mixdog 0.9.141 → 0.9.143

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.141",
+  "version": "0.9.143",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/agent-lead-e2e-probe.mjs

@@ -15,12 +15,7 @@ import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-lead-e2e-'));
-// MIXDOG_LEAD_E2E_LIVE_DAEMON=1: keep the inherited runtime root (live daemon
-// discovery) and opt into agent shard spread, so the spawned worker runs on
-// the INSTALLED daemon's shard pool — the deployed remote-completion path.
-const LIVE_DAEMON = process.env.MIXDOG_LEAD_E2E_LIVE_DAEMON === '1';
-if (LIVE_DAEMON) process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
-else process.env.MIXDOG_RUNTIME_ROOT = ROOT;
+process.env.MIXDOG_RUNTIME_ROOT = ROOT;
 process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
 process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
 process.env.MIXDOG_FEATURE_MEMORY = '0';

package/scripts/agent-turn-trace-probe.mjs

@@ -17,9 +17,7 @@ const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-turn-trace-'));
 process.env.MIXDOG_RUNTIME_ROOT = ROOT;
 process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
 process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
-process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
-// The probe's whole point is the trace: explicit path (shared by daemon and
-// shard children via env inheritance) + timing rows.
+// The probe's whole point is the trace: explicit path plus timing rows.
 const TRACE_PATH = join(ROOT, 'agent-trace.jsonl');
 delete process.env.MIXDOG_AGENT_TRACE_DISABLE;
 process.env.MIXDOG_AGENT_TRACE_PATH = TRACE_PATH;
@@ -75,7 +73,7 @@ try {
       '2) read README.md (first 40 lines)',
       '3) run the shell command: node -v',
       '4) read apps/desktop/package.json',
-      '5) grep the string "createSessionRuntimePool" under src/standalone (files list only)',
+      '5) grep the string "createSessionRuntimeHost" under src/standalone (files list only)',
       'Then reply with one line: DONE <package name> <node version>. Do not edit anything.',
     ].join('\n'),
   }, { invocationSource: 'model-tool', cwd: REPO });
@@ -90,7 +88,7 @@ try {
   process.stdout.write(`wall=${((Date.now() - t0) / 1000).toFixed(1)}s\n--- result ---\n${last.slice(0, 400)}\n`);
   try { agent.closeAll('turn-trace probe end'); } catch { /* teardown */ }
 
-  // Shard children flush their local trace buffers on a short timer.
+  // The runtime worker flushes its local trace buffer on a short timer.
   await sleep(9_000);
   const rows = existsSync(TRACE_PATH)
     ? readFileSync(TRACE_PATH, 'utf8').split('\n').filter(Boolean).flatMap((line) => {

package/scripts/native-binary-arch.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+
+/**
+ * Architecture of a compiled artifact, read from its own header.
+ *
+ * The desktop runtime is prepared for a TARGET that need not match the build
+ * host, and the expensive failure is silent: an arm64 addon inside an x64 app
+ * packages, uploads, and publishes without complaint, then refuses to load on
+ * the user's machine. Reading the header turns that into a build error at the
+ * moment the archive is assembled.
+ *
+ * Only the fields that name the architecture are parsed; nothing here loads or
+ * executes the file.
+ */
+
+// Mach-O cpu_type_t. The 0x01000000 bit marks the 64-bit variants.
+const MACHO_CPU = new Map([[0x01000007, 'x64'], [0x0100000c, 'arm64'], [7, 'ia32']])
+// ELF e_machine.
+const ELF_MACHINE = new Map([[0x3e, 'x64'], [0xb7, 'arm64'], [0x03, 'ia32']])
+// PE IMAGE_FILE_HEADER.Machine.
+const PE_MACHINE = new Map([[0x8664, 'x64'], [0xaa64, 'arm64'], [0x14c, 'ia32']])
+
+function machOArch(buffer) {
+  if (buffer.length < 8) return null
+  const magic = buffer.readUInt32BE(0)
+  // Thin Mach-O: 0xfeedfacf (64-bit) / 0xfeedface (32-bit), either endianness.
+  if (magic === 0xfeedfacf || magic === 0xfeedface) return MACHO_CPU.get(buffer.readUInt32BE(4)) || null
+  if (magic === 0xcffaedfe || magic === 0xcefaedfe) return MACHO_CPU.get(buffer.readUInt32LE(4)) || null
+  return null
+}
+
+/** Universal binaries name every slice they carry, so they are read as a set. */
+function machOFatArches(buffer) {
+  if (buffer.length < 8) return null
+  const magic = buffer.readUInt32BE(0)
+  // 0xcafebabe is also a Java class file; those never reach an addon path, and
+  // the slice count sanity check below rejects the overlap in practice.
+  if (magic !== 0xcafebabe && magic !== 0xcafebabf) return null
+  const wide = magic === 0xcafebabf
+  const count = buffer.readUInt32BE(4)
+  if (!count || count > 16) return null
+  const entrySize = wide ? 32 : 20
+  const arches = []
+  for (let index = 0; index < count; index += 1) {
+    const offset = 8 + index * entrySize
+    if (offset + 4 > buffer.length) return null
+    const arch = MACHO_CPU.get(buffer.readUInt32BE(offset))
+    if (arch) arches.push(arch)
+  }
+  return arches.length ? arches : null
+}
+
+function elfArch(buffer) {
+  if (buffer.length < 20) return null
+  if (buffer.readUInt32BE(0) !== 0x7f454c46) return null
+  const littleEndian = buffer[5] === 1
+  const machine = littleEndian ? buffer.readUInt16LE(18) : buffer.readUInt16BE(18)
+  return ELF_MACHINE.get(machine) || null
+}
+
+function peArch(buffer) {
+  if (buffer.length < 64 || buffer.readUInt16LE(0) !== 0x5a4d) return null
+  const headerOffset = buffer.readUInt32LE(60)
+  if (headerOffset + 6 > buffer.length) return null
+  if (buffer.readUInt32LE(headerOffset) !== 0x00004550) return null
+  return PE_MACHINE.get(buffer.readUInt16LE(headerOffset + 4)) || null
+}
+
+/**
+ * Every architecture the artifact can run on, or null when the bytes carry no
+ * recognizable object header (a text stub, a placeholder, a data file).
+ */
+export function nativeBinaryArches(buffer) {
+  const fat = machOFatArches(buffer)
+  if (fat) return fat
+  const single = machOArch(buffer) || elfArch(buffer) || peArch(buffer)
+  return single ? [single] : null
+}
+
+/** Convenience for the single-slice case; a fat binary reports its first slice. */
+export function nativeBinaryArch(buffer) {
+  return nativeBinaryArches(buffer)?.[0] ?? null
+}
+
+/**
+ * True when the artifact can run on `arch`. An unrecognized header answers
+ * true: the caller is verifying compiled objects, and refusing every file it
+ * cannot parse would fail builds over unrelated payloads.
+ */
+export function nativeBinaryRunsOn(buffer, arch) {
+  const arches = nativeBinaryArches(buffer)
+  return arches === null || arches.includes(arch)
+}

package/scripts/native-binary-arch.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  nativeBinaryArch,
+  nativeBinaryArches,
+  nativeBinaryRunsOn,
+} from './native-binary-arch.mjs'
+
+function machO({ cpu, littleEndian = true, wide = true }) {
+  const buffer = Buffer.alloc(32)
+  const magic = wide ? 0xfeedfacf : 0xfeedface
+  if (littleEndian) {
+    buffer.writeUInt32BE(wide ? 0xcffaedfe : 0xcefaedfe, 0)
+    buffer.writeUInt32LE(cpu, 4)
+  } else {
+    buffer.writeUInt32BE(magic, 0)
+    buffer.writeUInt32BE(cpu, 4)
+  }
+  return buffer
+}
+
+function machOFat(cpus) {
+  const buffer = Buffer.alloc(8 + cpus.length * 20)
+  buffer.writeUInt32BE(0xcafebabe, 0)
+  buffer.writeUInt32BE(cpus.length, 4)
+  cpus.forEach((cpu, index) => buffer.writeUInt32BE(cpu, 8 + index * 20))
+  return buffer
+}
+
+function elf(machine) {
+  const buffer = Buffer.alloc(32)
+  buffer.writeUInt32BE(0x7f454c46, 0)
+  buffer[5] = 1
+  buffer.writeUInt16LE(machine, 18)
+  return buffer
+}
+
+function pe(machine) {
+  const buffer = Buffer.alloc(128)
+  buffer.writeUInt16LE(0x5a4d, 0)
+  buffer.writeUInt32LE(64, 60)
+  buffer.writeUInt32LE(0x00004550, 64)
+  buffer.writeUInt16LE(machine, 68)
+  return buffer
+}
+
+test('Mach-O headers name their architecture in both endiannesses', () => {
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x01000007 })), 'x64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x0100000c })), 'arm64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 0x01000007, littleEndian: false })), 'x64')
+  assert.equal(nativeBinaryArch(machO({ cpu: 7, wide: false })), 'ia32')
+})
+
+test('universal binaries report every slice they carry', () => {
+  assert.deepEqual(nativeBinaryArches(machOFat([0x01000007, 0x0100000c])), ['x64', 'arm64'])
+  assert.equal(nativeBinaryRunsOn(machOFat([0x01000007, 0x0100000c]), 'arm64'), true)
+})
+
+test('ELF and PE headers are read too', () => {
+  assert.equal(nativeBinaryArch(elf(0x3e)), 'x64')
+  assert.equal(nativeBinaryArch(elf(0xb7)), 'arm64')
+  assert.equal(nativeBinaryArch(pe(0x8664)), 'x64')
+  assert.equal(nativeBinaryArch(pe(0xaa64)), 'arm64')
+})
+
+test('a foreign architecture is rejected for the target', () => {
+  assert.equal(nativeBinaryRunsOn(machO({ cpu: 0x0100000c }), 'x64'), false)
+  assert.equal(nativeBinaryRunsOn(elf(0x3e), 'arm64'), false)
+})
+
+test('bytes without a recognizable object header do not fail a build', () => {
+  assert.equal(nativeBinaryArches(Buffer.from('#!/bin/sh\nexec node "$0"\n')), null)
+  assert.equal(nativeBinaryRunsOn(Buffer.alloc(4), 'x64'), true)
+})

package/scripts/native-tool-download.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+
+/**
+ * Target-aware download of the four product-native tools for a desktop build.
+ *
+ * The runtime fetchers (graph/patch/spawn/token) resolve the HOST's asset.
+ * That is exactly right for an installed app fetching its own binary, and
+ * exactly wrong for preparing a runtime for another platform — so rather than
+ * teach four production code paths a build-only concern, this reads the same
+ * manifests and names the target explicitly.
+ *
+ * The URL is rebuilt from the manifest version and the target instead of being
+ * trusted verbatim, which keeps a rewritten manifest from redirecting the
+ * download; the recorded sha256 still has to match the bytes that arrive.
+ */
+import { createHash } from 'node:crypto'
+import { mkdir, readFile, rename, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+  streamResponseToFile,
+} from '../src/runtime/shared/bounded-download.mjs'
+
+const RELEASE_ROOT = 'https://github.com/tribgames/mixdog/releases/download'
+const TOOLS_DIR = new URL('../src/runtime/agent/orchestrator/tools/', import.meta.url)
+
+export const NATIVE_TOOL_KINDS = Object.freeze(['graph', 'patch', 'spawn', 'token'])
+
+/** Released asset name. Only token ships as a Node addon; the rest are executables. */
+export function nativeToolAssetName(kind, target) {
+  const suffix = kind === 'token' ? '.node' : (target.platform === 'win32' ? '.exe' : '')
+  return `mixdog-${kind}-${target.platform}-${target.arch}${suffix}`
+}
+
+export function nativeToolAssetUrl(kind, version, target) {
+  return `${RELEASE_ROOT}/${kind}-v${version}/${nativeToolAssetName(kind, target)}`
+}
+
+/** Installed name inside the app, named for the TARGET rather than the host. */
+export function nativeToolInstalledName(kind, target) {
+  if (kind === 'token') return 'mixdog-token.node'
+  return target.platform === 'win32' ? `mixdog-${kind}.exe` : `mixdog-${kind}`
+}
+
+async function sha256File(path) {
+  return createHash('sha256').update(await readFile(path)).digest('hex')
+}
+
+async function download(url, destination, label) {
+  // 4 attempts, 1s/3s/9s backoff. A 4xx is the manifest being wrong, not the
+  // network being unlucky, so it ends the attempt sequence immediately.
+  const delays = [1000, 3000, 9000]
+  let lastError
+  for (let attempt = 0; attempt <= delays.length; attempt += 1) {
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(180_000) })
+      if (response.status >= 400 && response.status < 500) {
+        throw new Error(`${label}: HTTP ${response.status} is terminal — ${url}`)
+      }
+      if (!response.ok) throw new Error(`${label}: HTTP ${response.status} — ${url}`)
+      await streamResponseToFile(response, destination, {
+        maxBytes: MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+        label,
+      })
+      return
+    } catch (error) {
+      lastError = error
+      if (String(error?.message || '').includes('is terminal')) throw error
+      if (attempt < delays.length) {
+        process.stderr.write(
+          `${label}: attempt ${attempt + 1} failed (${error?.message}); retrying…\n`,
+        )
+        await new Promise((resolve) => setTimeout(resolve, delays[attempt]))
+      }
+    }
+  }
+  throw lastError
+}
+
+export async function downloadNativeTool(kind, target, cacheDir) {
+  const manifestPath = fileURLToPath(new URL(`${kind}-manifest.json`, TOOLS_DIR))
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+  const version = String(manifest?.version || '')
+  if (!/^\d+\.\d+\.\d+$/.test(version)) {
+    throw new Error(`${kind}-manifest.json carries no usable version: ${version || '(empty)'}`)
+  }
+  const key = `${target.platform}-${target.arch}`
+  const asset = manifest?.assets?.[key]
+  const expectedSha256 = String(asset?.sha256 || '').toLowerCase()
+  if (!/^[a-f0-9]{64}$/.test(expectedSha256)) {
+    const supported = Object.keys(manifest?.assets || {}).join(', ') || '(none)'
+    throw new Error(`${kind}-manifest.json has no ${key} asset. Available: ${supported}.`)
+  }
+  const url = nativeToolAssetUrl(kind, version, target)
+  if (asset.url !== url) {
+    throw new Error(
+      `${kind}-manifest.json ${key} url does not match its own release identity.\n`
+      + `  manifest: ${asset.url}\n  expected: ${url}`,
+    )
+  }
+  await mkdir(cacheDir, { recursive: true })
+  const destination = join(cacheDir, `${nativeToolAssetName(kind, target)}-${version}`)
+  const label = `${kind} ${key} download`
+  try {
+    if (await sha256File(destination) === expectedSha256) return destination
+  } catch { /* absent or unreadable: download it */ }
+  const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`
+  await download(url, temporary, label)
+  const actual = await sha256File(temporary)
+  if (actual !== expectedSha256) {
+    await rm(temporary, { force: true })
+    throw new Error(`${label}: sha256 mismatch — expected ${expectedSha256}, got ${actual}`)
+  }
+  await rename(temporary, destination)
+  return destination
+}

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -334,45 +334,6 @@ export function makeAgentDispatch(opts = {}) {
         // pooled or resumed. Cache prefix matching happens at the provider
         // layer (account-level), not the session level.
         const finalPrompt = prompt;
-        // Agent shard spread: inside a shard child the ephemeral hidden-role
-        // session runs on a peer shard through the daemon session protocol —
-        // the same single spawn path the agent tool uses. ONE path per mode:
-        // a remote failure fails the dispatch (no in-process fallback).
-        const spreadMod = await import('../../../../standalone/agent-tool/shard-spread.mjs')
-            .catch(() => null);
-        if (spreadMod?.agentShardSpreadEnabled?.()) {
-            const raw = await spreadMod.dispatchHiddenAgentRemote({
-                spec: {
-                    agent,
-                    presetName,
-                    preset,
-                    runtimeSpec,
-                    permission,
-                    cwd,
-                    sourceType: opts.sourceType,
-                    sourceName: sourceNameArg || opts.sourceName,
-                    parentSessionId: opts.parentSessionId || null,
-                    ownerSessionId: opts.ownerSessionId === undefined ? (opts.parentSessionId || null) : opts.ownerSessionId,
-                    clientHostPid: opts.clientHostPid,
-                    skipRoleReminder: isPoolC,
-                    schemaAllowedTools: resolveHiddenRoleSchemaAllowedTools(hidden),
-                    taskType: opts.taskType,
-                    maxLoopIterations: opts.maxLoopIterations,
-                },
-                provider: preset.provider,
-                model: preset.model,
-                cwd,
-                prompt: finalPrompt,
-                parentSignals: [opts.parentSignal, callParentSignal],
-                watchdogPolicy: resolveAgentWatchdogPolicy(agent, {
-                    idleTimeoutMs: Number.isFinite(callIdleTimeoutMs)
-                        ? callIdleTimeoutMs
-                        : opts.idleTimeoutMs,
-                    firstResponseTimeoutMs: opts.firstResponseTimeoutMs,
-                }),
-            });
-            return opts.brief === false ? raw : applyBriefCap(raw);
-        }
         const { session } = prepareAgentSession({
             agent,
             presetName,

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { resourceAdmission } from '../../../shared/resource-admission.mjs';
 
 // Normal provider traffic is not concurrency-gated. Independent sessions and
 // accounts start immediately; a finite limit exists only when an operator
@@ -577,28 +578,33 @@ export function wrapProviderAdmission(provider, providerName, scheduler = provid
         const opts = sendOpts || {};
         const signal = opts.signal || null;
         const key = providerAdmissionKey(providerName, this);
-        return scheduler.run(key, (admissionSignal) => {
-            // Admission is the common request-clock boundary for WS/SSE/HTTP.
-            // Queue wait therefore cannot consume first-byte or agent-watchdog
-            // time. Provider-local retry remains the sole retry owner.
-            try { opts.onStageChange?.('requesting'); } catch {}
-            return originalSend.call(this, messages, model, tools, {
-                ...opts,
-                signal: admissionSignal,
-            });
-        }, {
-            signal,
-            ownerKey: opts.admissionOwner || opts.sessionId || null,
-            priority: opts.admissionPriority || 'user-visible',
-            onCooldownWait: (waitMs) => {
-                // Display-only: the TUI/desktop 'reconnecting' stage already
-                // renders a custom verb, so no new stage vocabulary is needed.
-                const secs = Math.max(1, Math.ceil(waitMs / 1000));
-                try {
-                    opts.onStageChange?.('reconnecting', { message: `Rate-limited — waiting ~${secs}s for the provider window` });
-                } catch { /* display-only */ }
-            },
-        });
+        // Provider queueing and network wait consume no local CPU slot. The
+        // resource controller reacquires the agent lease before model output
+        // continues through local context/tool processing.
+        return resourceAdmission.runYielded(() =>
+            scheduler.run(key, (admissionSignal) => {
+                // Admission is the common request-clock boundary for WS/SSE/HTTP.
+                // Queue wait therefore cannot consume first-byte or agent-watchdog
+                // time. Provider-local retry remains the sole retry owner.
+                try { opts.onStageChange?.('requesting'); } catch {}
+                return originalSend.call(this, messages, model, tools, {
+                    ...opts,
+                    signal: admissionSignal,
+                });
+            }, {
+                signal,
+                ownerKey: opts.admissionOwner || opts.sessionId || null,
+                priority: opts.admissionPriority || 'user-visible',
+                onCooldownWait: (waitMs) => {
+                    // Display-only: the TUI/desktop 'reconnecting' stage already
+                    // renders a custom verb, so no new stage vocabulary is needed.
+                    const secs = Math.max(1, Math.ceil(waitMs / 1000));
+                    try {
+                        opts.onStageChange?.('reconnecting', { message: `Rate-limited — waiting ~${secs}s for the provider window` });
+                    } catch { /* display-only */ }
+                },
+            })
+        );
     };
     return provider;
 }

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -164,7 +164,7 @@ export class GeminiProvider {
     /**
      * Stream-death recovery: re-issue a dead stream ONCE as a
      * non-streaming generateContent call instead of failing the turn.
-     * Narrower than cc by design — canFallbackNonStreaming() clears only a
+     * Deliberately narrow — canFallbackNonStreaming() clears only a
      * stream that exposed nothing, so rendered text is never duplicated and a
      * dispatched tool can never run twice. Returns the aggregated response, or
      * null when the failure is ineligible or the fallback itself fails.

package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs

@@ -130,7 +130,7 @@ export const LOGIN_TIMEOUT_MS = 5 * 60_000;
 // SSRF guard for any endpoint pulled from the discovery document or saved
 // tokens. xAI OAuth endpoints must be https on x.ai / *.x.ai — reject
 // anything else outright so a hostile discovery response can't redirect the
-// token / refresh request. Mirrors openclaw's isTrustedXaiOAuthEndpoint.
+// token / refresh request.
 function assertTrustedXaiEndpoint(endpoint, label) {
     let url;
     try {

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -456,7 +456,7 @@ export async function consumeCompatChatCompletionStream(stream, {
         if (leakGuard.enabled) flushLeak();
     } catch (err) {
         // Any mid-stream failure after live text was relayed is non-retryable —
-        // but the streamed partial must still ride on the error (CC rule: once
+        // but the streamed partial must still ride on the error (rule: once
         // output is visible, keep it and finalize with a notice instead of
         // discarding the turn). The loop's partial-final path consumes these.
         if (emittedText) {
@@ -1029,7 +1029,7 @@ export async function consumeCompatResponsesStream(stream, {
         const err = truncatedCompatStreamError(label, 'no response.completed');
         if (state.emittedText) {
             // Truncation after visible output: keep the streamed partial
-            // (CC rule) so the loop can finalize it as partial-final instead
+            // (same rule) so the loop can finalize it as partial-final instead
             // of dropping the turn. liveText marking still blocks replay.
             markErrorLiveTextEmitted(err);
             try {

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -312,7 +312,7 @@ function _buildHandshakeHeaders({ auth, sessionToken, turnState, cacheKey: _cach
     // xAI WS: do NOT pin x-grok-conv-id. Measured parallel runs show that
     // forcing a routing shard via that header alternates cold caches across
     // parallel workers; the automatic prompt-prefix cache holds up better
-    // when each handshake is unpinned. Reference: vercel/ai xai provider.
+    // when each handshake is unpinned.
     const headers = auth.type === 'xai'
         ? {
             'Authorization': `Bearer ${auth.apiKey}`,

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -689,7 +689,7 @@ export async function _streamResponse({
                 finish();
             }, interChunkMs);
         };
-        // pi per-event idle: (re)armed only on meaningful output deltas via
+        // Per-event idle: (re)armed only on meaningful output deltas via
         // bumpSemanticIdle(). Keepalive/metadata frames DON'T touch it, so a
         // deltas-then-silent wedge trips this short semantic window.
         const resetSemanticIdle = () => {

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -116,7 +116,7 @@ export function classifyError(err) {
   const status = Number(err.httpStatus || err.status || err.response?.status || 0) || 0
   if (AUTH_STATUSES.has(status)) return 'auth'
   // Stale previous_response_id is recoverable by dropping the chain and
-  // re-issuing a full frame (codex maps it to ApiError::Retryable). A typed
+  // re-issuing a full frame, which is the retryable path. A typed
   // 400 here is not a deterministic payload refusal.
   if (shouldDropPreviousResponseId(err)) return 'transient'
   if (typedErrorCode(err) === WEBSOCKET_CONNECTION_LIMIT) return 'transient'
@@ -137,7 +137,7 @@ export function classifyError(err) {
   // ever attempted (observed live: pooled WS retired by the server between
   // turns → close 1000 before response.created → the whole turn failed).
   // Reference behavior retries the same disconnect (codex `CodexErr::Stream`
-  // is_retryable, cc falls back/retries the stream); the exposure deny above
+  // is_retryable, and a stream fallback/retry applies); the exposure deny above
   // still fails closed for anything already relayed or dispatched.
   if (isNonTerminalStreamClose(err)) return 'transient'
 
@@ -162,10 +162,10 @@ export function classifyError(err) {
   ))) return 'transient'
 
   // Provider wire error event (`response.failed` / terminal `error` frame):
-  // default-retry, codex parity. codex maps every response.failed whose typed
-  // code is not a deterministic refusal to ApiError::Retryable (fatal codes
-  // are an explicit allow-list); cc retries all 5xx/overloaded 10×; opencode
-  // marks server_error/server_is_overloaded isRetryable. Evidence stays
+  // default-retry. Every response.failed whose typed code is not a
+  // deterministic refusal is retryable (fatal codes are an explicit
+  // allow-list), and server_error / server_is_overloaded count as retryable
+  // too. Evidence stays
   // structural — the event's own typed code/type field — message text is
   // never parsed. Exposure precedence is preserved: the replayUnsafe gate at
   // the top of this function already returned 'permanent' for any stream
@@ -379,8 +379,8 @@ function isPermanentQuotaError(err) {
 
 // ── Wire error events: default-retry with a fatal-code deny-list ────────────
 // Deterministic refusal codes a `response.failed` / `error` wire event may
-// carry: retrying the identical request can never succeed. Mirrors codex's
-// fatal set (context/quota/policy) plus the auth/billing refusals the
+// carry: retrying the identical request can never succeed. The fatal set is
+// context/quota/policy plus the auth/billing refusals the
 // Responses and Anthropic wire formats use. Everything OUTSIDE this set —
 // server_error, server_is_overloaded, slow_down, or an event with no code at
 // all — is a server-side fault and is retried under the bounded budgets
@@ -753,7 +753,7 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
     // A typed non-transient 4xx on the failure payload is a deterministic
     // refusal even without a recognized code string.
     if (failedStatus >= 400 && failedStatus < 500 && !TRANSIENT_STATUSES.has(failedStatus)) return null
-    // Default-retry (codex parity): a wire failure that is neither a fatal
+    // Default-retry: a wire failure that is neither a fatal
     // refusal nor a typed 4xx is a server-side fault — re-issue it under the
     // bounded mid-stream budget instead of failing the turn.
     return _allowMidstream('response_failed_retryable', attemptIndex, policy)

package/src/runtime/agent/orchestrator/session/compact/file-reattach.mjs

@@ -1,5 +1,5 @@
-// Post-compact file re-attachment (claude-code createPostCompactFileAttachments
-// parity). Files the summarized-away head had `read` are re-read FRESH from
+// Post-compact file re-attachment. Files the summarized-away head had `read`
+// are re-read FRESH from
 // disk and re-injected right after the summary message, so the model does not
 // burn a turn (and tokens) re-reading files it was actively working with.
 //  - newest-first, capped at MAX_REATTACH_FILES and per-file/total token caps

package/src/runtime/agent/orchestrator/session/compact/runner.mjs

@@ -59,7 +59,7 @@ import {
     stripWorkingFileSections,
 } from './handoff.mjs';
 
-// Post-compact file re-attachment (claude-code parity): re-inject fresh reads
+// Post-compact file re-attachment: re-inject fresh reads
 // of files the summarized-away head was working with, when they still fit the
 // budget. Semantic compact still uses this; recall-fasttrack lists paths
 // instead of file bodies.

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -152,7 +152,7 @@ export function markSessionAskStart(id) {
     // Publish heartbeat immediately so the status aggregator picks the
     // session up in the connecting / requesting window. Without this the
     // .hb file only landed on the first stream chunk — producing a 3–10s
-    // (xhigh: 30s+) invisible gap where agent sessions ran but the CC
+    // (xhigh: 30s+) invisible gap where agent sessions ran but the
     // statusline showed no maintenance/agent badge. STREAM_FRESH_MS (5 min)
     // still drops a session whose provider truly never returns a chunk;
     // markSessionStreamDelta keeps refreshing once chunks arrive.

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint.mjs

@@ -64,27 +64,12 @@ export function projectTurnCheckpointMessages(session, checkpoint) {
         || !Array.isArray(checkpoint?.turnMessages)) return source;
     const sessionGeneration = Number(session.generation) || 0;
     const checkpointGeneration = Number(checkpoint.generation) || 0;
-    const owner = String(session.owner || '').trim().toLowerCase();
-    const agent = String(session.agent || '').trim().toLowerCase();
-    const detachedLiveAgent = session.closed === true
-        && (owner === 'agent' || (agent && agent !== 'lead'))
-        && Boolean(String(session.ownerSessionId || session.parentSessionId || '').trim());
     const markerToken = typeof session.activeTurnCheckpoint?.turnToken === 'string'
         ? session.activeTurnCheckpoint.turnToken
         : null;
     const markerMatches = markerToken === checkpoint.turnToken;
     const checkpointIsNewer = Number(checkpoint.updatedAt) > Number(session.updatedAt || 0);
-    // External workers deliberately detach the durable session before their
-    // shard-owned turn finishes. closeSession writes the lifecycle fence by
-    // advancing the session generation once, while that already-running turn
-    // keeps publishing under its original generation. Accept exactly that
-    // one-generation handoff only when the durable marker token still proves
-    // identity and the checkpoint was written after the detach.
-    const detachedGenerationHandoff = detachedLiveAgent
-        && sessionGeneration === checkpointGeneration + 1
-        && markerMatches
-        && checkpointIsNewer;
-    if ((checkpointGeneration !== sessionGeneration && !detachedGenerationHandoff)
+    if (checkpointGeneration !== sessionGeneration
         || (markerToken && !markerMatches)
         || (!markerToken && !checkpointIsNewer)) return source;
     let start = -1;