mixdog 0.9.141 → 0.9.142

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.141",
+  "version": "0.9.142",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/native-binary-arch.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+
+/**
+ * Architecture of a compiled artifact, read from its own header.
+ *
+ * The desktop runtime is prepared for a TARGET that need not match the build
+ * host, and the expensive failure is silent: an arm64 addon inside an x64 app
+ * packages, uploads, and publishes without complaint, then refuses to load on
+ * the user's machine. Reading the header turns that into a build error at the
+ * moment the archive is assembled.
+ *
+ * Only the fields that name the architecture are parsed; nothing here loads or
+ * executes the file.
+ */
+
+// Mach-O cpu_type_t. The 0x01000000 bit marks the 64-bit variants.
+const MACHO_CPU = new Map([[0x01000007, 'x64'], [0x0100000c, 'arm64'], [7, 'ia32']])
+// ELF e_machine.
+const ELF_MACHINE = new Map([[0x3e, 'x64'], [0xb7, 'arm64'], [0x03, 'ia32']])
+// PE IMAGE_FILE_HEADER.Machine.
+const PE_MACHINE = new Map([[0x8664, 'x64'], [0xaa64, 'arm64'], [0x14c, 'ia32']])
+
+function machOArch(buffer) {
+  if (buffer.length < 8) return null
+  const magic = buffer.readUInt32BE(0)
+  // Thin Mach-O: 0xfeedfacf (64-bit) / 0xfeedface (32-bit), either endianness.
+  if (magic === 0xfeedfacf || magic === 0xfeedface) return MACHO_CPU.get(buffer.readUInt32BE(4)) || null
+  if (magic === 0xcffaedfe || magic === 0xcefaedfe) return MACHO_CPU.get(buffer.readUInt32LE(4)) || null
+  return null
+}
+
+/** Universal binaries name every slice they carry, so they are read as a set. */
+function machOFatArches(buffer) {
+  if (buffer.length < 8) return null
+  const magic = buffer.readUInt32BE(0)
+  // 0xcafebabe is also a Java class file; those never reach an addon path, and
+  // the slice count sanity check below rejects the overlap in practice.
+  if (magic !== 0xcafebabe && magic !== 0xcafebabf) return null
+  const wide = magic === 0xcafebabf
+  const count = buffer.readUInt32BE(4)
+  if (!count || count > 16) return null
+  const entrySize = wide ? 32 : 20
+  const arches = []
+  for (let index = 0; index < count; index += 1) {
+    const offset = 8 + index * entrySize
+    if (offset + 4 > buffer.length) return null
+    const arch = MACHO_CPU.get(buffer.readUInt32BE(offset))
+    if (arch) arches.push(arch)
+  }
+  return arches.length ? arches : null
+}
+
+function elfArch(buffer) {
+  if (buffer.length < 20) return null
+  if (buffer.readUInt32BE(0) !== 0x7f454c46) return null
+  const littleEndian = buffer[5] === 1
+  const machine = littleEndian ? buffer.readUInt16LE(18) : buffer.readUInt16BE(18)
+  return ELF_MACHINE.get(machine) || null
+}
+
+function peArch(buffer) {
+  if (buffer.length < 64 || buffer.readUInt16LE(0) !== 0x5a4d) return null
+  const headerOffset = buffer.readUInt32LE(60)
+  if (headerOffset + 6 > buffer.length) return null
+  if (buffer.readUInt32LE(headerOffset) !== 0x00004550) return null
+  return PE_MACHINE.get(buffer.readUInt16LE(headerOffset + 4)) || null
+}
+
+/**
+ * Every architecture the artifact can run on, or null when the bytes carry no
+ * recognizable object header (a text stub, a placeholder, a data file).
+ */
+export function nativeBinaryArches(buffer) {
+  const fat = machOFatArches(buffer)
+  if (fat) return fat
+  const single = machOArch(buffer) || elfArch(buffer) || peArch(buffer)
+  return single ? [single] : null
+}
+
+/** Convenience for the single-slice case; a fat binary reports its first slice. */
+export function nativeBinaryArch(buffer) {
+  return nativeBinaryArches(buffer)?.[0] ?? null
+}
+
+/**
+ * True when the artifact can run on `arch`. An unrecognized header answers
+ * true: the caller is verifying compiled objects, and refusing every file it
+ * cannot parse would fail builds over unrelated payloads.
+ */
+export function nativeBinaryRunsOn(buffer, arch) {
+  const arches = nativeBinaryArches(buffer)
+  return arches === null || arches.includes(arch)
+}

package/scripts/native-binary-arch.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  nativeBinaryArch,
+  nativeBinaryArches,
+  nativeBinaryRunsOn,
+} from './native-binary-arch.mjs'
+
+function machO({ cpu, littleEndian = true, wide = true }) {
+  const buffer = Buffer.alloc(32)
+  const magic = wide ? 0xfeedfacf : 0xfeedface
+  if (littleEndian) {
+    buffer.writeUInt32BE(wide ? 0xcffaedfe : 0xcefaedfe, 0)
+    buffer.writeUInt32LE(cpu, 4)
+  } else {
+    buffer.writeUInt32BE(magic, 0)
+    buffer.writeUInt32BE(cpu, 4)
+  }
+  return buffer
+}
+
+function machOFat(cpus) {
+  const buffer = Buffer.alloc(8 + cpus.length * 20)
+  buffer.writeUInt32BE(0xcafebabe, 0)
+  buffer.writeUInt32BE(cpus.length, 4)
+  cpus.forEach((cpu, index) => buffer.writeUInt32BE(cpu, 8 + index * 20))
+  return buffer
+}
+
+function elf(machine) {
+  const buffer = Buffer.alloc(32)
+  buffer.writeUInt32BE(0x7f454c46, 0)
+  buffer[5] = 1
+  buffer.writeUInt16LE(machine, 18)
+  return buffer
+}
+
+function pe(machine) {
+  const buffer = Buffer.alloc(128)
+  buffer.writeUInt16LE(0x5a4d, 0)
+  buffer.writeUInt32LE(64, 60)
+  buffer.writeUInt32LE(0x00004550, 64)
+  buffer.writeUInt16LE(machine, 68)
+  return buffer
+}
+
+test('Mach-O headers name their architecture in both endiannesses', () => {
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x01000007 })), 'x64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x0100000c })), 'arm64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x01000007, littleEndian: false })), 'x64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 7, wide: false })), 'ia32')
+})
+
+test('universal binaries report every slice they carry', () => {
+  assert.deepEqual(nativeBinaryArches(machOFat([0x01000007, 0x0100000c])), ['x64', 'arm64'])
+  assert.equal(nativeBinaryRunsOn(machOFat([0x01000007, 0x0100000c]), 'arm64'), true)
+})
+
+test('ELF and PE headers are read too', () => {
+  assert.equal(nativeBinaryArch(elf(0x3e)), 'x64')
+  assert.equal(nativeBinaryArch(elf(0xb7)), 'arm64')
+  assert.equal(nativeBinaryArch(pe(0x8664)), 'x64')
+  assert.equal(nativeBinaryArch(pe(0xaa64)), 'arm64')
+})
+
+test('a foreign architecture is rejected for the target', () => {
+  assert.equal(nativeBinaryRunsOn(machO({ cpu: 0x0100000c }), 'x64'), false)
+  assert.equal(nativeBinaryRunsOn(elf(0x3e), 'arm64'), false)
+})
+
+test('bytes without a recognizable object header do not fail a build', () => {
+  assert.equal(nativeBinaryArches(Buffer.from('#!/bin/sh\nexec node "$0"\n')), null)
+  assert.equal(nativeBinaryRunsOn(Buffer.alloc(4), 'x64'), true)
+})

package/scripts/native-tool-download.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+
+/**
+ * Target-aware download of the four product-native tools for a desktop build.
+ *
+ * The runtime fetchers (graph/patch/spawn/token) resolve the HOST's asset.
+ * That is exactly right for an installed app fetching its own binary, and
+ * exactly wrong for preparing a runtime for another platform — so rather than
+ * teach four production code paths a build-only concern, this reads the same
+ * manifests and names the target explicitly.
+ *
+ * The URL is rebuilt from the manifest version and the target instead of being
+ * trusted verbatim, which keeps a rewritten manifest from redirecting the
+ * download; the recorded sha256 still has to match the bytes that arrive.
+ */
+import { createHash } from 'node:crypto'
+import { mkdir, readFile, rename, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+  streamResponseToFile,
+} from '../src/runtime/shared/bounded-download.mjs'
+
+const RELEASE_ROOT = 'https://github.com/tribgames/mixdog/releases/download'
+const TOOLS_DIR = new URL('../src/runtime/agent/orchestrator/tools/', import.meta.url)
+
+export const NATIVE_TOOL_KINDS = Object.freeze(['graph', 'patch', 'spawn', 'token'])
+
+/** Released asset name. Only token ships as a Node addon; the rest are executables. */
+export function nativeToolAssetName(kind, target) {
+  const suffix = kind === 'token' ? '.node' : (target.platform === 'win32' ? '.exe' : '')
+  return `mixdog-${kind}-${target.platform}-${target.arch}${suffix}`
+}
+
+export function nativeToolAssetUrl(kind, version, target) {
+  return `${RELEASE_ROOT}/${kind}-v${version}/${nativeToolAssetName(kind, target)}`
+}
+
+/** Installed name inside the app, named for the TARGET rather than the host. */
+export function nativeToolInstalledName(kind, target) {
+  if (kind === 'token') return 'mixdog-token.node'
+  return target.platform === 'win32' ? `mixdog-${kind}.exe` : `mixdog-${kind}`
+}
+
+async function sha256File(path) {
+  return createHash('sha256').update(await readFile(path)).digest('hex')
+}
+
+async function download(url, destination, label) {
+  // 4 attempts, 1s/3s/9s backoff. A 4xx is the manifest being wrong, not the
+  // network being unlucky, so it ends the attempt sequence immediately.
+  const delays = [1000, 3000, 9000]
+  let lastError
+  for (let attempt = 0; attempt <= delays.length; attempt += 1) {
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(180_000) })
+      if (response.status >= 400 && response.status < 500) {
+        throw new Error(`${label}: HTTP ${response.status} is terminal — ${url}`)
+      }
+      if (!response.ok) throw new Error(`${label}: HTTP ${response.status} — ${url}`)
+      await streamResponseToFile(response, destination, {
+        maxBytes: MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+        label,
+      })
+      return
+    } catch (error) {
+      lastError = error
+      if (String(error?.message || '').includes('is terminal')) throw error
+      if (attempt < delays.length) {
+        process.stderr.write(
+          `${label}: attempt ${attempt + 1} failed (${error?.message}); retrying…\n`,
+        )
+        await new Promise((resolve) => setTimeout(resolve, delays[attempt]))
+      }
+    }
+  }
+  throw lastError
+}
+
+export async function downloadNativeTool(kind, target, cacheDir) {
+  const manifestPath = fileURLToPath(new URL(`${kind}-manifest.json`, TOOLS_DIR))
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+  const version = String(manifest?.version || '')
+  if (!/^\d+\.\d+\.\d+$/.test(version)) {
+    throw new Error(`${kind}-manifest.json carries no usable version: ${version || '(empty)'}`)
+  }
+  const key = `${target.platform}-${target.arch}`
+  const asset = manifest?.assets?.[key]
+  const expectedSha256 = String(asset?.sha256 || '').toLowerCase()
+  if (!/^[a-f0-9]{64}$/.test(expectedSha256)) {
+    const supported = Object.keys(manifest?.assets || {}).join(', ') || '(none)'
+    throw new Error(`${kind}-manifest.json has no ${key} asset. Available: ${supported}.`)
+  }
+  const url = nativeToolAssetUrl(kind, version, target)
+  if (asset.url !== url) {
+    throw new Error(
+      `${kind}-manifest.json ${key} url does not match its own release identity.\n`
+      + `  manifest: ${asset.url}\n  expected: ${url}`,
+    )
+  }
+  await mkdir(cacheDir, { recursive: true })
+  const destination = join(cacheDir, `${nativeToolAssetName(kind, target)}-${version}`)
+  const label = `${kind} ${key} download`
+  try {
+    if (await sha256File(destination) === expectedSha256) return destination
+  } catch { /* absent or unreadable: download it */ }
+  const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`
+  await download(url, temporary, label)
+  const actual = await sha256File(temporary)
+  if (actual !== expectedSha256) {
+    await rm(temporary, { force: true })
+    throw new Error(`${label}: sha256 mismatch — expected ${expectedSha256}, got ${actual}`)
+  }
+  await rename(temporary, destination)
+  return destination
+}

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -164,7 +164,7 @@ export class GeminiProvider {
     /**
      * Stream-death recovery: re-issue a dead stream ONCE as a
      * non-streaming generateContent call instead of failing the turn.
-     * Narrower than cc by design — canFallbackNonStreaming() clears only a
+     * Deliberately narrow — canFallbackNonStreaming() clears only a
      * stream that exposed nothing, so rendered text is never duplicated and a
      * dispatched tool can never run twice. Returns the aggregated response, or
      * null when the failure is ineligible or the fallback itself fails.

package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs

@@ -130,7 +130,7 @@ export const LOGIN_TIMEOUT_MS = 5 * 60_000;
 // SSRF guard for any endpoint pulled from the discovery document or saved
 // tokens. xAI OAuth endpoints must be https on x.ai / *.x.ai — reject
 // anything else outright so a hostile discovery response can't redirect the
-// token / refresh request. Mirrors openclaw's isTrustedXaiOAuthEndpoint.
+// token / refresh request.
 function assertTrustedXaiEndpoint(endpoint, label) {
     let url;
     try {

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -456,7 +456,7 @@ export async function consumeCompatChatCompletionStream(stream, {
         if (leakGuard.enabled) flushLeak();
     } catch (err) {
         // Any mid-stream failure after live text was relayed is non-retryable —
-        // but the streamed partial must still ride on the error (CC rule: once
+        // but the streamed partial must still ride on the error (rule: once
         // output is visible, keep it and finalize with a notice instead of
         // discarding the turn). The loop's partial-final path consumes these.
         if (emittedText) {
@@ -1029,7 +1029,7 @@ export async function consumeCompatResponsesStream(stream, {
         const err = truncatedCompatStreamError(label, 'no response.completed');
         if (state.emittedText) {
             // Truncation after visible output: keep the streamed partial
-            // (CC rule) so the loop can finalize it as partial-final instead
+            // (same rule) so the loop can finalize it as partial-final instead
             // of dropping the turn. liveText marking still blocks replay.
             markErrorLiveTextEmitted(err);
             try {

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -312,7 +312,7 @@ function _buildHandshakeHeaders({ auth, sessionToken, turnState, cacheKey: _cach
     // xAI WS: do NOT pin x-grok-conv-id. Measured parallel runs show that
     // forcing a routing shard via that header alternates cold caches across
     // parallel workers; the automatic prompt-prefix cache holds up better
-    // when each handshake is unpinned. Reference: vercel/ai xai provider.
+    // when each handshake is unpinned.
     const headers = auth.type === 'xai'
         ? {
             'Authorization': `Bearer ${auth.apiKey}`,

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -689,7 +689,7 @@ export async function _streamResponse({
                 finish();
             }, interChunkMs);
         };
-        // pi per-event idle: (re)armed only on meaningful output deltas via
+        // Per-event idle: (re)armed only on meaningful output deltas via
         // bumpSemanticIdle(). Keepalive/metadata frames DON'T touch it, so a
         // deltas-then-silent wedge trips this short semantic window.
         const resetSemanticIdle = () => {

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -116,7 +116,7 @@ export function classifyError(err) {
   const status = Number(err.httpStatus || err.status || err.response?.status || 0) || 0
   if (AUTH_STATUSES.has(status)) return 'auth'
   // Stale previous_response_id is recoverable by dropping the chain and
-  // re-issuing a full frame (codex maps it to ApiError::Retryable). A typed
+  // re-issuing a full frame, which is the retryable path. A typed
   // 400 here is not a deterministic payload refusal.
   if (shouldDropPreviousResponseId(err)) return 'transient'
   if (typedErrorCode(err) === WEBSOCKET_CONNECTION_LIMIT) return 'transient'
@@ -137,7 +137,7 @@ export function classifyError(err) {
   // ever attempted (observed live: pooled WS retired by the server between
   // turns → close 1000 before response.created → the whole turn failed).
   // Reference behavior retries the same disconnect (codex `CodexErr::Stream`
-  // is_retryable, cc falls back/retries the stream); the exposure deny above
+  // is_retryable, and a stream fallback/retry applies); the exposure deny above
   // still fails closed for anything already relayed or dispatched.
   if (isNonTerminalStreamClose(err)) return 'transient'
 
@@ -162,10 +162,10 @@ export function classifyError(err) {
   ))) return 'transient'
 
   // Provider wire error event (`response.failed` / terminal `error` frame):
-  // default-retry, codex parity. codex maps every response.failed whose typed
-  // code is not a deterministic refusal to ApiError::Retryable (fatal codes
-  // are an explicit allow-list); cc retries all 5xx/overloaded 10×; opencode
-  // marks server_error/server_is_overloaded isRetryable. Evidence stays
+  // default-retry. Every response.failed whose typed code is not a
+  // deterministic refusal is retryable (fatal codes are an explicit
+  // allow-list), and server_error / server_is_overloaded count as retryable
+  // too. Evidence stays
   // structural — the event's own typed code/type field — message text is
   // never parsed. Exposure precedence is preserved: the replayUnsafe gate at
   // the top of this function already returned 'permanent' for any stream
@@ -379,8 +379,8 @@ function isPermanentQuotaError(err) {
 
 // ── Wire error events: default-retry with a fatal-code deny-list ────────────
 // Deterministic refusal codes a `response.failed` / `error` wire event may
-// carry: retrying the identical request can never succeed. Mirrors codex's
-// fatal set (context/quota/policy) plus the auth/billing refusals the
+// carry: retrying the identical request can never succeed. The fatal set is
+// context/quota/policy plus the auth/billing refusals the
 // Responses and Anthropic wire formats use. Everything OUTSIDE this set —
 // server_error, server_is_overloaded, slow_down, or an event with no code at
 // all — is a server-side fault and is retried under the bounded budgets
@@ -753,7 +753,7 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
     // A typed non-transient 4xx on the failure payload is a deterministic
     // refusal even without a recognized code string.
     if (failedStatus >= 400 && failedStatus < 500 && !TRANSIENT_STATUSES.has(failedStatus)) return null
-    // Default-retry (codex parity): a wire failure that is neither a fatal
+    // Default-retry: a wire failure that is neither a fatal
     // refusal nor a typed 4xx is a server-side fault — re-issue it under the
     // bounded mid-stream budget instead of failing the turn.
     return _allowMidstream('response_failed_retryable', attemptIndex, policy)

package/src/runtime/agent/orchestrator/session/compact/file-reattach.mjs

@@ -1,5 +1,5 @@
-// Post-compact file re-attachment (claude-code createPostCompactFileAttachments
-// parity). Files the summarized-away head had `read` are re-read FRESH from
+// Post-compact file re-attachment. Files the summarized-away head had `read`
+// are re-read FRESH from
 // disk and re-injected right after the summary message, so the model does not
 // burn a turn (and tokens) re-reading files it was actively working with.
 //  - newest-first, capped at MAX_REATTACH_FILES and per-file/total token caps

package/src/runtime/agent/orchestrator/session/compact/runner.mjs

@@ -59,7 +59,7 @@ import {
     stripWorkingFileSections,
 } from './handoff.mjs';
 
-// Post-compact file re-attachment (claude-code parity): re-inject fresh reads
+// Post-compact file re-attachment: re-inject fresh reads
 // of files the summarized-away head was working with, when they still fit the
 // budget. Semantic compact still uses this; recall-fasttrack lists paths
 // instead of file bodies.

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -152,7 +152,7 @@ export function markSessionAskStart(id) {
     // Publish heartbeat immediately so the status aggregator picks the
     // session up in the connecting / requesting window. Without this the
     // .hb file only landed on the first stream chunk — producing a 3–10s
-    // (xhigh: 30s+) invisible gap where agent sessions ran but the CC
+    // (xhigh: 30s+) invisible gap where agent sessions ran but the
     // statusline showed no maintenance/agent badge. STREAM_FRESH_MS (5 min)
     // still drops a session whose provider truly never returns a chunk;
     // markSessionStreamDelta keeps refreshing once chunks arrive.

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -608,7 +608,7 @@ export async function executeBashTool(args, workDir, options = {}) {
         try { bashAbortSignal = (await getAbortSignalForSession(options?.sessionId)) || null; }
         catch { bashAbortSignal = null; }
         combinedBashAbort = _combineAbortSignals(bashAbortSignal, options?.abortSignal || null);
-        // Promote-at-timeout (CC shouldAutoBackground parity). When a
+        // Promote-at-timeout. When a
         // foreground one-shot hits its timeout and is still running, adopt it
         // as a background job (task_id + notify) instead of tree-killing it.
         // The truthy MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS env restores the old

package/src/runtime/agent/orchestrator/tools/builtin/read-image-resize.mjs

@@ -133,8 +133,8 @@ function normalizeFmt(fmt) {
     return f === 'jpg' ? 'jpeg' : f;
 }
 
-// Build the metadata text block prepended to a resized image. Mirrors CC
-// createImageMetadataText: "[Image: WxH, displayed at ...]" plus a coordinate
+// Build the metadata text block prepended to a resized image:
+// "[Image: WxH, displayed at ...]" plus a coordinate
 // scale note when the image was downsampled.
 export function imageMetadataText(dims, sourcePath) {
     if (!dims) return sourcePath ? `[Image source: ${sourcePath}]` : null;
@@ -158,7 +158,7 @@ export function imageMetadataText(dims, sourcePath) {
 
 // Resize / downsample an image buffer with sharp.
 //
-// Pipeline (mirrors CC maybeResizeAndDownsampleImageBuffer + token budget):
+// Pipeline (resize / downsample under a token budget):
 //   1. metadata() — read format + dimensions.
 //   2. resize fit:inside withoutEnlargement to <= 2000x2000 (only when over
 //      dimension caps OR over the 3.75MB raw target).

package/src/runtime/agent/orchestrator/tools/builtin/read-special-files.mjs

@@ -170,7 +170,7 @@ export async function extractIpynbText(fullPath, { maxOutputBytes = DEFAULT_READ
                         const rawTxt = data['text/plain']
                             ? (Array.isArray(data['text/plain']) ? data['text/plain'].join('') : data['text/plain'])
                             : (Array.isArray(out.text) ? out.text.join('') : out.text);
-                        // Port CC behaviour: a single huge output is replaced
+                        // A single huge output is replaced
                         // with a jq hint rather than dumped inline.
                         if (typeof rawTxt === 'string' && rawTxt.length > IPYNB_OUTPUT_MAX_CHARS) {
                             block += `\n# Output: [large output omitted — ${rawTxt.length} chars; inspect with: cat "${fullPath}" | jq '.cells[${cellIndex}].outputs']`;

package/src/runtime/agent/orchestrator/tools/builtin/read-tool.mjs

@@ -116,7 +116,7 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
         _recordReadSnapshot,
         READ_MAX_OUTPUT_BYTES,
     } = helpers;
-    // CC `file_path` alias — official SDK schema uses `file_path`;
+    // `file_path` alias — the official SDK schema uses `file_path`;
     // mixdog has historically used `path`. Honor `file_path` so a
     // CC-trained agent's call shape works without translation.
     const usedFilePathAlias = typeof args.file_path === 'string' && !args.path;
@@ -232,8 +232,8 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
         // result is sliced back into the original per-entry windows
         // for response assembly. Non-same-path entries are untouched.
         const rawEntries = args.path.map((r) => {
-            // CC `file_path` alias on a per-entry batch: file_path is
-            // 1-based (CC schema), so decrement a positive offset to
+            // `file_path` alias on a per-entry batch: file_path is
+            // 1-based (SDK schema), so decrement a positive offset to
             // match the 0-based `path` form. Mirrors the scalar
             // alias adjustment at line 57.
             const entryUsesFilePathAlias = typeof r?.file_path === 'string' && !r?.path;

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -599,7 +599,7 @@ export function execShellCommand({
       if (grace.unref) grace.unref();
     };
     child.once('exit', _onChildExit);
-    // Auto-background transition (CC startBackgrounding analogue). Two triggers
+    // Auto-background transition. Two triggers
     // resolve the call immediately with a 'backgrounded' result while the
     // child keeps running, adopted into the shell-jobs registry but still
     // owned by this CLI process:
@@ -904,7 +904,7 @@ export function execShellCommand({
     if (abortSignal) {
       abortHandler = () => {
         // Interrupt (the user typed a NEW message while this was running) is a
-        // "also look at this" signal, not "stop that" — CC backgrounds instead
+        // "also look at this" signal, not "stop that" — it backgrounds instead
         // of killing there, and throwing away a long build the user never asked
         // to stop is the worse outcome. Explicit cancellation (ESC) keeps the
         // kill. The promotion reuses the timeout path's guards verbatim so a

package/src/runtime/agent/orchestrator/tools/shell-exec-output.mjs

@@ -337,7 +337,7 @@ export class TaskOutput {
   }
 
   // Direct mode has no JS write path, so byte counters must come from the
-  // filesystem (CC "poll the file tail" analogue).
+  // filesystem (a "poll the file tail" approach).
   _refreshDirectSizes() {
     if (!this.direct) return;
     try { this.stdoutFileSize = statSync(this.stdoutPath).size; } catch {}
@@ -531,7 +531,7 @@ export class ExecResult {
     // renderer in builtin/bash-tool.mjs turns this into a model-visible marker.
     this.failurePhase = opts.failurePhase || null;
     this.failureReason = opts.failureReason || null;
-    // Auto-background transition (CC startBackgrounding analogue). When a
+    // Auto-background transition. When a
     // foreground command outlives autoBackgroundMs the call settles with
     // backgrounded:true + the jobId for manual task control. The
     // child stays owned by the CLI process; stdout/stderr keep flowing to

package/src/runtime/agent/orchestrator/tools/shell-policy.mjs

@@ -55,7 +55,7 @@ const BLOCKED_PATTERNS = [
   // cmd `del /s` / `rd /s`) are NOT blocked outright — each is target-checked
   // by a dedicated guard below via _isDangerousDeleteTarget, blocking only
   // filesystem-root / home / top-level-system / whole-cwd targets (CC-level).
-  // `git reset --hard` is likewise no longer hard-blocked (CC prompts; the
+  // `git reset --hard` is likewise no longer hard-blocked (a prompt suffices; the
   // agent workflow already gates destructive git ops).
   // Bare `git push --force` (and `--force=`) still blocks; the safer
   // `--force-with-lease` / `--force-if-includes` variants pass.

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -289,7 +289,7 @@ function refreshActiveInstance(instanceId, meta, options) {
         }
         preservedExtra.gateway_server_pid = prevGatewayServerPid;
         // Clear session-scoped gateway metrics when the transcript changes —
-        // a new CC session must not inherit the previous session's context
+        // a new session must not inherit the previous session's context
         // usage before the gateway re-advertises.
         const metricTranscript =
           typeof prevForPreserve?.gateway_transcript_path === 'string' && prevForPreserve.gateway_transcript_path

package/src/tui/app/use-mouse-input.mjs

@@ -660,7 +660,7 @@ export function useMouseInput({
             // words/lines from this span (see buildSpanRect). Leave the drag
             // ARMED (active:true): a release without motion keeps this highlight
             // (buildSpanRect returns the span for an in-span target), while
-            // any motion extends it. Mirrors selectWordAt/selectLineAt setting
+            // any motion extends it. The word/line select sets
             // isDragging=true + anchorSpan; the mouse-up finalizes.
             const kind = clickCount === 2 ? 'word' : 'line';
             const wr = kind === 'word' ? store.getWordRectAt?.(x, y) : store.getLineRectAt?.(y);

package/src/tui/components/tool-output-format.mjs

@@ -35,11 +35,11 @@ import { buildTableRender } from '../markdown/table-layout.mjs';
 const DEFAULT_MARKDOWN_WIDTH = 80;
 
 // Hard ceilings so a pathological tool result can never lock the render loop.
-// CC uses ~MAX_LINES*width*4 for the collapsed fold; for the EXPANDED body we
+// The collapsed fold budgets roughly MAX_LINES*width*4; for the EXPANDED body we
 // cap total characters processed and total lines kept, with an explicit marker.
 const MAX_EXPANDED_CHARS = 256 * 1024; // 256 KB of text gets per-line processing
 const MAX_EXPANDED_LINES = 4000; // logical-line safety ceiling; physical mount cap is separate
-const MAX_JSON_FORMAT_LENGTH = 10_000; // mirror CC's tryJsonFormatContent cap
+const MAX_JSON_FORMAT_LENGTH = 10_000; // JSON pretty-format cap
 const MAX_HIGHLIGHT_LINE_CHARS = 2000; // skip token-scan on absurdly long lines
 // Lockstep with ToolExecution collapsed fit budget (MIN_RESULT_LINE_CHARS).
 const MIN_EXPANDED_BODY_COLS = 24;

package/src/tui/dist/index.mjs

@@ -2061,7 +2061,7 @@ var tealPalette = {
   error: "rgb(204,102,102)",
   // red #cc6666
   warning: "rgb(255,255,0)",
-  // yellow #ffff00 (pi uses pure yellow)
+  // yellow #ffff00 (pure yellow by design)
   suggestion: "rgb(129,162,190)",
   // mdLink #81a2be
   panelTitle: "rgb(138,190,183)",

package/src/tui/themes/teal.mjs

@@ -38,7 +38,7 @@ export const tealPalette = {
   promptBorder: 'rgb(80,80,80)', // borderMuted/darkGray #505050
   success: 'rgb(181,189,104)', // green #b5bd68
   error: 'rgb(204,102,102)', // red #cc6666
-  warning: 'rgb(255,255,0)', // yellow #ffff00 (pi uses pure yellow)
+  warning: 'rgb(255,255,0)', // yellow #ffff00 (pure yellow by design)
   suggestion: 'rgb(129,162,190)', // mdLink #81a2be
   panelTitle: 'rgb(138,190,183)', // accent
   permission: 'rgb(204,102,102)', // red