mixdog 0.9.173 → 0.9.175

package/README.md

@@ -43,10 +43,6 @@ security warning.
 
 Requires Node.js 22.19+ (22.x) or 24+.
 
-CLI native assets support Windows x64, macOS x64/ARM64, and Linux x64/ARM64.
-Windows ARM64 Node.js is not supported. On ARM Windows, use x64 Node.js under
-Windows x64 emulation; native ARM64 installation is not available.
-
 ```bash
 npm install -g mixdog
 mixdog
@@ -263,13 +259,16 @@ Mixdog supports subscription OAuth and API-key routes, including:
 
 - Anthropic API keys and Claude account OAuth
 - OpenAI API keys and ChatGPT/Codex account OAuth
-- Google Gemini API keys and Antigravity OAuth
+- Google Gemini API keys
 - xAI API keys and Grok account OAuth
 - OpenRouter API keys and its unified model catalog
-- Experimental Cursor account OAuth
 - DeepSeek and OpenCode Go
 - Mixdog's built-in Local Provider
 
+Cursor and Antigravity (Gemini) account OAuth are off by default; turn them on
+under **Settings → Developer**, which warns that using these providers through
+OAuth risks account restrictions.
+
 The model picker combines live provider catalogs with model metadata for
 context limits, pricing, tool support, reasoning, and recency.
 
@@ -297,7 +296,7 @@ mixdog
 mixdog --provider anthropic-oauth --model claude-haiku-4-5-20251001
 
 # Select a workflow
-mixdog --workflow solo
+mixdog --workflow default
 
 # Use read-only tools
 mixdog --readonly
@@ -376,10 +375,10 @@ Workflows and agents are Markdown definition packs (`WORKFLOW.md`, `AGENT.md`).
 Built-in packs ship with Mixdog; custom packs live under the Mixdog data
 directory.
 
-**Solo** is the default workflow: the Lead does the work without delegating.
-Choose **Cowork** (`mixdog --workflow default`) for parallel agent delegation.
-Running multiple independent Desktop sessions is separate from delegating
-work to agents within one session.
+By default the Lead does the work without delegating (**Solo**). Each
+session's orchestration mode sets how much it delegates to agents, up to
+**Swarm** for maximum delegation. Running multiple independent Desktop
+sessions is separate from delegating work to agents within one session.
 
 To start a time-bounded Goal, for example:
 
@@ -497,7 +496,7 @@ Main directories:
 
 ```text
 src/            CLI, TUI, runtime, workflows, agents, and rules
-apps/desktop/   cross-platform desktop app
+apps/desktop/   desktop app
 apps/relay/     remote web app and relay
 native/         native process, search, graph, patch, and support binaries
 scripts/        tests, diagnostics, benchmarks, and build scripts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.173",
+  "version": "0.9.175",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -75,10 +75,10 @@
     "test:native-edit-wire": "node scripts/native-edit-wire-test.mjs",
     "test:release-critical": "npm run test:release-assets && npm run smoke:patch && npm run test:providers",
     "test:spec-advisory": "node scripts/run-advisory-spec.mjs && npm run test:spec-advisory --prefix apps/desktop",
-    "test:session-transport": "node --test \"scripts/session-transport/*.test.mjs\" scripts/daemon-bootstrap-test.mjs src/runtime/shared/child-spawn-remote.test.mjs src/standalone/session-runtime-agent-control-client.test.mjs src/standalone/session-runtime-dispatch-cancel.test.mjs src/standalone/session-runtime-host-factory.test.mjs src/standalone/session-runtime-inline-host.test.mjs src/standalone/session-runtime-provider-cooldown.test.mjs src/standalone/session-runtime-shard-host.test.mjs src/standalone/session-runtime-shard-router.test.mjs",
+    "test:session-transport": "node --test \"scripts/session-transport/*.test.mjs\" scripts/daemon-bootstrap-test.mjs src/standalone/session-runtime-inline-host.test.mjs",
     "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store.slow.test.mjs scripts/turn-review-revert.slow.test.mjs src/runtime/shared/tool-surface.test.mjs src/runtime/bridge-clients.test.mjs src/runtime/browser-bridge/action-schema.test.mjs src/runtime/computer-bridge/client-semantic-error.test.mjs src/runtime/agent/orchestrator/session/tool-envelope.test.mjs src/runtime/agent/orchestrator/session/eager-dispatch.test.mjs",
     "test:quick": "npm run test:session && npm run test:session-transport && npm run test:desktop-main --prefix apps/desktop",
-    "test:office": "node --test scripts/run-office-live-tests.test.mjs src/runtime/office/office-runtime-contract.test.mjs src/runtime/office/office-runtime-com.test.mjs src/runtime/office/office-runtime-portable.test.mjs src/runtime/office/xlsx-formula-audit.test.mjs src/runtime/office/xlsx-portable-snapshot.test.mjs src/runtime/office/office-runtime-pdf.test.mjs src/runtime/office/office-runtime-design.test.mjs src/runtime/office/office-assurance.test.mjs src/runtime/office/office-design-aesthetics.test.mjs src/runtime/office/portable-authoring.test.mjs src/runtime/office/slide-quality.test.mjs src/runtime/office/authoring/pptx-brief.test.mjs src/runtime/office/authoring/pptx-receipt.test.mjs src/runtime/office/quality/render-air.test.mjs src/runtime/office/quality/pptx-deck-rubric.test.mjs && npm run test:office-approval --prefix apps/desktop",
+    "test:office": "node --test scripts/run-office-live-tests.test.mjs src/runtime/office/office-runtime-contract.test.mjs src/runtime/office/office-runtime-com.test.mjs src/runtime/office/office-runtime-portable.slow.test.mjs src/runtime/office/xlsx-formula-audit.test.mjs src/runtime/office/xlsx-portable-snapshot.test.mjs src/runtime/office/office-runtime-pdf.slow.test.mjs src/runtime/office/office-runtime-design.test.mjs src/runtime/office/office-assurance.slow.test.mjs src/runtime/office/office-design-aesthetics.test.mjs src/runtime/office/portable-authoring.slow.test.mjs src/runtime/office/slide-quality.test.mjs src/runtime/office/authoring/pptx-brief.test.mjs src/runtime/office/authoring/pptx-receipt.test.mjs src/runtime/office/quality/render-air.test.mjs src/runtime/office/quality/pptx-deck-rubric.test.mjs && npm run test:office-approval --prefix apps/desktop",
     "test:office:live": "node scripts/run-office-live-tests.mjs",
     "test:office:preview": "node --test src/runtime/office/office-render-preview.test.mjs",
     "test:office:review": "node --test src/runtime/office/pptx-independent-review.test.mjs src/runtime/office/pptx-chart-styling.test.mjs",

package/scripts/agent-turn-trace-probe.mjs

@@ -76,7 +76,7 @@ try {
         '2) read README.md (first 40 lines)',
         '3) run the shell command: node -v',
         '4) read apps/desktop/package.json',
-        '5) grep the string "createSessionRuntimeHost" under src/standalone (files list only)',
+        '5) grep the string "createInlineSessionRuntimeHost" under src/standalone (files list only)',
         'Then reply with one line: DONE <package name> <node version>. Do not edit anything.',
       ].join('\n'),
     },

package/scripts/build-ffmpeg-runtime.sh

@@ -16,6 +16,22 @@ echo "==> Downloading FFmpeg n${FFMPEG_VERSION}"
 curl -fsSL --retry 3 \
 	"https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz" \
 	-o "$BUILD_DIR/ffmpeg.tar.xz"
+# ffmpeg.org publishes no .sha256 for releases; this digest was computed from the
+# official https://ffmpeg.org/releases/ffmpeg-6.1.1.tar.xz. Update it with FFMPEG_VERSION.
+FFMPEG_SHA256="8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
+if [[ "$FFMPEG_VERSION" != "6.1.1" ]]; then
+	echo "No pinned SHA-256 for FFmpeg ${FFMPEG_VERSION}" >&2
+	exit 1
+fi
+if command -v sha256sum >/dev/null 2>&1; then
+	ACTUAL_SHA256="$(sha256sum "$BUILD_DIR/ffmpeg.tar.xz" | cut -d' ' -f1)"
+else
+	ACTUAL_SHA256="$(shasum -a 256 "$BUILD_DIR/ffmpeg.tar.xz" | cut -d' ' -f1)"
+fi
+if [[ "$ACTUAL_SHA256" != "$FFMPEG_SHA256" ]]; then
+	echo "FFmpeg source SHA-256 mismatch: expected $FFMPEG_SHA256, got $ACTUAL_SHA256" >&2
+	exit 1
+fi
 tar -xJf "$BUILD_DIR/ffmpeg.tar.xz" -C "$BUILD_DIR"
 
 # shellcheck disable=SC2054  # comma lists are single ffmpeg --enable-* values

package/scripts/build-runtime-linux.sh

@@ -12,6 +12,10 @@ set -euo pipefail
 
 PG_VERSION="16.4"
 PGVECTOR_VERSION="0.8.2"
+# sha256 from https://ftp.postgresql.org/pub/source/v16.4/postgresql-16.4.tar.gz.sha256
+PG_TARBALL_SHA256="2e17a90062403e15d6540480fdec50c8b005eb48729a91cb4989ffeb04df193c"
+# Commit the pgvector v0.8.2 tag resolves to (git ls-remote refs/tags/v0.8.2).
+PGVECTOR_COMMIT="cab9da72c04353f143bb06b42ab70a403daac64a"
 TARGET_OS="${TARGET_OS:-linux}"
 TARGET_ARCH="${TARGET_ARCH:-x64}"
 
@@ -54,6 +58,7 @@ else
 		curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
 			-o "postgresql-${PG_VERSION}.tar.gz"
 	fi
+	echo "${PG_TARBALL_SHA256}  postgresql-${PG_VERSION}.tar.gz" | sha256sum -c -
 	rm -rf "postgresql-${PG_VERSION}"
 	tar xzf "postgresql-${PG_VERSION}.tar.gz"
 
@@ -94,8 +99,9 @@ else
 	echo "==> Cloning pgvector $PGVECTOR_VERSION"
 	cd "$BUILD_DIR"
 	rm -rf pgvector
-	git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-		https://github.com/pgvector/pgvector.git pgvector
+	git clone https://github.com/pgvector/pgvector.git pgvector
+	git -C pgvector -c advice.detachedHead=false checkout --detach "$PGVECTOR_COMMIT"
+	[[ "$(git -C pgvector rev-parse HEAD)" == "$PGVECTOR_COMMIT" ]]
 
 	echo "==> Building pgvector"
 	cd pgvector

package/scripts/build-runtime-macos.sh

@@ -9,6 +9,10 @@ set -euo pipefail
 
 PG_VERSION="16.4"
 PGVECTOR_VERSION="0.8.2"
+# sha256 from https://ftp.postgresql.org/pub/source/v16.4/postgresql-16.4.tar.gz.sha256
+PG_TARBALL_SHA256="2e17a90062403e15d6540480fdec50c8b005eb48729a91cb4989ffeb04df193c"
+# Commit the pgvector v0.8.2 tag resolves to (git ls-remote refs/tags/v0.8.2).
+PGVECTOR_COMMIT="cab9da72c04353f143bb06b42ab70a403daac64a"
 TARGET_OS="${TARGET_OS:-darwin}"
 TARGET_ARCH="${TARGET_ARCH:-$(uname -m | sed 's/x86_64/x64/')}"
 
@@ -41,6 +45,7 @@ else
 		curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
 			-o "postgresql-${PG_VERSION}.tar.gz"
 	fi
+	echo "${PG_TARBALL_SHA256}  postgresql-${PG_VERSION}.tar.gz" | shasum -a 256 -c -
 	rm -rf "postgresql-${PG_VERSION}"
 	tar xzf "postgresql-${PG_VERSION}.tar.gz"
 
@@ -85,8 +90,9 @@ else
 	echo "==> Cloning + building pgvector $PGVECTOR_VERSION"
 	cd "$BUILD_DIR"
 	rm -rf pgvector
-	git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-		https://github.com/pgvector/pgvector.git pgvector
+	git clone https://github.com/pgvector/pgvector.git pgvector
+	git -C pgvector -c advice.detachedHead=false checkout --detach "$PGVECTOR_COMMIT"
+	[[ "$(git -C pgvector rev-parse HEAD)" == "$PGVECTOR_COMMIT" ]]
 	cd pgvector
 	make PG_CONFIG="$PG_CONFIG" -j"$(sysctl -n hw.logicalcpu)"
 	make PG_CONFIG="$PG_CONFIG" install

package/scripts/build-tui.mjs

@@ -7,13 +7,14 @@
  * ESM bundle at src/tui/dist/index.mjs.
  *
  * What is bundled vs external:
- *   - bundled: our JSX only.
- *   - external: React and Mixdog's patched Ink runtime dependency.
+ *   - bundled: our JSX and the local modules it imports, plus Mixdog's patched
+ *     Ink with its whole dependency tree (see bundleInkPlugin).
+ *   - external: React and every package our own code imports.
  *
  * Run:  node scripts/build-tui.mjs   (or `npm run build:tui`)
  */
 import { build } from 'esbuild';
-import { dirname, join } from 'node:path';
+import { dirname, isAbsolute, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
@@ -41,6 +42,30 @@ const sessionClientExternalPlugin = {
   },
 };
 
+// Ink's ESM build is ~500 small files (es-toolkit alone is ~430), and loading
+// them one by one cost ~150 ms of every TUI start, so Ink and everything it
+// imports are bundled. React stays external so Ink's reconciler and our
+// components share one React instance; packages our own code imports stay
+// external. Ink's optional React DevTools bridge (DEV=true) is left out: it
+// would pull ws and the uninstalled react-devtools-core into the bundle.
+const bundleInkPlugin = {
+  name: 'mixdog-bundle-ink',
+  setup(build) {
+    build.onResolve({ filter: /^[^./]/ }, ({ path, importer, kind }) => {
+      if (kind === 'entry-point' || isAbsolute(path)) return undefined;
+      if (path === 'react' || path.startsWith('react/')) return { path, external: true };
+      if (path === 'ink' || /[\\/]node_modules[\\/]/.test(importer)) return undefined;
+      return { path, external: true };
+    });
+    build.onResolve({ filter: /^\.\/devtools\.js$/ }, ({ importer }) =>
+      /[\\/]node_modules[\\/]ink[\\/]/.test(importer)
+        ? { path: 'ink-devtools', namespace: 'mixdog-omitted' }
+        : undefined
+    );
+    build.onLoad({ filter: /.*/, namespace: 'mixdog-omitted' }, () => ({ contents: '' }));
+  },
+};
+
 await build({
   entryPoints: [join(SRC, 'index.jsx')],
   outfile: join(SRC, 'dist', 'index.mjs'),
@@ -49,11 +74,9 @@ await build({
   platform: 'node',
   target: 'node22',
   jsx: 'automatic',
-  // Keep package imports external like the original CLI flow. Local shared
-  // helpers are bundled so relative paths stay valid from src/tui/dist/.
-  // Process shutdown stays external so the CLI and checked-in TUI bundle use
-  // the same process-global lifecycle state.
-  packages: 'external',
+  // Local shared helpers are bundled so relative paths stay valid from
+  // src/tui/dist/. Process shutdown stays external so the CLI and checked-in
+  // TUI bundle use the same process-global lifecycle state.
   // Bundled CJS helpers (e.g. src/lib/mixdog-debug.cjs) compile to esbuild's
   // __require shim, which throws "Dynamic require of ..." in plain ESM.
   // Provide a real module-scope require so those requires resolve at runtime.
@@ -73,7 +96,7 @@ await build({
     '../../runtime/channels/lib/voice-runtime-fetcher.mjs',
     '../../runtime/channels/lib/whisper-server.mjs',
   ],
-  plugins: [sharedRuntimeExternalPlugin, sessionClientExternalPlugin],
+  plugins: [sharedRuntimeExternalPlugin, sessionClientExternalPlugin, bundleInkPlugin],
   logLevel: 'info',
 });
 

package/scripts/computer-task-cost-report.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
+import { distribution } from './lib/trace-stats.mjs';
 
 function arg(name, fallback) {
   const prefix = `--${name}=`;
@@ -14,26 +15,10 @@ function load(path) {
   return JSON.parse(readFileSync(resolve(path), 'utf8'));
 }
 
-function percentile(values, fraction) {
-  const sorted = values
-    .map(Number)
-    .filter(Number.isFinite)
-    .sort((a, b) => a - b);
-  if (sorted.length === 0) return 0;
-  return sorted[Math.max(0, Math.ceil(sorted.length * fraction) - 1)];
-}
-
 function fixed(value, digits = 2) {
   return Number(Number(value || 0).toFixed(digits));
 }
 
-function distribution(values) {
-  return {
-    p50: percentile(values, 0.5),
-    p95: percentile(values, 0.95),
-  };
-}
-
 const modelPath = arg('model', 'artifacts/computer-use/computer-schema-sequence-guided-full.json');
 const hostPath = arg('host', 'apps/desktop/artifacts/computer-use/scenario-repeat-further-optimized-v5.json');
 const sequencePath = arg('sequence', 'artifacts/computer-use/sequence-performance-final.json');

package/scripts/graph-parity.mjs

@@ -6,6 +6,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import { pathToFileURL } from 'node:url';
+import { median, sortedFinite } from './lib/trace-stats.mjs';
 
 const USAGE = `usage: node scripts/graph-parity.mjs --old <binary> --new <binary> [--root <dir>] [--files <rel>...] [--json <out>] [--kind-map <path.json>] [--tokens] [--allow-new-languages <ids>] [--max-symbol-loss N] [--max-import-diff N] [--max-token-loss N] [--max-time-ratio 1.10] [--runs 3]
        node scripts/graph-parity.mjs --old-jsonl <file> --new-jsonl <file> [thresholds...]`;
@@ -227,13 +228,6 @@ function asStr(v) {
   return typeof v === 'string' ? v : '';
 }
 
-function median(values) {
-  const s = [...values].sort((a, b) => a - b);
-  if (!s.length) return 0;
-  const mid = Math.floor(s.length / 2);
-  return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
-}
-
 function normalizeSymbol(s) {
   return {
     name: String(s?.name ?? ''),
@@ -1018,7 +1012,7 @@ async function runTimedWalks(bin, root, runs) {
     times.push(result.ms);
     last = result;
   }
-  return { times, medianMs: median(times), stdout: last.stdout };
+  return { times, medianMs: median(sortedFinite(times)), stdout: last.stdout };
 }
 
 function kindMapError(message) {
@@ -1052,67 +1046,90 @@ export async function loadKindMap(opts, root, runner = runProcess) {
   }
 }
 
+// Runs the old and new binaries against the live tree: timed walks, the
+// manifest comparison and, with --files, the incremental re-walk of those files.
+async function walkBothBinaries(opts, root, allowedSet) {
+  const oldWalk = await runTimedWalks(opts.old, root, opts.runs);
+  const newWalk = await runTimedWalks(opts.new, root, opts.runs);
+  let ratio = 1;
+  if (oldWalk.medianMs > 0) ratio = newWalk.medianMs / oldWalk.medianMs;
+  else if (newWalk.medianMs > 0) ratio = Infinity;
+  const timing = {
+    oldMs: oldWalk.medianMs,
+    newMs: newWalk.medianMs,
+    ratio,
+    runs: opts.runs,
+    oldTimes: oldWalk.times,
+    newTimes: newWalk.times,
+  };
+  let oldRecords = parseJsonl(oldWalk.stdout);
+  let newRecords = parseJsonl(newWalk.stdout);
+
+  const oldMan = await runProcess(opts.old, [root, '--manifest']);
+  const newMan = await runProcess(opts.new, [root, '--manifest']);
+  const manifestRawIdentical = Buffer.compare(oldMan.stdout, newMan.stdout) === 0;
+  let manifestIdentical = true;
+  let manifestDroppedNew = [];
+  let manifestDroppedOld = [];
+  if (!manifestRawIdentical) {
+    const filtered = compareManifests(oldMan.stdout, newMan.stdout, allowedSet);
+    manifestIdentical = filtered.identical;
+    manifestDroppedNew = filtered.newDropped;
+    manifestDroppedOld = filtered.oldDropped;
+  }
+
+  if (opts.files?.length) {
+    const files = opts.files.map(normalizeRel);
+    const fileSet = new Set(files);
+    const reused = oldRecords.filter((rec) => !fileSet.has(normalizeRel(rec.rel))).map(reusedMetaLine);
+    const stdinText = reused.length ? `${reused.join('\n')}\n` : '';
+    const oldFiles = await runProcess(opts.old, [root, '--files', ...files], { stdinText });
+    const newFiles = await runProcess(opts.new, [root, '--files', ...files], { stdinText });
+    oldRecords = parseJsonl(oldFiles.stdout);
+    newRecords = parseJsonl(newFiles.stdout);
+  }
+  return {
+    oldRecords,
+    newRecords,
+    timing,
+    manifestIdentical,
+    manifestRawIdentical,
+    oldManifest: oldMan.stdout,
+    newManifest: newMan.stdout,
+    manifestDroppedNew,
+    manifestDroppedOld,
+  };
+}
+
 export async function runParity(opts) {
   const root = resolve(opts.root || '.');
   const jsonlMode = Boolean(opts.oldJsonl && opts.newJsonl);
   const allowNewLanguages = [...new Set(opts.allowNewLanguages || [])];
   const allowedSet = new Set(allowNewLanguages);
-  let oldRecords;
-  let newRecords;
-  let timing = null;
-  let manifestIdentical = null;
-  let manifestRawIdentical = null;
-  let oldManifest = null;
-  let newManifest = null;
-  let manifestDroppedNew = [];
-  let manifestDroppedOld = [];
   const loadedKinds = await loadKindMap(opts, root);
-
-  if (jsonlMode) {
-    oldRecords = parseJsonl(readFileSync(opts.oldJsonl));
-    newRecords = parseJsonl(readFileSync(opts.newJsonl));
-  } else {
-    const oldWalk = await runTimedWalks(opts.old, root, opts.runs);
-    const newWalk = await runTimedWalks(opts.new, root, opts.runs);
-    let ratio = 1;
-    if (oldWalk.medianMs > 0) ratio = newWalk.medianMs / oldWalk.medianMs;
-    else if (newWalk.medianMs > 0) ratio = Infinity;
-    timing = {
-      oldMs: oldWalk.medianMs,
-      newMs: newWalk.medianMs,
-      ratio,
-      runs: opts.runs,
-      oldTimes: oldWalk.times,
-      newTimes: newWalk.times,
-    };
-    oldRecords = parseJsonl(oldWalk.stdout);
-    newRecords = parseJsonl(newWalk.stdout);
-
-    const oldMan = await runProcess(opts.old, [root, '--manifest']);
-    const newMan = await runProcess(opts.new, [root, '--manifest']);
-    oldManifest = oldMan.stdout;
-    newManifest = newMan.stdout;
-    manifestRawIdentical = Buffer.compare(oldMan.stdout, newMan.stdout) === 0;
-    if (manifestRawIdentical) {
-      manifestIdentical = true;
-    } else {
-      const filtered = compareManifests(oldMan.stdout, newMan.stdout, allowedSet);
-      manifestIdentical = filtered.identical;
-      manifestDroppedNew = filtered.newDropped;
-      manifestDroppedOld = filtered.oldDropped;
-    }
-
-    if (opts.files?.length) {
-      const files = opts.files.map(normalizeRel);
-      const fileSet = new Set(files);
-      const reused = oldRecords.filter((rec) => !fileSet.has(normalizeRel(rec.rel))).map(reusedMetaLine);
-      const stdinText = reused.length ? `${reused.join('\n')}\n` : '';
-      const oldFiles = await runProcess(opts.old, [root, '--files', ...files], { stdinText });
-      const newFiles = await runProcess(opts.new, [root, '--files', ...files], { stdinText });
-      oldRecords = parseJsonl(oldFiles.stdout);
-      newRecords = parseJsonl(newFiles.stdout);
-    }
-  }
+  const {
+    oldRecords,
+    newRecords,
+    timing,
+    manifestIdentical,
+    manifestRawIdentical,
+    oldManifest,
+    newManifest,
+    manifestDroppedNew,
+    manifestDroppedOld,
+  } = jsonlMode
+    ? {
+        oldRecords: parseJsonl(readFileSync(opts.oldJsonl)),
+        newRecords: parseJsonl(readFileSync(opts.newJsonl)),
+        timing: null,
+        manifestIdentical: null,
+        manifestRawIdentical: null,
+        oldManifest: null,
+        newManifest: null,
+        manifestDroppedNew: [],
+        manifestDroppedOld: [],
+      }
+    : await walkBothBinaries(opts, root, allowedSet);
 
   const compared = compareWalks(oldRecords, newRecords, {
     kindMap: loadedKinds.map,

package/scripts/lib/bench-sandbox.mjs

@@ -0,0 +1,67 @@
+// Live-bench plumbing shared by bench-run, internal-comms-bench and
+// output-style-bench: where the real data dir lives, the OAuth artifacts a
+// sandboxed data dir needs to reach a provider, and the session id a headless
+// run prints.
+import { copyFileSync, existsSync, readdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+// Filenames verified in provider ensureAuth / token paths (resolvePluginData / getPluginData).
+export const AUTH_ARTIFACT_BY_PROVIDER = {
+  'grok-oauth': ['grok-oauth.json', 'grok-oauth-models.json'],
+  'anthropic-oauth': ['anthropic-oauth-credentials.json', 'anthropic-oauth-models.json'],
+  'openai-oauth': ['openai-oauth.json', 'openai-oauth-models.json'],
+};
+
+export function defaultUserDataDir() {
+  return process.env.MIXDOG_DATA_DIR || join(process.env.MIXDOG_HOME || join(homedir(), '.mixdog'), 'data');
+}
+
+export function readUnifiedConfig(dataDir) {
+  try {
+    const unified = JSON.parse(readFileSync(join(dataDir, 'mixdog-config.json'), 'utf8'));
+    return unified && typeof unified === 'object' ? unified : {};
+  } catch {
+    return {};
+  }
+}
+
+export function authArtifactNamesForSandbox(realDataDir, provider) {
+  const names = new Set();
+  for (const file of AUTH_ARTIFACT_BY_PROVIDER[provider] || []) names.add(file);
+  try {
+    for (const entry of readdirSync(realDataDir, { withFileTypes: true })) {
+      if (!entry.isFile() || !entry.name.endsWith('.json')) continue;
+      if (/oauth/i.test(entry.name) || /credentials/i.test(entry.name)) names.add(entry.name);
+    }
+  } catch {
+    /* missing real data dir */
+  }
+  return [...names];
+}
+
+export function copyAuthArtifacts(realDataDir, sandboxDataDir, provider) {
+  const copied = [];
+  const skipped = [];
+  for (const name of authArtifactNamesForSandbox(realDataDir, provider)) {
+    const src = join(realDataDir, name);
+    const dest = join(sandboxDataDir, name);
+    if (!existsSync(src)) {
+      skipped.push(name);
+      continue;
+    }
+    try {
+      copyFileSync(src, dest);
+      copied.push(name);
+    } catch {
+      skipped.push(name);
+    }
+  }
+  return { copied, skipped };
+}
+
+export function extractSessionId(text) {
+  const s = String(text || '');
+  const m = s.match(/sessionId:\s*(sess_[A-Za-z0-9_]+)/) || s.match(/\b(sess_[A-Za-z0-9_]+)/);
+  return m ? m[1] : null;
+}

package/scripts/lib/bench-sandbox.test.mjs

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import {
+  authArtifactNamesForSandbox,
+  copyAuthArtifacts,
+  extractSessionId,
+  readUnifiedConfig,
+} from './bench-sandbox.mjs';
+
+function withDir(run) {
+  const dir = mkdtempSync(join(tmpdir(), 'bench-sandbox-'));
+  try {
+    return run(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test('extractSessionId prefers the labelled id, then any sess_ token', () => {
+  assert.equal(extractSessionId('sessionId: sess_abc123 other sess_zzz'), 'sess_abc123');
+  assert.equal(extractSessionId('noise sess_q9 end'), 'sess_q9');
+  assert.equal(extractSessionId('nothing here'), null);
+  assert.equal(extractSessionId(undefined), null);
+});
+
+test('readUnifiedConfig returns an object, and {} for a missing or non-object file', () => {
+  withDir((dir) => {
+    assert.deepEqual(readUnifiedConfig(dir), {});
+    writeFileSync(join(dir, 'mixdog-config.json'), '{"a":1}');
+    assert.deepEqual(readUnifiedConfig(dir), { a: 1 });
+    writeFileSync(join(dir, 'mixdog-config.json'), 'null');
+    assert.deepEqual(readUnifiedConfig(dir), {});
+  });
+});
+
+test('auth artifacts: provider files plus every oauth/credentials json in the real dir', () => {
+  withDir((real) => {
+    writeFileSync(join(real, 'grok-oauth.json'), 'g');
+    writeFileSync(join(real, 'extra-credentials.json'), 'c');
+    writeFileSync(join(real, 'unrelated.json'), 'u');
+    const names = authArtifactNamesForSandbox(real, 'grok-oauth').sort();
+    assert.deepEqual(names, ['extra-credentials.json', 'grok-oauth-models.json', 'grok-oauth.json']);
+    const sandbox = join(real, 'sandbox');
+    mkdirSync(sandbox);
+    const { copied, skipped } = copyAuthArtifacts(real, sandbox, 'grok-oauth');
+    assert.deepEqual(copied.sort(), ['extra-credentials.json', 'grok-oauth.json']);
+    assert.deepEqual(skipped, ['grok-oauth-models.json']);
+    assert.equal(readFileSync(join(sandbox, 'grok-oauth.json'), 'utf8'), 'g');
+    assert.equal(existsSync(join(sandbox, 'unrelated.json')), false);
+  });
+});