cwd, ['for-each-ref', '--format=%(refname) %(symref)', 'refs/remotes'], {
+    readOnly: true,
+  });
+  const names = [];
+  for (const line of lines(result.stdout)) {
+    const [ref, target] = line.split(' ');
+    if (!ref.endsWith('/HEAD') || !target) continue;
+    const remote = ref.slice(0, -'HEAD'.length);
+    if (target.startsWith(remote)) names.push(target.slice(remote.length));
+  }
+  return names;
+}
+
 export async function validBranchName(cwd, branch) {
   if (typeof branch !== 'string' || !branch.trim() || branch.startsWith('-')) return false;
   const result = await runGit(cwd, ['check-ref-format', '--branch', branch], { allowFailure: true });

package/src/runtime/shared/worktrees/manager.mjs

@@ -49,6 +49,7 @@ import {
   WORKTREE_SNAPSHOT_KIND,
   worktreeBranchName,
   worktreeError,
+  worktreeRefusal,
 } from './contract.mjs';
 import {
   assertCarryable,
@@ -68,6 +69,7 @@ import {
   listWorktrees,
   localBranches,
   parseStatusPaths,
+  remoteDefaultBranches,
   runGit,
   throwIfAborted,
   validBranchName,
@@ -757,6 +759,11 @@ export async function resolveBranchWorkspace({
         repoCommonDir: repo.repoCommonDir,
       };
     }
+    // Checked out in a managed worktree, the branch a remote declares its
+    // default would stay locked away from the project folder.
+    if (!create && (await remoteDefaultBranches(repo.projectPath)).includes(branch)) {
+      throw worktreeError('WORKTREE_DEFAULT_BRANCH', undefined, { branch });
+    }
     const entry = await createManagedWorktree({
       projectPath,
       sessionId,
@@ -770,10 +777,6 @@ export async function resolveBranchWorkspace({
       confirmLarge,
       signal,
     });
-    const record = await getRecord(entry.id);
-    record.mergeTarget = repo.currentBranch;
-    await putRecord(record);
-    entry.mergeTarget = repo.currentBranch;
     return { path: entry.path, branch, entry, created: true, repoCommonDir: repo.repoCommonDir };
   });
 }
@@ -1219,7 +1222,10 @@ export async function createManagedWorktree({
         path: managedWorktreePath(repo.repoCommonDir, slug),
         branch,
         baseCommit,
-        mergeTarget,
+        // An existing branch has no base it branched from: it merges where a
+        // merge first takes it (recorded then), and until that its own work is
+        // what it gained here since baseCommit.
+        mergeTarget: existingBranch ? null : mergeTarget,
         createdAt: Date.now(),
         ownerSessionId: owner.sessionId,
         existingBranch,
@@ -1400,9 +1406,7 @@ export async function removeSessionSnapshots(sessionId, { txIds = null } = {}) {
   const only = txIds ? new Set(txIds) : null;
   const held = Object.values((await readRegistry()).entries).filter(
     (record) =>
-      record.kind === WORKTREE_SNAPSHOT_KIND &&
-      record.holderSessionId === sessionId &&
-      (!only || only.has(record.txId))
+      record.kind === WORKTREE_SNAPSHOT_KIND && record.holderSessionId === sessionId && (!only || only.has(record.txId))
   );
   for (const record of held) {
     const row = { id: record.id, txId: record.txId };
@@ -1854,19 +1858,59 @@ export async function removeManagedWorktree({
       if (!current && !expected) throw worktreeError('WORKTREE_MISSING', undefined, { entryId });
       return skipped;
     }
-    assertNotShared(current, sessionId);
-    if (current.state === 'creating' || current.state === 'recovery') {
-      const rollback = await rollbackCreation(current);
-      return rollback.complete ? { removed: true } : { removed: false, retryable: true, remaining: rollback.remaining };
+    return removeLocked(current, { force, sessionId, preserveBranch, safeOnly });
+  });
+}
+
+/** The removal of `current`, under its repository lock. */
+async function removeLocked(current, { force, sessionId, preserveBranch = false, safeOnly = false }) {
+  assertNotShared(current, sessionId);
+  if (current.state === 'creating' || current.state === 'recovery') {
+    const rollback = await rollbackCreation(current);
+    return rollback.complete ? { removed: true } : { removed: false, retryable: true, remaining: rollback.remaining };
+  }
+  // Every deletion attempt of a snapshot, a resumed one included, waits
+  // for (refuses on) its consumers.
+  const release = current.kind === WORKTREE_SNAPSHOT_KIND ? holdSnapshotFolder(current) : () => {};
+  try {
+    return await decideAndFinishDeletion(current, { force, preserveBranch, safeOnly });
+  } finally {
+    release();
+  }
+}
+
+/**
+ * Remove a worktree whose owner is gone, on an explicit request: under the
+ * repository lock its retention is read again right before anything moves,
+ * so an owner that came back (a live session, a running lease holder) or a
+ * session the store still keeps it for refuses (WORKTREE_BUSY_JOBS). Then
+ * the ordinary removal guards apply (dirty or unmerged work needs `force`).
+ * @param {{ entryId: string, force?: boolean, liveSessionIds?: string[], retainedSessionIds?: string[] }} input
+ */
+export async function removeOrphanedWorktree({
+  entryId,
+  force = false,
+  liveSessionIds = [],
+  retainedSessionIds = [],
+} = {}) {
+  const record = await getRecord(entryId);
+  if (!record) throw worktreeError('WORKTREE_MISSING', undefined, { entryId });
+  return withRepoLock(record.repoCommonDir, async () => {
+    const current = await getRecord(entryId);
+    if (!current || current.kind === WORKTREE_SNAPSHOT_KIND) {
+      throw worktreeError('WORKTREE_MISSING', undefined, { entryId });
     }
-    // Every deletion attempt of a snapshot, a resumed one included, waits
-    // for (refuses on) its consumers.
-    const release = current.kind === WORKTREE_SNAPSHOT_KIND ? holdSnapshotFolder(current) : () => {};
-    try {
-      return await decideAndFinishDeletion(current, { force, preserveBranch, safeOnly });
-    } finally {
-      release();
+    const { ownerLive, removable } = await retentionOf(current, new Set(liveSessionIds), new Set(retainedSessionIds));
+    if (ownerLive) throw worktreeRefusal('workspace-lease', { entryId });
+    if (!removable) {
+      // Retained recovery data names itself; otherwise sessions still keep it.
+      await assertRecoveryStoresClear(current);
+      throw worktreeRefusal('workspace-retained', {
+        entryId,
+        sessions: [current.ownerSessionId, ...(current.sharedSessionIds ?? [])].filter(Boolean),
+      });
     }
+    return removeLocked(current, { force });
   });
 }
 
@@ -1900,25 +1944,7 @@ export async function listManagedWorktrees({ liveSessionIds = [], retainedSessio
   const retained = new Set(retainedSessionIds);
   const rows = [];
   for (const record of Object.values((await readRegistry()).entries)) {
-    const snapshot = record.kind === WORKTREE_SNAPSHOT_KIND;
-    const ownerLive = snapshot
-      ? await snapshotHolderLive(record, live)
-      : (!!record.ownerSessionId && live.has(record.ownerSessionId)) ||
-        leaseProcessAlive(await readOwnerLease(record));
-    const isRetained = !!record.ownerSessionId && retained.has(record.ownerSessionId);
-    // A snapshot outlives no holder: the prune removes it, changes and all.
-    let removable = snapshot
-      ? !ownerLive
-      : !record.sharedSessionIds?.length &&
-        (record.state !== 'ready' || (!ownerLive && (record.disposable === true || !isRetained)));
-    if (removable) {
-      try {
-        await assertRecoveryStoresClear(record);
-      } catch (error) {
-        if (error?.code !== 'WORKTREE_FILE_RECOVERY') throw error;
-        removable = false;
-      }
-    }
+    const { ownerLive, retained: isRetained, removable } = await retentionOf(record, live, retained);
     rows.push({
       ...entryView(record),
       projectPath: record.projectPath,
@@ -1930,6 +1956,29 @@ export async function listManagedWorktrees({ liveSessionIds = [], retainedSessio
   return rows;
 }
 
+/** Who keeps `record` (listManagedWorktrees): `live` and `retained` are session id sets. */
+async function retentionOf(record, live, retained) {
+  const snapshot = record.kind === WORKTREE_SNAPSHOT_KIND;
+  const ownerLive = snapshot
+    ? await snapshotHolderLive(record, live)
+    : (!!record.ownerSessionId && live.has(record.ownerSessionId)) || leaseProcessAlive(await readOwnerLease(record));
+  const isRetained = !!record.ownerSessionId && retained.has(record.ownerSessionId);
+  // A snapshot outlives no holder: the prune removes it, changes and all.
+  let removable = snapshot
+    ? !ownerLive
+    : !record.sharedSessionIds?.length &&
+      (record.state !== 'ready' || (!ownerLive && (record.disposable === true || !isRetained)));
+  if (removable) {
+    try {
+      await assertRecoveryStoresClear(record);
+    } catch (error) {
+      if (error?.code !== 'WORKTREE_FILE_RECOVERY') throw error;
+      removable = false;
+    }
+  }
+  return { ownerLive, retained: isRetained, removable };
+}
+
 /**
  * Conservative reconcile (daemon startup, and the manual prune). Always:
  * resumes interrupted deletions, rolls back interrupted creations of no

package/src/runtime/shared/worktrees/test-support.mjs

@@ -1,26 +1,22 @@
 // Temporary git repositories and data dirs for the worktree suites.
 import '../git-direct.test-support.mjs';
 import { execFileSync } from 'node:child_process';
-import { appendFileSync, chmodSync, cpSync, existsSync, mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { appendFileSync, chmodSync, cpSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { makeTempDirSync, removeTempDirSync } from '../../../../scripts/lib/scoped-temp.mjs';
 
 const created = [];
 
+// A suite that never calls cleanupTempDirs still has its directories removed
+// when the process exits.
 export function tempDir(prefix = 'mixdog-wt-') {
-  const dir = mkdtempSync(join(tmpdir(), prefix));
+  const dir = makeTempDirSync(prefix);
   created.push(dir);
   return dir;
 }
 
 export function cleanupTempDirs() {
-  for (const dir of created.splice(0)) {
-    try {
-      rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
-    } catch {
-      /* best effort */
-    }
-  }
+  for (const dir of created.splice(0)) removeTempDirSync(dir);
 }
 
 const GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_EDITOR: 'true' };

package/src/runtime/visualize-bridge/client.mjs

@@ -163,6 +163,8 @@ export async function executeVisualizeTool(args, options = {}) {
     cwd: options.cwd || process.cwd(),
     action: validated.action,
     input: validated.input,
+    // The call's id: the host names it in its turn-end record of opens whose tab is gone.
+    ...(options.callId ? { callId: String(options.callId) } : {}),
   };
   let discovery = readBridgeDiscovery(DISCOVERY_FILE);
   if (!discovery) return toolError(unavailableMessage());

package/src/session-runtime/agent-home-delivery.mjs

@@ -332,6 +332,9 @@ export function createRoutineResultQueue(
     rounds: section(doc, 'rounds'),
     // Reporting turns not yet queued, by submission id (agent-task-sessions.mjs).
     watches: section(doc, 'watches'),
+    // The bot-sent turns that hold no watch (reports off, or a watch that could
+    // not be stored), by submission id: work a restart re-attaches.
+    owned: section(doc, 'owned'),
     // Posted task results whose wake turn was not taken yet, per home.
     wakes: section(doc, 'wakes'),
   });
@@ -559,6 +562,26 @@ export function createRoutineResultQueue(
         return { ...doc, watches };
       });
     },
+    /** Keep `work` ({ runId, agentId, taskSessionId, owner, at }): a bot-sent
+     *  turn that reports nothing, until its work ends. It is no watch: it
+     *  owes no report, starts no hand-off and takes no part in a watch cap. */
+    async own(work) {
+      await update((doc) => ({ ...doc, owned: { ...doc.owned, [work.runId]: work } }));
+    },
+    /** Every stored record of bot-sent work that reports nothing, oldest first. */
+    async owned() {
+      return Object.values((await read()).owned);
+    },
+    /** Drop the records of `runIds` (a run id or a list; their work ended), in one write. */
+    async disown(runIds) {
+      const ids = [runIds].flat();
+      await update((doc) => {
+        if (!ids.some((runId) => doc.owned[runId])) return undefined;
+        const owned = { ...doc.owned };
+        for (const runId of ids) delete owned[runId];
+        return { ...doc, owned };
+      });
+    },
     /** The user spoke in `homeId`: its round trips count from zero again. */
     async resetRounds(homeId) {
       await update((doc) => {
@@ -1351,6 +1374,9 @@ export function createAgentHomeDelivery({
     unwatchTask: (runId) => queue.unwatch(runId),
     followTask: (runId, submissionId) => queue.followWatch(runId, submissionId),
     taskWatches: () => queue.watches(),
+    ownTask: (work) => queue.own(work),
+    disownTask: (runId) => queue.disown(runId),
+    ownedTasks: () => queue.owned(),
     resetRounds: (homeId) => queue.resetRounds(homeId),
   };
 }
@@ -1446,6 +1472,21 @@ export async function followAgentTask(runId, submissionId) {
   return (await processDelivery()).followTask(runId, submissionId);
 }
 
+/** Keep the record of one bot-sent turn that reports nothing until its work ends. */
+export async function ownAgentTask(work) {
+  return (await processDelivery()).ownTask(work);
+}
+
+/** Drop the record of one bot-sent turn that reports nothing (its work ended). */
+export async function disownAgentTask(runId) {
+  return (await processDelivery()).disownTask(runId);
+}
+
+/** The bot-sent turns that report nothing and whose work was not seen to end. */
+export async function agentOwnedTasks() {
+  return (await processDelivery()).ownedTasks();
+}
+
 /** A user's own message in `homeId`: its round trips with every target restart. */
 export async function resetAgentTaskRounds(homeId) {
   return (await processDelivery()).resetRounds(homeId);