mixdog 0.9.140 → 0.9.142

package/LICENSES/MIT.txt

@@ -12,6 +12,10 @@ component listed here. Each component keeps its own copyright notice.
   https://github.com/microsoft/vscode-codicons
   Copyright (c) Microsoft Corporation
 
+  Octicons
+  https://github.com/primer/octicons
+  Copyright (c) GitHub, Inc.
+
   GitHub Pull Requests and Issues (VS Code extension)
   https://github.com/microsoft/vscode-pull-request-github
   Copyright (c) Microsoft Corporation. All rights reserved.

package/NOTICE.md

@@ -1,10 +1,8 @@
 # NOTICE
 
-Mixdog itself is MIT-licensed (see `LICENSE`). The license sections below
-cover third-party code and data that Mixdog actually carries. The closing
-"Behavioral references" section records projects that only informed the
-implementation, with no code taken. Everything is kept here in one place so
-the individual source files stay free of scattered attribution comments.
+Mixdog itself is MIT-licensed (see `LICENSE`). The sections below cover the
+third-party code and data that Mixdog actually carries, kept here in one place
+so the individual source files stay free of scattered attribution comments.
 
 Full license texts live in `LICENSES/`:
 
@@ -47,6 +45,15 @@ The chrome-level UI glyph font used by the desktop and web renderer. The code
 is MIT; the icons themselves are licensed under Creative Commons Attribution
 4.0 International (CC BY 4.0).
 
+### Octicons — Copyright (c) GitHub, Inc.
+
+<https://github.com/primer/octicons>
+
+The five changed-file status glyphs in
+`apps/desktop/src/renderer/ScmStatusIcon.tsx` carry Octicons 16px path data
+unmodified: `diffAdded`, `diffModified`, `diffRemoved`, `diffRenamed` and
+`alert`.
+
 ### GitHub Pull Requests extension — Copyright (c) Microsoft Corporation
 
 <https://github.com/microsoft/vscode-pull-request-github>
@@ -98,44 +105,3 @@ upstream NOTICE file is preserved as `LICENSES/codex-NOTICE.txt`.
 The Apache-2.0 terms require this notice to travel with any redistribution of
 the derived files. Full license text: `LICENSES/Apache-2.0.txt`
 (<https://www.apache.org/licenses/LICENSE-2.0>).
-
-## Behavioral references
-
-The projects below informed Mixdog through publicly observable behavior, a
-published wire contract, or a documented algorithm. No source code from them
-is present in Mixdog, so no license obligation travels with the result; they
-are recorded here because the source files themselves carry no attribution
-comments.
-
-- **Chromium** — the workspace tab strip follows Chromium's tab-strip layout
-  semantics: two layout domains around the crossover width, the active-tab
-  floor, the inactive sliver floor, the left-to-right remainder grant and the
-  icon visibility ladder. The implementation is independent TypeScript and CSS
-  on Mixdog's own constants (`apps/desktop/src/renderer/WorkspaceTabStrip.tsx`,
-  `apps/desktop/src/renderer/desktop/04-workspace-tabs.css`).
-- **GitHub Desktop** — the Source Control dock grammar: commit-form layout,
-  changed-file status glyph semantics, single-sentence path colouring, history
-  context-menu gating, and detached-checkout / tag rules. Painted entirely on
-  Mixdog's own semantic tokens.
-- **OpenCode** — transcript auto-scroll gesture grammar, virtual-timeline
-  anchoring and the streaming-markdown projection model.
-- **Orca** — editor-surface and tab-hierarchy structure, the terminal host
-  portal, the keep-awake power-save blocker and the hosted-review link
-  derivation.
-- **Files** — the folder pane's grouping keys, date-span labels, size buckets
-  and discrete layout size ladder
-  (`apps/desktop/src/renderer/FolderPane.lazy.tsx`).
-- **Claude Code** (Anthropic) — terminal input tokenizing and keypress
-  parsing, the TUI selection word model in `vendor/ink`, and interactive turn
-  semantics such as queued-message recall, message-selector rewind and
-  background-task lifetime. The Anthropic OAuth route additionally sends the
-  client identity that Anthropic's token edge validates; those values are a
-  wire requirement, not a derivation.
-- **opencode-antigravity-auth** — MIT
-  (<https://github.com/NoeFabris/opencode-antigravity-auth>). The Google Cloud
-  Code Assist wire contract used by the Antigravity OAuth provider: OAuth
-  client parameters, endpoint fallback order, client impersonation headers,
-  request envelope and thinking-signature handling.
-- **assistant-ui, Chatbox, Cherry Studio, Jan, Zed** — the heading-size and
-  list-density survey behind the desktop markdown ladder in
-  `apps/desktop/src/renderer/desktop/22-markdown.css`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.140",
+  "version": "0.9.142",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/manifest-cache-key.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+
+/**
+ * Version-neutral digest for release cache keys.
+ *
+ * Deploy rewrites the version field of package.json / package-lock.json on
+ * every release, so a cache key built from hashFiles() over those manifests is
+ * guaranteed to miss on the one run that needs it: the desktop bundle and the
+ * five prepared platform runtimes were rebuilt from scratch each release even
+ * though their inputs were byte-identical apart from the version string.
+ * Hashing the same manifests with the package identity stripped keeps the key
+ * pinned to the dependency tree that actually decides the output.
+ */
+import { createHash } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+import { normalizeRuntimeLockfile } from './runtime-dependency-cache-key.mjs'
+
+export const MANIFEST_CACHE_SCHEMA = 1
+
+export function manifestCacheKey(manifests) {
+  const digest = createHash('sha256')
+  digest.update(`manifest-v${MANIFEST_CACHE_SCHEMA}`)
+  for (const manifest of manifests) {
+    digest.update(JSON.stringify(normalizeRuntimeLockfile(manifest)))
+  }
+  return digest.digest('hex')
+}
+
+const invokedPath = process.argv[1] ? pathToFileURL(resolve(process.argv[1])).href : ''
+if (invokedPath === import.meta.url) {
+  const manifestPaths = process.argv.slice(2)
+  if (!manifestPaths.length) {
+    throw new Error('Usage: manifest-cache-key.mjs <package.json|package-lock.json>...')
+  }
+  Promise.all(manifestPaths.map((path) => readFile(resolve(path))))
+    .then((manifests) => process.stdout.write(`${manifestCacheKey(manifests)}\n`))
+    .catch((error) => {
+      process.stderr.write(`Manifest cache key failed: ${error?.message || error}\n`)
+      process.exitCode = 1
+    })
+}

package/scripts/native-binary-arch.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+
+/**
+ * Architecture of a compiled artifact, read from its own header.
+ *
+ * The desktop runtime is prepared for a TARGET that need not match the build
+ * host, and the expensive failure is silent: an arm64 addon inside an x64 app
+ * packages, uploads, and publishes without complaint, then refuses to load on
+ * the user's machine. Reading the header turns that into a build error at the
+ * moment the archive is assembled.
+ *
+ * Only the fields that name the architecture are parsed; nothing here loads or
+ * executes the file.
+ */
+
+// Mach-O cpu_type_t. The 0x01000000 bit marks the 64-bit variants.
+const MACHO_CPU = new Map([[0x01000007, 'x64'], [0x0100000c, 'arm64'], [7, 'ia32']])
+// ELF e_machine.
+const ELF_MACHINE = new Map([[0x3e, 'x64'], [0xb7, 'arm64'], [0x03, 'ia32']])
+// PE IMAGE_FILE_HEADER.Machine.
+const PE_MACHINE = new Map([[0x8664, 'x64'], [0xaa64, 'arm64'], [0x14c, 'ia32']])
+
+function machOArch(buffer) {
+  if (buffer.length < 8) return null
+  const magic = buffer.readUInt32BE(0)
+  // Thin Mach-O: 0xfeedfacf (64-bit) / 0xfeedface (32-bit), either endianness.
+  if (magic === 0xfeedfacf || magic === 0xfeedface) return MACHO_CPU.get(buffer.readUInt32BE(4)) || null
+  if (magic === 0xcffaedfe || magic === 0xcefaedfe) return MACHO_CPU.get(buffer.readUInt32LE(4)) || null
+  return null
+}
+
+/** Universal binaries name every slice they carry, so they are read as a set. */
+function machOFatArches(buffer) {
+  if (buffer.length < 8) return null
+  const magic = buffer.readUInt32BE(0)
+  // 0xcafebabe is also a Java class file; those never reach an addon path, and
+  // the slice count sanity check below rejects the overlap in practice.
+  if (magic !== 0xcafebabe && magic !== 0xcafebabf) return null
+  const wide = magic === 0xcafebabf
+  const count = buffer.readUInt32BE(4)
+  if (!count || count > 16) return null
+  const entrySize = wide ? 32 : 20
+  const arches = []
+  for (let index = 0; index < count; index += 1) {
+    const offset = 8 + index * entrySize
+    if (offset + 4 > buffer.length) return null
+    const arch = MACHO_CPU.get(buffer.readUInt32BE(offset))
+    if (arch) arches.push(arch)
+  }
+  return arches.length ? arches : null
+}
+
+function elfArch(buffer) {
+  if (buffer.length < 20) return null
+  if (buffer.readUInt32BE(0) !== 0x7f454c46) return null
+  const littleEndian = buffer[5] === 1
+  const machine = littleEndian ? buffer.readUInt16LE(18) : buffer.readUInt16BE(18)
+  return ELF_MACHINE.get(machine) || null
+}
+
+function peArch(buffer) {
+  if (buffer.length < 64 || buffer.readUInt16LE(0) !== 0x5a4d) return null
+  const headerOffset = buffer.readUInt32LE(60)
+  if (headerOffset + 6 > buffer.length) return null
+  if (buffer.readUInt32LE(headerOffset) !== 0x00004550) return null
+  return PE_MACHINE.get(buffer.readUInt16LE(headerOffset + 4)) || null
+}
+
+/**
+ * Every architecture the artifact can run on, or null when the bytes carry no
+ * recognizable object header (a text stub, a placeholder, a data file).
+ */
+export function nativeBinaryArches(buffer) {
+  const fat = machOFatArches(buffer)
+  if (fat) return fat
+  const single = machOArch(buffer) || elfArch(buffer) || peArch(buffer)
+  return single ? [single] : null
+}
+
+/** Convenience for the single-slice case; a fat binary reports its first slice. */
+export function nativeBinaryArch(buffer) {
+  return nativeBinaryArches(buffer)?.[0] ?? null
+}
+
+/**
+ * True when the artifact can run on `arch`. An unrecognized header answers
+ * true: the caller is verifying compiled objects, and refusing every file it
+ * cannot parse would fail builds over unrelated payloads.
+ */
+export function nativeBinaryRunsOn(buffer, arch) {
+  const arches = nativeBinaryArches(buffer)
+  return arches === null || arches.includes(arch)
+}

package/scripts/native-binary-arch.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  nativeBinaryArch,
+  nativeBinaryArches,
+  nativeBinaryRunsOn,
+} from './native-binary-arch.mjs'
+
+function machO({ cpu, littleEndian = true, wide = true }) {
+  const buffer = Buffer.alloc(32)
+  const magic = wide ? 0xfeedfacf : 0xfeedface
+  if (littleEndian) {
+    buffer.writeUInt32BE(wide ? 0xcffaedfe : 0xcefaedfe, 0)
+    buffer.writeUInt32LE(cpu, 4)
+  } else {
+    buffer.writeUInt32BE(magic, 0)
+    buffer.writeUInt32BE(cpu, 4)
+  }
+  return buffer
+}
+
+function machOFat(cpus) {
+  const buffer = Buffer.alloc(8 + cpus.length * 20)
+  buffer.writeUInt32BE(0xcafebabe, 0)
+  buffer.writeUInt32BE(cpus.length, 4)
+  cpus.forEach((cpu, index) => buffer.writeUInt32BE(cpu, 8 + index * 20))
+  return buffer
+}
+
+function elf(machine) {
+  const buffer = Buffer.alloc(32)
+  buffer.writeUInt32BE(0x7f454c46, 0)
+  buffer[5] = 1
+  buffer.writeUInt16LE(machine, 18)
+  return buffer
+}
+
+function pe(machine) {
+  const buffer = Buffer.alloc(128)
+  buffer.writeUInt16LE(0x5a4d, 0)
+  buffer.writeUInt32LE(64, 60)
+  buffer.writeUInt32LE(0x00004550, 64)
+  buffer.writeUInt16LE(machine, 68)
+  return buffer
+}
+
+test('Mach-O headers name their architecture in both endiannesses', () => {
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x01000007 })), 'x64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x0100000c })), 'arm64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x01000007, littleEndian: false })), 'x64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 7, wide: false })), 'ia32')
+})
+
+test('universal binaries report every slice they carry', () => {
+  assert.deepEqual(nativeBinaryArches(machOFat([0x01000007, 0x0100000c])), ['x64', 'arm64'])
+  assert.equal(nativeBinaryRunsOn(machOFat([0x01000007, 0x0100000c]), 'arm64'), true)
+})
+
+test('ELF and PE headers are read too', () => {
+  assert.equal(nativeBinaryArch(elf(0x3e)), 'x64')
+  assert.equal(nativeBinaryArch(elf(0xb7)), 'arm64')
+  assert.equal(nativeBinaryArch(pe(0x8664)), 'x64')
+  assert.equal(nativeBinaryArch(pe(0xaa64)), 'arm64')
+})
+
+test('a foreign architecture is rejected for the target', () => {
+  assert.equal(nativeBinaryRunsOn(machO({ cpu: 0x0100000c }), 'x64'), false)
+  assert.equal(nativeBinaryRunsOn(elf(0x3e), 'arm64'), false)
+})
+
+test('bytes without a recognizable object header do not fail a build', () => {
+  assert.equal(nativeBinaryArches(Buffer.from('#!/bin/sh\nexec node "$0"\n')), null)
+  assert.equal(nativeBinaryRunsOn(Buffer.alloc(4), 'x64'), true)
+})

package/scripts/native-tool-download.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+
+/**
+ * Target-aware download of the four product-native tools for a desktop build.
+ *
+ * The runtime fetchers (graph/patch/spawn/token) resolve the HOST's asset.
+ * That is exactly right for an installed app fetching its own binary, and
+ * exactly wrong for preparing a runtime for another platform — so rather than
+ * teach four production code paths a build-only concern, this reads the same
+ * manifests and names the target explicitly.
+ *
+ * The URL is rebuilt from the manifest version and the target instead of being
+ * trusted verbatim, which keeps a rewritten manifest from redirecting the
+ * download; the recorded sha256 still has to match the bytes that arrive.
+ */
+import { createHash } from 'node:crypto'
+import { mkdir, readFile, rename, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+  streamResponseToFile,
+} from '../src/runtime/shared/bounded-download.mjs'
+
+const RELEASE_ROOT = 'https://github.com/tribgames/mixdog/releases/download'
+const TOOLS_DIR = new URL('../src/runtime/agent/orchestrator/tools/', import.meta.url)
+
+export const NATIVE_TOOL_KINDS = Object.freeze(['graph', 'patch', 'spawn', 'token'])
+
+/** Released asset name. Only token ships as a Node addon; the rest are executables. */
+export function nativeToolAssetName(kind, target) {
+  const suffix = kind === 'token' ? '.node' : (target.platform === 'win32' ? '.exe' : '')
+  return `mixdog-${kind}-${target.platform}-${target.arch}${suffix}`
+}
+
+export function nativeToolAssetUrl(kind, version, target) {
+  return `${RELEASE_ROOT}/${kind}-v${version}/${nativeToolAssetName(kind, target)}`
+}
+
+/** Installed name inside the app, named for the TARGET rather than the host. */
+export function nativeToolInstalledName(kind, target) {
+  if (kind === 'token') return 'mixdog-token.node'
+  return target.platform === 'win32' ? `mixdog-${kind}.exe` : `mixdog-${kind}`
+}
+
+async function sha256File(path) {
+  return createHash('sha256').update(await readFile(path)).digest('hex')
+}
+
+async function download(url, destination, label) {
+  // 4 attempts, 1s/3s/9s backoff. A 4xx is the manifest being wrong, not the
+  // network being unlucky, so it ends the attempt sequence immediately.
+  const delays = [1000, 3000, 9000]
+  let lastError
+  for (let attempt = 0; attempt <= delays.length; attempt += 1) {
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(180_000) })
+      if (response.status >= 400 && response.status < 500) {
+        throw new Error(`${label}: HTTP ${response.status} is terminal — ${url}`)
+      }
+      if (!response.ok) throw new Error(`${label}: HTTP ${response.status} — ${url}`)
+      await streamResponseToFile(response, destination, {
+        maxBytes: MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+        label,
+      })
+      return
+    } catch (error) {
+      lastError = error
+      if (String(error?.message || '').includes('is terminal')) throw error
+      if (attempt < delays.length) {
+        process.stderr.write(
+          `${label}: attempt ${attempt + 1} failed (${error?.message}); retrying…\n`,
+        )
+        await new Promise((resolve) => setTimeout(resolve, delays[attempt]))
+      }
+    }
+  }
+  throw lastError
+}
+
+export async function downloadNativeTool(kind, target, cacheDir) {
+  const manifestPath = fileURLToPath(new URL(`${kind}-manifest.json`, TOOLS_DIR))
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+  const version = String(manifest?.version || '')
+  if (!/^\d+\.\d+\.\d+$/.test(version)) {
+    throw new Error(`${kind}-manifest.json carries no usable version: ${version || '(empty)'}`)
+  }
+  const key = `${target.platform}-${target.arch}`
+  const asset = manifest?.assets?.[key]
+  const expectedSha256 = String(asset?.sha256 || '').toLowerCase()
+  if (!/^[a-f0-9]{64}$/.test(expectedSha256)) {
+    const supported = Object.keys(manifest?.assets || {}).join(', ') || '(none)'
+    throw new Error(`${kind}-manifest.json has no ${key} asset. Available: ${supported}.`)
+  }
+  const url = nativeToolAssetUrl(kind, version, target)
+  if (asset.url !== url) {
+    throw new Error(
+      `${kind}-manifest.json ${key} url does not match its own release identity.\n`
+      + `  manifest: ${asset.url}\n  expected: ${url}`,
+    )
+  }
+  await mkdir(cacheDir, { recursive: true })
+  const destination = join(cacheDir, `${nativeToolAssetName(kind, target)}-${version}`)
+  const label = `${kind} ${key} download`
+  try {
+    if (await sha256File(destination) === expectedSha256) return destination
+  } catch { /* absent or unreadable: download it */ }
+  const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`
+  await download(url, temporary, label)
+  const actual = await sha256File(temporary)
+  if (actual !== expectedSha256) {
+    await rm(temporary, { force: true })
+    throw new Error(`${label}: sha256 mismatch — expected ${expectedSha256}, got ${actual}`)
+  }
+  await rename(temporary, destination)
+  return destination
+}

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -164,7 +164,7 @@ export class GeminiProvider {
     /**
      * Stream-death recovery: re-issue a dead stream ONCE as a
      * non-streaming generateContent call instead of failing the turn.
-     * Narrower than cc by design — canFallbackNonStreaming() clears only a
+     * Deliberately narrow — canFallbackNonStreaming() clears only a
      * stream that exposed nothing, so rendered text is never duplicated and a
      * dispatched tool can never run twice. Returns the aggregated response, or
      * null when the failure is ineligible or the fallback itself fails.

package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs

@@ -110,7 +110,7 @@ export function resolveGrokOAuthResponsesTransport() {
 // Retired model aliases xAI no longer exposes by their old ids. The live
 // catalog surfaces the coding model as grok-build-0.1; map the legacy ids to
 // it so a stale config selection doesn't hit a model-not-found. Exact table,
-// not a heuristic. Mirrors openclaw extensions/xai/model-definitions.ts.
+// not a heuristic.
 const RETIRED_MODEL_ALIASES = Object.freeze({
     'grok-code-fast-1': 'grok-build-0.1',
     'grok-code-fast': 'grok-build-0.1',
@@ -130,7 +130,7 @@ export const LOGIN_TIMEOUT_MS = 5 * 60_000;
 // SSRF guard for any endpoint pulled from the discovery document or saved
 // tokens. xAI OAuth endpoints must be https on x.ai / *.x.ai — reject
 // anything else outright so a hostile discovery response can't redirect the
-// token / refresh request. Mirrors openclaw's isTrustedXaiOAuthEndpoint.
+// token / refresh request.
 function assertTrustedXaiEndpoint(endpoint, label) {
     let url;
     try {

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -456,7 +456,7 @@ export async function consumeCompatChatCompletionStream(stream, {
         if (leakGuard.enabled) flushLeak();
     } catch (err) {
         // Any mid-stream failure after live text was relayed is non-retryable —
-        // but the streamed partial must still ride on the error (CC rule: once
+        // but the streamed partial must still ride on the error (rule: once
         // output is visible, keep it and finalize with a notice instead of
         // discarding the turn). The loop's partial-final path consumes these.
         if (emittedText) {
@@ -1029,7 +1029,7 @@ export async function consumeCompatResponsesStream(stream, {
         const err = truncatedCompatStreamError(label, 'no response.completed');
         if (state.emittedText) {
             // Truncation after visible output: keep the streamed partial
-            // (CC rule) so the loop can finalize it as partial-final instead
+            // (same rule) so the loop can finalize it as partial-final instead
             // of dropping the turn. liveText marking still blocks replay.
             markErrorLiveTextEmitted(err);
             try {

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -312,7 +312,7 @@ function _buildHandshakeHeaders({ auth, sessionToken, turnState, cacheKey: _cach
     // xAI WS: do NOT pin x-grok-conv-id. Measured parallel runs show that
     // forcing a routing shard via that header alternates cold caches across
     // parallel workers; the automatic prompt-prefix cache holds up better
-    // when each handshake is unpinned. Reference: vercel/ai xai provider.
+    // when each handshake is unpinned.
     const headers = auth.type === 'xai'
         ? {
             'Authorization': `Bearer ${auth.apiKey}`,

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -689,7 +689,7 @@ export async function _streamResponse({
                 finish();
             }, interChunkMs);
         };
-        // pi per-event idle: (re)armed only on meaningful output deltas via
+        // Per-event idle: (re)armed only on meaningful output deltas via
         // bumpSemanticIdle(). Keepalive/metadata frames DON'T touch it, so a
         // deltas-then-silent wedge trips this short semantic window.
         const resetSemanticIdle = () => {

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -116,7 +116,7 @@ export function classifyError(err) {
   const status = Number(err.httpStatus || err.status || err.response?.status || 0) || 0
   if (AUTH_STATUSES.has(status)) return 'auth'
   // Stale previous_response_id is recoverable by dropping the chain and
-  // re-issuing a full frame (codex maps it to ApiError::Retryable). A typed
+  // re-issuing a full frame, which is the retryable path. A typed
   // 400 here is not a deterministic payload refusal.
   if (shouldDropPreviousResponseId(err)) return 'transient'
   if (typedErrorCode(err) === WEBSOCKET_CONNECTION_LIMIT) return 'transient'
@@ -137,7 +137,7 @@ export function classifyError(err) {
   // ever attempted (observed live: pooled WS retired by the server between
   // turns → close 1000 before response.created → the whole turn failed).
   // Reference behavior retries the same disconnect (codex `CodexErr::Stream`
-  // is_retryable, cc falls back/retries the stream); the exposure deny above
+  // is_retryable, and a stream fallback/retry applies); the exposure deny above
   // still fails closed for anything already relayed or dispatched.
   if (isNonTerminalStreamClose(err)) return 'transient'
 
@@ -162,10 +162,10 @@ export function classifyError(err) {
   ))) return 'transient'
 
   // Provider wire error event (`response.failed` / terminal `error` frame):
-  // default-retry, codex parity. codex maps every response.failed whose typed
-  // code is not a deterministic refusal to ApiError::Retryable (fatal codes
-  // are an explicit allow-list); cc retries all 5xx/overloaded 10×; opencode
-  // marks server_error/server_is_overloaded isRetryable. Evidence stays
+  // default-retry. Every response.failed whose typed code is not a
+  // deterministic refusal is retryable (fatal codes are an explicit
+  // allow-list), and server_error / server_is_overloaded count as retryable
+  // too. Evidence stays
   // structural — the event's own typed code/type field — message text is
   // never parsed. Exposure precedence is preserved: the replayUnsafe gate at
   // the top of this function already returned 'permanent' for any stream
@@ -215,10 +215,10 @@ export function isNonTerminalStreamClose(err) {
 /**
  * Should this failed stream be re-issued as a NON-STREAMING request?
  *
- * cc's last safety net: when a stream dies it repeats the same request with
- * `stream:false` instead of failing the turn (claude.ts, gated off only when
+ * A last safety net: when a stream dies, repeat the same request with
+ * `stream:false` instead of failing the turn (gated off only when
  * streaming tool execution could double-run a tool). MixDog dispatches tools
- * eagerly, so this stays deliberately narrower than cc: only a stream that
+ * eagerly, so this stays deliberately narrow: only a stream that
  * exposed NOTHING qualifies. An exposed stream is already covered by the
  * loop-level retraction replay (send-with-recovery), which asks the owner to
  * withdraw the rendered characters first.
@@ -379,8 +379,8 @@ function isPermanentQuotaError(err) {
 
 // ── Wire error events: default-retry with a fatal-code deny-list ────────────
 // Deterministic refusal codes a `response.failed` / `error` wire event may
-// carry: retrying the identical request can never succeed. Mirrors codex's
-// fatal set (context/quota/policy) plus the auth/billing refusals the
+// carry: retrying the identical request can never succeed. The fatal set is
+// context/quota/policy plus the auth/billing refusals the
 // Responses and Anthropic wire formats use. Everything OUTSIDE this set —
 // server_error, server_is_overloaded, slow_down, or an event with no code at
 // all — is a server-side fault and is retried under the bounded budgets
@@ -753,7 +753,7 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
     // A typed non-transient 4xx on the failure payload is a deterministic
     // refusal even without a recognized code string.
     if (failedStatus >= 400 && failedStatus < 500 && !TRANSIENT_STATUSES.has(failedStatus)) return null
-    // Default-retry (codex parity): a wire failure that is neither a fatal
+    // Default-retry: a wire failure that is neither a fatal
     // refusal nor a typed 4xx is a server-side fault — re-issue it under the
     // bounded mid-stream budget instead of failing the turn.
     return _allowMidstream('response_failed_retryable', attemptIndex, policy)

package/src/runtime/agent/orchestrator/session/compact/file-reattach.mjs

@@ -1,5 +1,5 @@
-// Post-compact file re-attachment (claude-code createPostCompactFileAttachments
-// parity). Files the summarized-away head had `read` are re-read FRESH from
+// Post-compact file re-attachment. Files the summarized-away head had `read`
+// are re-read FRESH from
 // disk and re-injected right after the summary message, so the model does not
 // burn a turn (and tokens) re-reading files it was actively working with.
 //  - newest-first, capped at MAX_REATTACH_FILES and per-file/total token caps

package/src/runtime/agent/orchestrator/session/compact/runner.mjs

@@ -59,7 +59,7 @@ import {
     stripWorkingFileSections,
 } from './handoff.mjs';
 
-// Post-compact file re-attachment (claude-code parity): re-inject fresh reads
+// Post-compact file re-attachment: re-inject fresh reads
 // of files the summarized-away head was working with, when they still fit the
 // budget. Semantic compact still uses this; recall-fasttrack lists paths
 // instead of file bodies.

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -152,7 +152,7 @@ export function markSessionAskStart(id) {
     // Publish heartbeat immediately so the status aggregator picks the
     // session up in the connecting / requesting window. Without this the
     // .hb file only landed on the first stream chunk — producing a 3–10s
-    // (xhigh: 30s+) invisible gap where agent sessions ran but the CC
+    // (xhigh: 30s+) invisible gap where agent sessions ran but the
     // statusline showed no maintenance/agent badge. STREAM_FRESH_MS (5 min)
     // still drops a session whose provider truly never returns a chunk;
     // markSessionStreamDelta keeps refreshing once chunks arrive.

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -608,7 +608,7 @@ export async function executeBashTool(args, workDir, options = {}) {
         try { bashAbortSignal = (await getAbortSignalForSession(options?.sessionId)) || null; }
         catch { bashAbortSignal = null; }
         combinedBashAbort = _combineAbortSignals(bashAbortSignal, options?.abortSignal || null);
-        // Promote-at-timeout (CC shouldAutoBackground parity). When a
+        // Promote-at-timeout. When a
         // foreground one-shot hits its timeout and is still running, adopt it
         // as a background job (task_id + notify) instead of tree-killing it.
         // The truthy MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS env restores the old

package/src/runtime/agent/orchestrator/tools/builtin/read-constants.mjs

@@ -3,9 +3,8 @@ import { TOOL_OUTPUT_MAX_BYTES } from './tool-output-limit.mjs';
 
 // Read tool caps.
 //
-// READ_MAX_SIZE_BYTES (10 MB) — fast-path file-size threshold mirroring
-// Reference FAST_PATH_MAX_SIZE (readFileInRange.ts:44). Files at or below
-// this size use readFile + in-memory split by default, which CC measured at
+// READ_MAX_SIZE_BYTES (10 MB) — fast-path file-size threshold. Files at or below
+// this size use readFile + in-memory split by default, measured at
 // ~2x faster than createReadStream + readline for typical source. Explicit
 // offset/limit windows on files above READ_STREAM_RANGE_MIN_BYTES take the
 // streaming path too, so a targeted read avoids materialising a whole

package/src/runtime/agent/orchestrator/tools/builtin/read-image-resize.mjs

@@ -1,7 +1,6 @@
-// Optional-sharp image resize / downsample helper. Mirrors reference
-// imageResizer.ts (maybeResizeAndDownsampleImageBuffer +
-// readImageWithTokenBudget) so a `read` on an image returns a viewable,
-// budget-bounded image block instead of refusing oversized originals.
+// Optional-sharp image resize / downsample helper: a `read` on an image
+// returns a viewable, budget-bounded image block instead of refusing
+// oversized originals.
 //
 // sharp is a direct runtime dependency. Entry points still degrade to `null`
 // when a platform-native binding cannot load so a damaged install reports the
@@ -134,8 +133,8 @@ function normalizeFmt(fmt) {
     return f === 'jpg' ? 'jpeg' : f;
 }
 
-// Build the metadata text block prepended to a resized image. Mirrors CC
-// createImageMetadataText: "[Image: WxH, displayed at ...]" plus a coordinate
+// Build the metadata text block prepended to a resized image:
+// "[Image: WxH, displayed at ...]" plus a coordinate
 // scale note when the image was downsampled.
 export function imageMetadataText(dims, sourcePath) {
     if (!dims) return sourcePath ? `[Image source: ${sourcePath}]` : null;
@@ -159,7 +158,7 @@ export function imageMetadataText(dims, sourcePath) {
 
 // Resize / downsample an image buffer with sharp.
 //
-// Pipeline (mirrors CC maybeResizeAndDownsampleImageBuffer + token budget):
+// Pipeline (resize / downsample under a token budget):
 //   1. metadata() — read format + dimensions.
 //   2. resize fit:inside withoutEnlargement to <= 2000x2000 (only when over
 //      dimension caps OR over the 3.75MB raw target).