aegis-desktop 0.5.0 → 0.5.3

package/lib/local/engine.js

@@ -109,18 +109,38 @@ const EFFORT_TOKEN_BUDGET = { low: 8192, medium: 16384, high: 32768 };
 const AUTONOMOUS_IDLE_TIMEOUT_MS = 15 * 60_000;
 
 /**
- * Only ever raises a too-low budget for a DeepSeek reasoning model — never
- * lowers whatever the caller (renderer dropdown, or "adaptive" ceiling)
- * already asked for. Everything else (non-DeepSeek models, non-reasoning
- * DeepSeek ids like deepseek-chat) passes through untouched. Effort defaults
- * to 'high' since custom endpoints have no effort selector of their own
- * (that UI is aegis-class/autonomous-only) — matching aegiscodex-dev's own
- * default effort.
+ * The budget a DeepSeek reasoning model runs on, resolved from EXACTLY ONE
+ * authority per call.
+ *
+ * A caller-stated number IS the budget, and is returned verbatim. For the
+ * non-pooled classes the renderer's max-tokens dropdown is the only budget
+ * control on offer — updateBudgetControls hides the effort row for them — so
+ * silently raising that number to an effort rung is precisely what made the
+ * figure beside the dropdown untrustworthy. The old form was
+ * `Math.max(stated, EFFORT_TOKEN_BUDGET[eff])`, which could only ever raise a
+ * deliberate cap: a caller asking for 1024 ran on 32768, and the number the
+ * UI displayed was never the number the call used.
+ *
+ * The effort rung is the DEFAULT, consulted only when no number was stated at
+ * all (the pooled class, which the renderer sends `effort` for and which the
+ * server sizes itself). This is the same rule doubledBudget() follows for its
+ * truncation retry: a stated cap is never overridden, by a rung or an order of
+ * magnitude.
+ *
+ * Truncated and empty turns are handled where they belong — the doubled-budget
+ * retry plus emptyTurnError — rather than by inflating the caller's ceiling up
+ * front. Escalating on a demonstrated empty turn is strictly cheaper than
+ * pre-emptively granting the top rung to every reasoning call.
+ *
+ * Everything else (non-DeepSeek models, non-reasoning DeepSeek ids like
+ * deepseek-chat) passes through untouched.
  */
-function deepseekReasoningFloor(model, maxTokens, effort) {
+function reasoningBudget(model, maxTokens, effort) {
   if (!DEEPSEEK_REASONING_MODEL_RE.test(String(model || ''))) return maxTokens;
+  const stated = Number(maxTokens);
+  if (Number.isFinite(stated) && stated > 0) return stated;
   const eff = effort === 'low' || effort === 'medium' ? effort : 'high';
-  return Math.max(Number(maxTokens) || 0, EFFORT_TOKEN_BUDGET[eff]);
+  return EFFORT_TOKEN_BUDGET[eff];
 }
 
 /** Relay model entries arrive as ids or objects; keep only real model ids. */
@@ -326,6 +346,15 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
   // In-memory only, on purpose — never persisted, so a restart (or
   // newChat()'s clearSessionApprovals) always starts from a clean gate.
   const sessionAllowlists = new Map(); // rootSessionId -> Set<toolName>
+  // Denials are remembered for the same reason allows are, mirroring it for
+  // the other answer. Without this, a "Deny" was forgotten the instant it was
+  // given: the model read `… the user denied the request`, re-planned, called
+  // the SAME tool again, and the gate raised a SECOND card — so one "no" cost
+  // the user a prompt per round for up to maxRounds (24 chat / 40 autonomous)
+  // rounds, each round re-sending the whole conversation to the provider. A
+  // gate that only remembers "yes" turns a single click into a retry storm;
+  // remembering "no" makes the first answer stick.
+  const sessionDenials = new Map(); // rootSessionId -> Set<toolName>
   const pendingApprovals = new Map(); // approvalId -> { resolve }
 
   function sessionAllows(rootId, name) {
@@ -338,10 +367,44 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
     sessionAllowlists.get(rootId).add(name);
   }
 
+  /** Has this conversation already refused this tool? Checked before the card
+   *  is raised, so a repeat call is refused outright instead of re-prompting. */
+  function sessionDenies(rootId, name) {
+    const set = sessionDenials.get(rootId);
+    return Boolean(set && set.has(name));
+  }
+
+  function denyForSession(rootId, name) {
+    if (!sessionDenials.has(rootId)) sessionDenials.set(rootId, new Set());
+    sessionDenials.get(rootId).add(name);
+  }
+
+  /**
+   * The text a refused tool hands back to the model. The old one-line
+   * `"<tool> was not executed — the user denied the request."` read to a
+   * capable agent as a transient failure to route around: it would apologise,
+   * pick a different command that does the same thing, and call the gate
+   * again. This says the durable part out loud (the refusal covers the rest of
+   * the conversation, not just that call) and asks for the one response that
+   * actually helps — say what you need and stop, so the user can re-enable it.
+   */
+  function denialText(name) {
+    return (
+      `${name} was not executed — the user denied this tool for this conversation. ` +
+      `Do NOT retry it and do NOT attempt the same effect by another route ` +
+      `(another command, a writeFile instead of an edit, a subagent). ` +
+      `Stop calling tools and reply in plain text: say what you were trying to do, ` +
+      `what you need, and that the user can re-enable ${name} to let it proceed.`
+    );
+  }
+
   /** newChat() in the renderer calls this so a fresh conversation never
-   *  inherits a prior thread's blanket allows. */
+   *  inherits a prior thread's blanket allows — or its refusals. A new chat is
+   *  a new gate in both directions: leaving denials behind would silently
+   *  refuse a tool in a thread where the user never said no. */
   function clearSessionApprovals(rootSessionId) {
     sessionAllowlists.delete(rootSessionId);
+    sessionDenials.delete(rootSessionId);
     return { ok: true };
   }
 
@@ -359,22 +422,28 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
 
   /**
    * Ask the renderer to approve one mutating tool call. Resolves 'once',
-   * 'session' or 'deny'. Sent over `rootOnDelta` (see chat()) as an
-   * `{ approval }` chunk so it rides the exact same streaming channel as
-   * tool-activity chunks — no new IPC surface needed on the push side, only
-   * on the reply side (respondApproval). Fails safe: no listener able to
-   * ever answer (no onDelta, or the turn was aborted) resolves 'deny'
-   * instead of hanging the tool round forever.
+   * 'session' or 'deny' (an explicit choice by the user) — or 'cancel' when
+   * nobody ever answered: no listener able to reply, or the turn was aborted.
+   * 'cancel' is kept apart from 'deny' on purpose. Both refuse the call, but
+   * only 'deny' is a decision the user made, so only 'deny' may be remembered
+   * as "this conversation said no" (see sessionDenials). Folding the two
+   * together — which is what the old fail-safe did, resolving 'deny' for an
+   * abort — would let a cancelled turn permanently refuse a tool the user
+   * never ruled on. Sent over `rootOnDelta` (see chat()) as an `{ approval }`
+   * chunk so it rides the exact same streaming channel as tool-activity
+   * chunks — no new IPC surface needed on the push side, only on the reply
+   * side (respondApproval). Fails safe: an unanswered request refuses the
+   * call instead of hanging the tool round forever.
    */
   function requestApproval(rootSessionId, rootOnDelta, signal, info) {
     return new Promise((resolve) => {
       if (signal && signal.aborted) {
-        resolve('deny');
+        resolve('cancel');
         return;
       }
       const id = randomUUID();
       let settled = false;
-      const onAbort = () => finish('deny');
+      const onAbort = () => finish('cancel');
       const finish = (decision) => {
         if (settled) return;
         settled = true;
@@ -385,7 +454,7 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       if (signal) signal.addEventListener('abort', onAbort, { once: true });
       pendingApprovals.set(id, { resolve: finish });
       if (typeof rootOnDelta !== 'function') {
-        finish('deny');
+        finish('cancel');
         return;
       }
       rootOnDelta({
@@ -420,6 +489,13 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
     if (!T.MUTATING_TOOLS.has(name)) return T.executeTool(name, args, toolCtx);
     if (!confirmModeEnabled()) return T.executeTool(name, args, toolCtx);
     if (sessionAllows(rootSessionId, name)) return T.executeTool(name, args, toolCtx);
+    // Already refused in this conversation: refuse again WITHOUT raising a
+    // second card. Before this, the model's retry after a denial re-prompted
+    // the user for the same tool — one "no" produced a card per round for up
+    // to maxRounds rounds, each one a billed provider call re-sending the
+    // whole conversation. Checked after the confirm-mode short-circuit so
+    // turning the gate off still overrides an earlier refusal.
+    if (sessionDenies(rootSessionId, name)) return { ok: false, error: denialText(name) };
 
     let preview = null;
     if (name === 'writeFile' || name === 'editFile') {
@@ -433,8 +509,15 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       diff: preview && preview.diff,
     });
 
+    // Only a click is remembered. 'cancel' (aborted turn / nobody able to
+    // answer) refuses this call but must not write a durable "no" the user
+    // never gave.
     if (decision === 'deny') {
-      return { ok: false, error: `${name} was not executed — the user denied the request.` };
+      denyForSession(rootSessionId, name);
+      return { ok: false, error: denialText(name) };
+    }
+    if (decision !== 'session' && decision !== 'once') {
+      return { ok: false, error: `${name} was not executed — the request was cancelled.` };
     }
     if (decision === 'session') allowForSession(rootSessionId, name);
 
@@ -545,7 +628,24 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         messages: opts.messages,
         model: opts.model,
         mode: opts.mode,
-        maxTokens: opts.maxTokens,
+        // Only a cap the caller STATED travels; an effort-derived one does not.
+        // The server derives its own budget from `effort` (aegis1 pass_budgets
+        // splits its ladder across workers + synthesis), so forwarding the
+        // derived number states one decision twice — and the copies had already
+        // drifted: 974adc5 doubled aegis1's ladder while this side stood still,
+        // leaving the client capping below the budget it displayed. The cap was
+        // never the one the renderer showed either (updateBudgetControls hides
+        // the max-tokens dropdown for the pooled class). Omitting the field is
+        // what tells aegis1 "no cap stated — let effort decide", the same
+        // contract aegiscodex-dev sends.
+        //
+        // A cap the caller DID state is a different thing, and dropping it was
+        // a bug: aegis1 reads a body max_tokens as a ceiling over its ladder,
+        // so omitting it does not bound the call — it grants the full top rung
+        // instead. A deliberate 4096 would have run at 32768, which is the same
+        // "only ever raise the caller's ceiling" failure the old
+        // Math.max(Number(maxTokens) || 0, EFFORT_TOKEN_BUDGET[eff]) had.
+        maxTokens: opts.statedMaxTokens,
         stream: opts.stream !== false,
         // The pooled (Nexus) brain is streamed, and an OpenAI-compatible SSE
         // stream reports no token usage unless asked. Without this the Aegis
@@ -561,12 +661,53 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         // AUTONOMOUS_IDLE_TIMEOUT_MS). Undefined elsewhere -> 60s default.
         idleTimeoutMs: opts.idleTimeoutMs,
         signal: opts.signal,
-        // aegis_memory: automatic, no button — the server both reads prior
-        // synced memory into context AND writes this turn back to it, the
-        // same flag aegis-online sets. Matches aegiscodex-dev's own
-        // cross-session memory (auto-indexed, no manual tagging).
+        // aegis_recall — the read half of aegis_memory, and the only half a
+        // client on this engine should send.
+        //
+        // aegis_memory is both halves: it injects the account's synced memory
+        // into context AND persists this turn back into it, charging sync
+        // quota for the write. That pairing is right for aegis-online, whose
+        // chat has nowhere else to live. It is wrong here, because this engine
+        // is shared by the GUI and the CLI (cli/src/deps.js loads this file):
+        // either would be billed for every "hey" and would fill the user's
+        // memory with greetings. Verified against aegis1 app.py: every
+        // write-back site (the note/upsert calls) is gated on aegis_memory,
+        // and aegis_memory implies aegis_recall there — so dropping the write
+        // half leaves /online unchanged and costs nothing on the read side.
+        //
+        // Writing is still available, explicitly: the aegis_memory_save tool
+        // (mcp/tools.js; the CLI exposes it as /memory). Recall on every turn,
+        // store only what the user asks for — which is what aegiscodex-dev's
+        // own cross-session memory does, and what this comment claimed to
+        // match while sending both halves.
+        //
+        // Recall was previously unreachable for a client that would not pay
+        // for it: services/tiered_recall.py only ran behind a flag that also
+        // bought a write, so the tiered path existed with no caller able to
+        // afford it. The split is what makes it reachable. The DEEP tier of the
+        // same read is a third flag with its own price — see `opts.recallDeep`
+        // below, which is off unless the session opted in.
         extra: {
-          aegis_memory: true,
+          aegis_recall: true,
+          // The DEEP tier of that read — brain corrections plus the semantic
+          // answer cache — is not the same price, so it does not ride along.
+          // aegis1 app.py:8367 reads `aegis_recall_deep` (or the
+          // X-AEGIS-Recall-Deep header) and services/brain_memory.py
+          // find_cached_answer embeds the query: one provider embedding per
+          // turn, metered. The server deliberately implies it from
+          // `aegis_memory` and NOT from `aegis_recall`, so that a terminal
+          // client can buy the cheap read without the embedding.
+          //
+          // This client is that terminal client (the CLI loads this file via
+          // cli/src/deps.js), so it must not opt itself in: the flag is sent
+          // only when the SESSION asked for it — CLI `/memory-deep on`, a
+          // desktop payload with `recallDeep: true` — and it defaults false
+          // everywhere. It also travels only on the user's own turn
+          // (`opts.recallDeep` is cleared for every other dispatch below): a
+          // tool round, the doubled-budget retry and the write-up re-dispatch
+          // all re-send a context whose embedding the first round already
+          // bought, which would turn one embedding per turn into one per round.
+          ...(opts.recallDeep ? { aegis_recall_deep: true } : {}),
           session: opts.sessionId,
           // The fan-out is opt-in per dispatch. `brain` is sent EXPLICITLY
           // whenever this dispatch is not the autonomous one, because the
@@ -638,7 +779,16 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
   async function chat(payload, onDelta) {
     const cls = payload && payload.class;
     const model = payload && payload.model;
-    const maxTokens = deepseekReasoningFloor(model, payload && payload.maxTokens, payload && payload.effort);
+    const maxTokens = reasoningBudget(model, payload && payload.maxTokens, payload && payload.effort);
+    // The caller's OWN number, kept apart from `maxTokens` above. That one
+    // collapses two different facts into a single value — "the caller stated
+    // 4096" and "effort implies 32768" — and the pooled path must treat them
+    // differently. A stated cap is a liability ceiling the server honours
+    // downward (aegis1 pass_budgets: total = min(ladder, max_tokens x passes));
+    // an effort-derived one is the server's own arithmetic stated twice, and
+    // sending it is how the two copies came to disagree. So the pooled call
+    // forwards only what the caller actually asked for.
+    const statedMaxTokens = Number(payload && payload.maxTokens) > 0 ? Number(payload.maxTokens) : undefined;
     // "Work autonomously" — routes this call through aegis1's pool_brain
     // worker fan-out (services/pool_brain.py: N reasoning workers + a
     // synthesis pass) instead of a single provider call. UI-gated to the
@@ -710,9 +860,17 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       }
 
       const base = {
-        cls, model, mode: payload && payload.mode, maxTokens, autonomous, sessionId, signal, onDelta, cfg, apiKey, toolChoice,
+        cls, model, mode: payload && payload.mode, maxTokens, statedMaxTokens, autonomous, sessionId, signal, onDelta, cfg, apiKey, toolChoice,
         effort: payload && payload.effort,
         workers: payload && payload.workers,
+        // Deep recall (`aegis_recall_deep`) is an explicit per-session opt-in
+        // and never a default: it costs one provider embedding per turn
+        // server-side (aegis1 services/brain_memory.py find_cached_answer), so
+        // a client that pays per turn must not turn it on for itself. Only a
+        // literal `true` from the caller counts — an absent or `undefined`
+        // field is off, which is what keeps every existing caller (the
+        // renderer's IPC payloads included) on the cheap read.
+        recallDeep: payload && payload.recallDeep === true,
         onReasoning,
         idleTimeoutMs: autonomous ? AUTONOMOUS_IDLE_TIMEOUT_MS : undefined,
         // A caller with no live streaming surface (a `--no-stream` CLI flag, a
@@ -741,6 +899,26 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       let truncationRetried = false;
       let synthesisDone = false;
 
+      // Round cap — the bound aegiscodex-dev has had all along and this engine
+      // did not. Removing the old fixed cap (12) was right in spirit and wrong
+      // in effect: it left the turn with NO horizon, and on 2026-09-15 the
+      // question "can you check the plan" ran ~70 rounds, grew the context
+      // from 2,260 to 116,011 tokens, cost about EUR 2, and spent those rounds
+      // writing 400 lines of unrequested code into the source tree. Each round
+      // re-sends the whole conversation, so an unbounded loop gets more
+      // expensive the longer it runs.
+      //
+      // The numbers match aegiscodex-dev's (src/autonomous.js) so both clients
+      // behave the same: 24 rounds for a chat turn, 40 for an autonomous one.
+      // Env-overridable for a deliberately long job.
+      const maxRounds = (() => {
+        const name = autonomous ? 'AEGIS_AUTONOMOUS_MAX_ROUNDS' : 'AEGIS_CHAT_MAX_ROUNDS';
+        const raw = Number.parseInt(process.env[name] || '', 10);
+        if (Number.isFinite(raw) && raw > 0) return raw;
+        return autonomous ? 40 : 24;
+      })();
+      let round = 0;
+
       // Token accounting for the whole TURN, not just its last round. An
       // agentic turn makes one provider call per tool round, and returning only
       // the final round's `usage` (what this did) reported a fraction of what
@@ -789,7 +967,30 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       };
 
       for (;;) {
-        const opts = { ...base, system, messages: history, prompt, tools: toolSchemas };
+        // Stop and SAY so. A turn that reaches its horizon has usually done
+        // real work; ending silently would paint an empty answer over it,
+        // which is the same "(empty response)" failure the guards below exist
+        // to prevent.
+        if (round >= maxRounds) {
+          const note =
+            `[stopped at ${maxRounds} tool rounds` +
+            `${turnUsage.total_tokens ? `, ${turnUsage.total_tokens.toLocaleString()} tokens` : ''}` +
+            `. Ask again to continue, or raise ` +
+            `${autonomous ? 'AEGIS_AUTONOMOUS_MAX_ROUNDS' : 'AEGIS_CHAT_MAX_ROUNDS'}.]`;
+          if (rootOnDelta) rootOnDelta({ delta: `\n\n${note}` });
+          return withTurnUsage({
+            model: base.model,
+            choices: [{ message: { content: note }, finish_reason: 'length' }],
+            stoppedOnRounds: true,
+          });
+        }
+        round += 1;
+        // `round === 1` is the user's own ask, and the ONLY dispatch allowed to
+        // carry the deep-recall opt-in: the deep tier embeds the query once per
+        // dispatch, so leaving it on for an agentic turn would charge one
+        // embedding per tool round instead of one per turn (the retries below
+        // clear it explicitly, being re-dispatches inside round 1).
+        const opts = { ...base, system, messages: history, prompt, tools: toolSchemas, recallDeep: base.recallDeep && round === 1 };
         let res;
         try {
           res = await dispatch(cls, opts);
@@ -833,7 +1034,17 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
           res = await dispatch(cls, {
             ...opts,
             singlePass: true,
+            // A re-dispatch, not a new ask: the deep tier's embedding was
+            // bought by round 1, and buying it again here would charge a
+            // second one for the same context.
+            recallDeep: false,
             maxTokens: doubledBudget(opts.maxTokens),
+            // Doubling applies to the pooled path only when the caller stated a
+            // number. With none stated, the server's effort ladder IS the
+            // budget, and sending doubledBudget's 8192 floor would *lower* it
+            // (aegis1 reads max_tokens as a ceiling over the ladder) — a
+            // "double the budget" retry that halves it at high effort.
+            statedMaxTokens: opts.statedMaxTokens ? doubledBudget(opts.statedMaxTokens) : undefined,
           });
           addUsage(res);
         }
@@ -858,6 +1069,9 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
           res = await dispatch(cls, {
             ...opts,
             singlePass: true,
+            // Same as the truncation retry above: this pass writes up findings
+            // already in `history`, and a fresh embedding buys it nothing.
+            recallDeep: false,
             messages: history,
             prompt: '',
             tools: [],

package/lib/local/prompt.js

@@ -31,8 +31,15 @@ const MAIN_CHAT_PROMPT =
   `- Use tools silently. A one-line reason is enough; do not narrate your plan as a story. ` +
   `- Never claim what a tool found or what a command returned before the tool actually runs. ` +
   `  Report only the results you really received. ` +
-  `- Act, don't just inspect. After at most 2 rounds of reading or exploration, start making ` +
-  `  changes with writeFile or editFile. Reconnaissance is not progress — implement, then verify.\n` +
+  `- Match the response to the request. A greeting, a question about something you already ` +
+  `  know, or a request for an opinion is answered in plain words with NO tools. Only reach ` +
+  `  for a tool when the answer genuinely depends on something in this repo or on this ` +
+  `  machine. "hey" is not a task.\n` +
+  `- WHEN THE USER HAS ASKED FOR WORK: act, don't just inspect. After at most 2 rounds of ` +
+  `  reading or exploration, start making changes with writeFile or editFile. Reconnaissance ` +
+  `  is not progress — implement, then verify. This rule is about HOW to carry out a task you ` +
+  `  were given; it is never a reason to invent one. Never write or modify a file the user ` +
+  `  did not ask you to touch.\n` +
   `- When you have what you need, stop using tools and give a concise, direct answer to the ` +
   `  user's question. Never end your turn with an intention like "Let me check…" or "I'll now…" ` +
   `  — that is not an answer. ` +

package/lib/local/providers.js

@@ -235,27 +235,69 @@ function openaiToAnthropicTool(tool) {
   };
 }
 
+/**
+ * Idle budget for a direct-provider stream: the longest silence tolerated
+ * between two real SSE `data:` frames. Without it `reader.read()` below waits
+ * forever on a provider that holds the socket open and never answers — the
+ * host hangs with no error and no way out but force-quit. Measured between
+ * payloads, never reset by a keep-alive: DeepSeek answers a stalled request
+ * with ": keep-alive" comments and nothing else, indefinitely, so a watchdog
+ * that treats those as progress can never fire.
+ * Generous enough that a slow reasoning model mid-answer is untouched.
+ */
+const SSE_IDLE_TIMEOUT_MS = 2 * 60_000;
+
 /** Read an SSE body, invoking onEvent(json) for each parsed `data:` payload. */
-async function readSSE(res, onEvent) {
+async function readSSE(res, onEvent, { idleTimeoutMs = SSE_IDLE_TIMEOUT_MS } = {}) {
   const reader = res.body.getReader();
   const decoder = new TextDecoder();
   let buffer = '';
+  let lastPayloadAt = Date.now();
+  let keepAlives = 0;
+  const readWithIdleTimeout = async () => {
+    let timer;
+    const remaining = Math.max(0, idleTimeoutMs - (Date.now() - lastPayloadAt));
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new Error(
+          keepAlives > 0
+            ? `stream stalled - only keep-alives for ${idleTimeoutMs / 1000}s`
+            : `stream stalled - no data for ${idleTimeoutMs / 1000}s`
+        ));
+      }, remaining);
+    });
+    try {
+      return await Promise.race([reader.read(), timeout]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
   for (;;) {
-    const { done, value } = await reader.read();
+    let done, value;
+    try {
+      ({ done, value } = await readWithIdleTimeout());
+    } catch (err) {
+      reader.cancel().catch(() => {});
+      throw err;
+    }
     if (done) break;
     buffer += decoder.decode(value, { stream: true });
     const lines = buffer.split('\n');
     buffer = lines.pop(); // keep the trailing partial line
     for (const raw of lines) {
       const line = raw.trim();
-      if (!line.startsWith('data:')) continue;
+      if (!line.startsWith('data:')) {
+        if (line.startsWith(':')) keepAlives++;
+        continue;
+      }
+      lastPayloadAt = Date.now(); // a real frame: the stream is still speaking
       const payload = line.slice(5).trim();
       if (!payload || payload === '[DONE]') continue;
       let json;
       try {
         json = JSON.parse(payload);
       } catch {
-        continue; // keepalive / partial line
+        continue; // partial line
       }
       onEvent(json);
     }
@@ -263,7 +305,7 @@ async function readSSE(res, onEvent) {
 }
 
 /** POST with stream:true; streams SSE events or falls back to plain JSON. */
-async function requestStream({ url, headers, body, signal, onEvent }) {
+async function requestStream({ url, headers, body, signal, onEvent, idleTimeoutMs }) {
   const res = await fetch(url, {
     method: 'POST',
     headers,
@@ -282,7 +324,7 @@ async function requestStream({ url, headers, body, signal, onEvent }) {
 
   const contentType = res.headers.get('content-type') || '';
   if (contentType.includes('text/event-stream')) {
-    await readSSE(res, onEvent);
+    await readSSE(res, onEvent, { idleTimeoutMs });
     return;
   }
 
@@ -342,15 +384,28 @@ async function openaiCompatible({
       if (json.usage) usage = json.usage;
       const choice = json.choices && json.choices[0];
       if (choice && choice.finish_reason) finishReason = choice.finish_reason;
-      const delta =
-        (choice &&
-          ((choice.delta && choice.delta.content) ||
-            (choice.message && choice.message.content))) ||
-        '';
-      if (delta) {
-        fullText += delta;
-        if (onDelta) onDelta({ delta });
+      // `delta.content` is an INCREMENT; `message.content` is a SNAPSHOT of
+      // the whole message. Collapsing them with `||` made any stream that
+      // ends with a message snapshot append the entire answer a second time —
+      // the same duplication the shared client had. Emit only the unseen tail.
+      const inc = choice && choice.delta && choice.delta.content;
+      const snap = choice && choice.message && choice.message.content;
+      let add = '';
+      if (typeof inc === 'string' && inc) {
+        add = inc;
+        fullText += inc;
+      } else if (typeof snap === 'string' && snap) {
+        if (!fullText) {
+          add = snap;
+          fullText = snap;
+        } else if (snap.startsWith(fullText)) {
+          add = snap.slice(fullText.length);
+          fullText = snap;
+        }
+        // Disjoint from what was already shown: appending would duplicate, so
+        // keep what the caller has seen.
       }
+      if (add && onDelta) onDelta({ delta: add });
       // Streamed fragments (delta.tool_calls) and the whole-answer shape a
       // non-streaming fallback returns (message.tool_calls) both land here.
       const fragments =