mixdog 0.9.174 → 1.0.0

package/README.md

@@ -43,10 +43,6 @@ security warning.
 
 Requires Node.js 22.19+ (22.x) or 24+.
 
-CLI native assets support Windows x64, macOS x64/ARM64, and Linux x64/ARM64.
-Windows ARM64 Node.js is not supported. On ARM Windows, use x64 Node.js under
-Windows x64 emulation; native ARM64 installation is not available.
-
 ```bash
 npm install -g mixdog
 mixdog
@@ -263,13 +259,16 @@ Mixdog supports subscription OAuth and API-key routes, including:
 
 - Anthropic API keys and Claude account OAuth
 - OpenAI API keys and ChatGPT/Codex account OAuth
-- Google Gemini API keys and Antigravity OAuth
+- Google Gemini API keys
 - xAI API keys and Grok account OAuth
 - OpenRouter API keys and its unified model catalog
-- Experimental Cursor account OAuth
 - DeepSeek and OpenCode Go
 - Mixdog's built-in Local Provider
 
+Cursor and Antigravity (Gemini) account OAuth are off by default; turn them on
+under **Settings → Developer**, which warns that using these providers through
+OAuth risks account restrictions.
+
 The model picker combines live provider catalogs with model metadata for
 context limits, pricing, tool support, reasoning, and recency.
 
@@ -297,7 +296,7 @@ mixdog
 mixdog --provider anthropic-oauth --model claude-haiku-4-5-20251001
 
 # Select a workflow
-mixdog --workflow solo
+mixdog --workflow default
 
 # Use read-only tools
 mixdog --readonly
@@ -376,10 +375,10 @@ Workflows and agents are Markdown definition packs (`WORKFLOW.md`, `AGENT.md`).
 Built-in packs ship with Mixdog; custom packs live under the Mixdog data
 directory.
 
-**Solo** is the default workflow: the Lead does the work without delegating.
-Choose **Cowork** (`mixdog --workflow default`) for parallel agent delegation.
-Running multiple independent Desktop sessions is separate from delegating
-work to agents within one session.
+By default the Lead does the work without delegating (**Solo**). Each
+session's orchestration mode sets how much it delegates to agents, up to
+**Swarm** for maximum delegation. Running multiple independent Desktop
+sessions is separate from delegating work to agents within one session.
 
 To start a time-bounded Goal, for example:
 
@@ -497,7 +496,7 @@ Main directories:
 
 ```text
 src/            CLI, TUI, runtime, workflows, agents, and rules
-apps/desktop/   cross-platform desktop app
+apps/desktop/   desktop app
 apps/relay/     remote web app and relay
 native/         native process, search, graph, patch, and support binaries
 scripts/        tests, diagnostics, benchmarks, and build scripts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.174",
+  "version": "1.0.0",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -75,7 +75,7 @@
     "test:native-edit-wire": "node scripts/native-edit-wire-test.mjs",
     "test:release-critical": "npm run test:release-assets && npm run smoke:patch && npm run test:providers",
     "test:spec-advisory": "node scripts/run-advisory-spec.mjs && npm run test:spec-advisory --prefix apps/desktop",
-    "test:session-transport": "node --test \"scripts/session-transport/*.test.mjs\" scripts/daemon-bootstrap-test.mjs src/runtime/shared/child-spawn-remote.test.mjs src/standalone/session-runtime-agent-control-client.test.mjs src/standalone/session-runtime-dispatch-cancel.test.mjs src/standalone/session-runtime-host-factory.test.mjs src/standalone/session-runtime-inline-host.test.mjs src/standalone/session-runtime-provider-cooldown.test.mjs src/standalone/session-runtime-shard-host.test.mjs src/standalone/session-runtime-shard-router.test.mjs",
+    "test:session-transport": "node --test \"scripts/session-transport/*.test.mjs\" scripts/daemon-bootstrap-test.mjs src/standalone/session-runtime-inline-host.test.mjs",
     "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store.slow.test.mjs scripts/turn-review-revert.slow.test.mjs src/runtime/shared/tool-surface.test.mjs src/runtime/bridge-clients.test.mjs src/runtime/browser-bridge/action-schema.test.mjs src/runtime/computer-bridge/client-semantic-error.test.mjs src/runtime/agent/orchestrator/session/tool-envelope.test.mjs src/runtime/agent/orchestrator/session/eager-dispatch.test.mjs",
     "test:quick": "npm run test:session && npm run test:session-transport && npm run test:desktop-main --prefix apps/desktop",
     "test:office": "node --test scripts/run-office-live-tests.test.mjs src/runtime/office/office-runtime-contract.test.mjs src/runtime/office/office-runtime-com.test.mjs src/runtime/office/office-runtime-portable.slow.test.mjs src/runtime/office/xlsx-formula-audit.test.mjs src/runtime/office/xlsx-portable-snapshot.test.mjs src/runtime/office/office-runtime-pdf.slow.test.mjs src/runtime/office/office-runtime-design.test.mjs src/runtime/office/office-assurance.slow.test.mjs src/runtime/office/office-design-aesthetics.test.mjs src/runtime/office/portable-authoring.slow.test.mjs src/runtime/office/slide-quality.test.mjs src/runtime/office/authoring/pptx-brief.test.mjs src/runtime/office/authoring/pptx-receipt.test.mjs src/runtime/office/quality/render-air.test.mjs src/runtime/office/quality/pptx-deck-rubric.test.mjs && npm run test:office-approval --prefix apps/desktop",

package/scripts/agent-turn-trace-probe.mjs

@@ -76,7 +76,7 @@ try {
         '2) read README.md (first 40 lines)',
         '3) run the shell command: node -v',
         '4) read apps/desktop/package.json',
-        '5) grep the string "createSessionRuntimeHost" under src/standalone (files list only)',
+        '5) grep the string "createInlineSessionRuntimeHost" under src/standalone (files list only)',
         'Then reply with one line: DONE <package name> <node version>. Do not edit anything.',
       ].join('\n'),
     },

package/scripts/build-ffmpeg-runtime.sh

@@ -16,6 +16,22 @@ echo "==> Downloading FFmpeg n${FFMPEG_VERSION}"
 curl -fsSL --retry 3 \
 	"https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz" \
 	-o "$BUILD_DIR/ffmpeg.tar.xz"
+# ffmpeg.org publishes no .sha256 for releases; this digest was computed from the
+# official https://ffmpeg.org/releases/ffmpeg-6.1.1.tar.xz. Update it with FFMPEG_VERSION.
+FFMPEG_SHA256="8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
+if [[ "$FFMPEG_VERSION" != "6.1.1" ]]; then
+	echo "No pinned SHA-256 for FFmpeg ${FFMPEG_VERSION}" >&2
+	exit 1
+fi
+if command -v sha256sum >/dev/null 2>&1; then
+	ACTUAL_SHA256="$(sha256sum "$BUILD_DIR/ffmpeg.tar.xz" | cut -d' ' -f1)"
+else
+	ACTUAL_SHA256="$(shasum -a 256 "$BUILD_DIR/ffmpeg.tar.xz" | cut -d' ' -f1)"
+fi
+if [[ "$ACTUAL_SHA256" != "$FFMPEG_SHA256" ]]; then
+	echo "FFmpeg source SHA-256 mismatch: expected $FFMPEG_SHA256, got $ACTUAL_SHA256" >&2
+	exit 1
+fi
 tar -xJf "$BUILD_DIR/ffmpeg.tar.xz" -C "$BUILD_DIR"
 
 # shellcheck disable=SC2054  # comma lists are single ffmpeg --enable-* values

package/scripts/build-runtime-linux.sh

@@ -12,6 +12,10 @@ set -euo pipefail
 
 PG_VERSION="16.4"
 PGVECTOR_VERSION="0.8.2"
+# sha256 from https://ftp.postgresql.org/pub/source/v16.4/postgresql-16.4.tar.gz.sha256
+PG_TARBALL_SHA256="2e17a90062403e15d6540480fdec50c8b005eb48729a91cb4989ffeb04df193c"
+# Commit the pgvector v0.8.2 tag resolves to (git ls-remote refs/tags/v0.8.2).
+PGVECTOR_COMMIT="cab9da72c04353f143bb06b42ab70a403daac64a"
 TARGET_OS="${TARGET_OS:-linux}"
 TARGET_ARCH="${TARGET_ARCH:-x64}"
 
@@ -54,6 +58,7 @@ else
 		curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
 			-o "postgresql-${PG_VERSION}.tar.gz"
 	fi
+	echo "${PG_TARBALL_SHA256}  postgresql-${PG_VERSION}.tar.gz" | sha256sum -c -
 	rm -rf "postgresql-${PG_VERSION}"
 	tar xzf "postgresql-${PG_VERSION}.tar.gz"
 
@@ -94,8 +99,9 @@ else
 	echo "==> Cloning pgvector $PGVECTOR_VERSION"
 	cd "$BUILD_DIR"
 	rm -rf pgvector
-	git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-		https://github.com/pgvector/pgvector.git pgvector
+	git clone https://github.com/pgvector/pgvector.git pgvector
+	git -C pgvector -c advice.detachedHead=false checkout --detach "$PGVECTOR_COMMIT"
+	[[ "$(git -C pgvector rev-parse HEAD)" == "$PGVECTOR_COMMIT" ]]
 
 	echo "==> Building pgvector"
 	cd pgvector

package/scripts/build-runtime-macos.sh

@@ -9,6 +9,10 @@ set -euo pipefail
 
 PG_VERSION="16.4"
 PGVECTOR_VERSION="0.8.2"
+# sha256 from https://ftp.postgresql.org/pub/source/v16.4/postgresql-16.4.tar.gz.sha256
+PG_TARBALL_SHA256="2e17a90062403e15d6540480fdec50c8b005eb48729a91cb4989ffeb04df193c"
+# Commit the pgvector v0.8.2 tag resolves to (git ls-remote refs/tags/v0.8.2).
+PGVECTOR_COMMIT="cab9da72c04353f143bb06b42ab70a403daac64a"
 TARGET_OS="${TARGET_OS:-darwin}"
 TARGET_ARCH="${TARGET_ARCH:-$(uname -m | sed 's/x86_64/x64/')}"
 
@@ -41,6 +45,7 @@ else
 		curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
 			-o "postgresql-${PG_VERSION}.tar.gz"
 	fi
+	echo "${PG_TARBALL_SHA256}  postgresql-${PG_VERSION}.tar.gz" | shasum -a 256 -c -
 	rm -rf "postgresql-${PG_VERSION}"
 	tar xzf "postgresql-${PG_VERSION}.tar.gz"
 
@@ -85,8 +90,9 @@ else
 	echo "==> Cloning + building pgvector $PGVECTOR_VERSION"
 	cd "$BUILD_DIR"
 	rm -rf pgvector
-	git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-		https://github.com/pgvector/pgvector.git pgvector
+	git clone https://github.com/pgvector/pgvector.git pgvector
+	git -C pgvector -c advice.detachedHead=false checkout --detach "$PGVECTOR_COMMIT"
+	[[ "$(git -C pgvector rev-parse HEAD)" == "$PGVECTOR_COMMIT" ]]
 	cd pgvector
 	make PG_CONFIG="$PG_CONFIG" -j"$(sysctl -n hw.logicalcpu)"
 	make PG_CONFIG="$PG_CONFIG" install

package/scripts/computer-task-cost-report.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { percentile, sortedFinite } from './lib/trace-stats.mjs';
+import { distribution } from './lib/trace-stats.mjs';
 
 function arg(name, fallback) {
   const prefix = `--${name}=`;
@@ -19,14 +19,6 @@ function fixed(value, digits = 2) {
   return Number(Number(value || 0).toFixed(digits));
 }
 
-function distribution(values) {
-  const sorted = sortedFinite(values.map(Number));
-  return {
-    p50: percentile(sorted, 50),
-    p95: percentile(sorted, 95),
-  };
-}
-
 const modelPath = arg('model', 'artifacts/computer-use/computer-schema-sequence-guided-full.json');
 const hostPath = arg('host', 'apps/desktop/artifacts/computer-use/scenario-repeat-further-optimized-v5.json');
 const sequencePath = arg('sequence', 'artifacts/computer-use/sequence-performance-final.json');

package/scripts/context-renewal-live-check.mjs

@@ -125,7 +125,8 @@ try {
   for (const spec of specs) {
     const dataDir = path.join(sandbox, spec.name);
     const db = path.join(dataDir, 'pgdata');
-    const ctl = path.join(dataDir, 'runtime', 'runtime-pg16.4+pgvector-0.8.2', 'bin', 'pg_ctl.exe');
+    const runtimeKey = fs.readFileSync(path.join(dataDir, 'runtime', 'active-version'), 'utf8').trim();
+    const ctl = path.join(dataDir, 'runtime', `runtime-${runtimeKey}`, 'bin', 'pg_ctl.exe');
     if (process.platform === 'win32' && fs.existsSync(ctl) && fs.existsSync(path.join(db, 'postmaster.pid'))) {
       const stopped = spawnSync(ctl, ['-D', db, '-m', 'fast', '-w', 'stop'], { stdio: 'inherit' });
       if (stopped.status !== 0) cleanupFailed = true;

package/scripts/graph-parity.mjs

@@ -1046,67 +1046,90 @@ export async function loadKindMap(opts, root, runner = runProcess) {
   }
 }
 
+// Runs the old and new binaries against the live tree: timed walks, the
+// manifest comparison and, with --files, the incremental re-walk of those files.
+async function walkBothBinaries(opts, root, allowedSet) {
+  const oldWalk = await runTimedWalks(opts.old, root, opts.runs);
+  const newWalk = await runTimedWalks(opts.new, root, opts.runs);
+  let ratio = 1;
+  if (oldWalk.medianMs > 0) ratio = newWalk.medianMs / oldWalk.medianMs;
+  else if (newWalk.medianMs > 0) ratio = Infinity;
+  const timing = {
+    oldMs: oldWalk.medianMs,
+    newMs: newWalk.medianMs,
+    ratio,
+    runs: opts.runs,
+    oldTimes: oldWalk.times,
+    newTimes: newWalk.times,
+  };
+  let oldRecords = parseJsonl(oldWalk.stdout);
+  let newRecords = parseJsonl(newWalk.stdout);
+
+  const oldMan = await runProcess(opts.old, [root, '--manifest']);
+  const newMan = await runProcess(opts.new, [root, '--manifest']);
+  const manifestRawIdentical = Buffer.compare(oldMan.stdout, newMan.stdout) === 0;
+  let manifestIdentical = true;
+  let manifestDroppedNew = [];
+  let manifestDroppedOld = [];
+  if (!manifestRawIdentical) {
+    const filtered = compareManifests(oldMan.stdout, newMan.stdout, allowedSet);
+    manifestIdentical = filtered.identical;
+    manifestDroppedNew = filtered.newDropped;
+    manifestDroppedOld = filtered.oldDropped;
+  }
+
+  if (opts.files?.length) {
+    const files = opts.files.map(normalizeRel);
+    const fileSet = new Set(files);
+    const reused = oldRecords.filter((rec) => !fileSet.has(normalizeRel(rec.rel))).map(reusedMetaLine);
+    const stdinText = reused.length ? `${reused.join('\n')}\n` : '';
+    const oldFiles = await runProcess(opts.old, [root, '--files', ...files], { stdinText });
+    const newFiles = await runProcess(opts.new, [root, '--files', ...files], { stdinText });
+    oldRecords = parseJsonl(oldFiles.stdout);
+    newRecords = parseJsonl(newFiles.stdout);
+  }
+  return {
+    oldRecords,
+    newRecords,
+    timing,
+    manifestIdentical,
+    manifestRawIdentical,
+    oldManifest: oldMan.stdout,
+    newManifest: newMan.stdout,
+    manifestDroppedNew,
+    manifestDroppedOld,
+  };
+}
+
 export async function runParity(opts) {
   const root = resolve(opts.root || '.');
   const jsonlMode = Boolean(opts.oldJsonl && opts.newJsonl);
   const allowNewLanguages = [...new Set(opts.allowNewLanguages || [])];
   const allowedSet = new Set(allowNewLanguages);
-  let oldRecords;
-  let newRecords;
-  let timing = null;
-  let manifestIdentical = null;
-  let manifestRawIdentical = null;
-  let oldManifest = null;
-  let newManifest = null;
-  let manifestDroppedNew = [];
-  let manifestDroppedOld = [];
   const loadedKinds = await loadKindMap(opts, root);
-
-  if (jsonlMode) {
-    oldRecords = parseJsonl(readFileSync(opts.oldJsonl));
-    newRecords = parseJsonl(readFileSync(opts.newJsonl));
-  } else {
-    const oldWalk = await runTimedWalks(opts.old, root, opts.runs);
-    const newWalk = await runTimedWalks(opts.new, root, opts.runs);
-    let ratio = 1;
-    if (oldWalk.medianMs > 0) ratio = newWalk.medianMs / oldWalk.medianMs;
-    else if (newWalk.medianMs > 0) ratio = Infinity;
-    timing = {
-      oldMs: oldWalk.medianMs,
-      newMs: newWalk.medianMs,
-      ratio,
-      runs: opts.runs,
-      oldTimes: oldWalk.times,
-      newTimes: newWalk.times,
-    };
-    oldRecords = parseJsonl(oldWalk.stdout);
-    newRecords = parseJsonl(newWalk.stdout);
-
-    const oldMan = await runProcess(opts.old, [root, '--manifest']);
-    const newMan = await runProcess(opts.new, [root, '--manifest']);
-    oldManifest = oldMan.stdout;
-    newManifest = newMan.stdout;
-    manifestRawIdentical = Buffer.compare(oldMan.stdout, newMan.stdout) === 0;
-    if (manifestRawIdentical) {
-      manifestIdentical = true;
-    } else {
-      const filtered = compareManifests(oldMan.stdout, newMan.stdout, allowedSet);
-      manifestIdentical = filtered.identical;
-      manifestDroppedNew = filtered.newDropped;
-      manifestDroppedOld = filtered.oldDropped;
-    }
-
-    if (opts.files?.length) {
-      const files = opts.files.map(normalizeRel);
-      const fileSet = new Set(files);
-      const reused = oldRecords.filter((rec) => !fileSet.has(normalizeRel(rec.rel))).map(reusedMetaLine);
-      const stdinText = reused.length ? `${reused.join('\n')}\n` : '';
-      const oldFiles = await runProcess(opts.old, [root, '--files', ...files], { stdinText });
-      const newFiles = await runProcess(opts.new, [root, '--files', ...files], { stdinText });
-      oldRecords = parseJsonl(oldFiles.stdout);
-      newRecords = parseJsonl(newFiles.stdout);
-    }
-  }
+  const {
+    oldRecords,
+    newRecords,
+    timing,
+    manifestIdentical,
+    manifestRawIdentical,
+    oldManifest,
+    newManifest,
+    manifestDroppedNew,
+    manifestDroppedOld,
+  } = jsonlMode
+    ? {
+        oldRecords: parseJsonl(readFileSync(opts.oldJsonl)),
+        newRecords: parseJsonl(readFileSync(opts.newJsonl)),
+        timing: null,
+        manifestIdentical: null,
+        manifestRawIdentical: null,
+        oldManifest: null,
+        newManifest: null,
+        manifestDroppedNew: [],
+        manifestDroppedOld: [],
+      }
+    : await walkBothBinaries(opts, root, allowedSet);
 
   const compared = compareWalks(oldRecords, newRecords, {
     kindMap: loadedKinds.map,

package/scripts/lib/bench-sandbox.mjs

@@ -0,0 +1,67 @@
+// Live-bench plumbing shared by bench-run, internal-comms-bench and
+// output-style-bench: where the real data dir lives, the OAuth artifacts a
+// sandboxed data dir needs to reach a provider, and the session id a headless
+// run prints.
+import { copyFileSync, existsSync, readdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+// Filenames verified in provider ensureAuth / token paths (resolvePluginData / getPluginData).
+export const AUTH_ARTIFACT_BY_PROVIDER = {
+  'grok-oauth': ['grok-oauth.json', 'grok-oauth-models.json'],
+  'anthropic-oauth': ['anthropic-oauth-credentials.json', 'anthropic-oauth-models.json'],
+  'openai-oauth': ['openai-oauth.json', 'openai-oauth-models.json'],
+};
+
+export function defaultUserDataDir() {
+  return process.env.MIXDOG_DATA_DIR || join(process.env.MIXDOG_HOME || join(homedir(), '.mixdog'), 'data');
+}
+
+export function readUnifiedConfig(dataDir) {
+  try {
+    const unified = JSON.parse(readFileSync(join(dataDir, 'mixdog-config.json'), 'utf8'));
+    return unified && typeof unified === 'object' ? unified : {};
+  } catch {
+    return {};
+  }
+}
+
+export function authArtifactNamesForSandbox(realDataDir, provider) {
+  const names = new Set();
+  for (const file of AUTH_ARTIFACT_BY_PROVIDER[provider] || []) names.add(file);
+  try {
+    for (const entry of readdirSync(realDataDir, { withFileTypes: true })) {
+      if (!entry.isFile() || !entry.name.endsWith('.json')) continue;
+      if (/oauth/i.test(entry.name) || /credentials/i.test(entry.name)) names.add(entry.name);
+    }
+  } catch {
+    /* missing real data dir */
+  }
+  return [...names];
+}
+
+export function copyAuthArtifacts(realDataDir, sandboxDataDir, provider) {
+  const copied = [];
+  const skipped = [];
+  for (const name of authArtifactNamesForSandbox(realDataDir, provider)) {
+    const src = join(realDataDir, name);
+    const dest = join(sandboxDataDir, name);
+    if (!existsSync(src)) {
+      skipped.push(name);
+      continue;
+    }
+    try {
+      copyFileSync(src, dest);
+      copied.push(name);
+    } catch {
+      skipped.push(name);
+    }
+  }
+  return { copied, skipped };
+}
+
+export function extractSessionId(text) {
+  const s = String(text || '');
+  const m = s.match(/sessionId:\s*(sess_[A-Za-z0-9_]+)/) || s.match(/\b(sess_[A-Za-z0-9_]+)/);
+  return m ? m[1] : null;
+}

package/scripts/lib/bench-sandbox.test.mjs

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import {
+  authArtifactNamesForSandbox,
+  copyAuthArtifacts,
+  extractSessionId,
+  readUnifiedConfig,
+} from './bench-sandbox.mjs';
+
+function withDir(run) {
+  const dir = mkdtempSync(join(tmpdir(), 'bench-sandbox-'));
+  try {
+    return run(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test('extractSessionId prefers the labelled id, then any sess_ token', () => {
+  assert.equal(extractSessionId('sessionId: sess_abc123 other sess_zzz'), 'sess_abc123');
+  assert.equal(extractSessionId('noise sess_q9 end'), 'sess_q9');
+  assert.equal(extractSessionId('nothing here'), null);
+  assert.equal(extractSessionId(undefined), null);
+});
+
+test('readUnifiedConfig returns an object, and {} for a missing or non-object file', () => {
+  withDir((dir) => {
+    assert.deepEqual(readUnifiedConfig(dir), {});
+    writeFileSync(join(dir, 'mixdog-config.json'), '{"a":1}');
+    assert.deepEqual(readUnifiedConfig(dir), { a: 1 });
+    writeFileSync(join(dir, 'mixdog-config.json'), 'null');
+    assert.deepEqual(readUnifiedConfig(dir), {});
+  });
+});
+
+test('auth artifacts: provider files plus every oauth/credentials json in the real dir', () => {
+  withDir((real) => {
+    writeFileSync(join(real, 'grok-oauth.json'), 'g');
+    writeFileSync(join(real, 'extra-credentials.json'), 'c');
+    writeFileSync(join(real, 'unrelated.json'), 'u');
+    const names = authArtifactNamesForSandbox(real, 'grok-oauth').sort();
+    assert.deepEqual(names, ['extra-credentials.json', 'grok-oauth-models.json', 'grok-oauth.json']);
+    const sandbox = join(real, 'sandbox');
+    mkdirSync(sandbox);
+    const { copied, skipped } = copyAuthArtifacts(real, sandbox, 'grok-oauth');
+    assert.deepEqual(copied.sort(), ['extra-credentials.json', 'grok-oauth.json']);
+    assert.deepEqual(skipped, ['grok-oauth-models.json']);
+    assert.equal(readFileSync(join(sandbox, 'grok-oauth.json'), 'utf8'), 'g');
+    assert.equal(existsSync(join(sandbox, 'unrelated.json')), false);
+  });
+});

package/scripts/lib/coverage.mjs

@@ -141,10 +141,8 @@ export async function foldCoverage(reports, { root = process.cwd() } = {}) {
     const entries = [...collected.get(path).values()].sort(
       (left, right) => left.startOffset - right.startOffset || left.endOffset - right.endOffset
     );
-    let source;
-    try {
-      source = (await readFile(join(rootPath, path), 'utf8')).replace(/^\uFEFF/, '');
-    } catch {
+    const source = await currentSource(rootPath, path);
+    if (source === null) {
       excluded.set(path, 'source-unreadable');
       continue;
     }

package/scripts/lib/run-node-tests.mjs

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import { appendFile, mkdtemp, readdir, readFile, rm, stat } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
+import { availableParallelism, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { FAILURE_RECORDS_ENV } from './test-failure-records.mjs';
 import { classifyRerunOutcomes, formatFailureSummary } from './test-failure-summary.mjs';
@@ -58,6 +58,27 @@ export function chunkFileArgs(fileArgs, budget) {
   return chunks;
 }
 
+const positiveInt = (value) => {
+  const n = Number(value);
+  return Number.isInteger(n) && n > 0 ? n : null;
+};
+
+// `node --test` defaults to availableParallelism()-1 file processes. When the
+// run is one of several concurrent shell commands (the Mixdog shell tool
+// exports the admission cap as MIXDOG_SHELL_CONCURRENCY_CAP), that multiplies
+// across peers, so each run takes its share of the cores. Precedence: an
+// explicit --test-concurrency flag, then MIXDOG_TEST_CONCURRENCY, then the
+// share; with none of them Node's default stands and standalone runs are
+// unchanged. Returns the flag to add, or null.
+export function testConcurrencyArg(nodeArgs, env = process.env, parallelism = availableParallelism()) {
+  if (nodeArgs.some((arg) => arg === '--test-concurrency' || arg.startsWith('--test-concurrency='))) return null;
+  const explicit = positiveInt(env.MIXDOG_TEST_CONCURRENCY);
+  if (explicit) return `--test-concurrency=${explicit}`;
+  const cap = positiveInt(env.MIXDOG_SHELL_CONCURRENCY_CAP);
+  if (!cap) return null;
+  return `--test-concurrency=${Math.max(2, Math.floor(parallelism / cap))}`;
+}
+
 function spawnBatch(args, env) {
   return new Promise((resolve) => {
     const child = spawn(process.execPath, args, { stdio: 'inherit', env });
@@ -108,8 +129,10 @@ export async function runNodeTests(
   // every fixture directory a test forgets to delete goes with it instead of
   // piling up in the system temp directory.
   const scratchDir = await mkdtemp(join(tmpdir(), 'mixdog-test-scratch-'));
+  const concurrencyArg = testConcurrencyArg(nodeArgs);
   const runArgs = [
     ...nodeArgs,
+    ...(concurrencyArg ? [concurrencyArg] : []),
     `--test-reporter=${SUMMARY_REPORTER}`,
     '--test-reporter-destination=stdout',
     '--test-reporter=spec',

package/scripts/lib/session-bench-fmt.mjs

@@ -0,0 +1,65 @@
+// Formatting helpers shared by the session-bench analysis and render layers.
+export function fmtMs(ms) {
+  const n = Number(ms);
+  if (!Number.isFinite(n)) return '-';
+  if (n >= 1000) return `${(n / 1000).toFixed(n >= 10_000 ? 0 : 1)}s`;
+  return `${Math.round(n)}ms`;
+}
+
+export function fmtSec(ms) {
+  const n = Number(ms);
+  if (!Number.isFinite(n)) return '-';
+  return `${(n / 1000).toFixed(n >= 10_000 ? 0 : 1)}s`;
+}
+
+export function fmtTok(n) {
+  const v = Number(n);
+  if (!Number.isFinite(v)) return '-';
+  if (v >= 1_000_000) return `${(v / 1_000_000).toFixed(2)}M`;
+  if (v >= 1000) return `${(v / 1000).toFixed(1)}k`;
+  return String(Math.round(v));
+}
+
+export function fmtPct(n) {
+  const v = Number(n);
+  return Number.isFinite(v) ? `${Math.round(v)}%` : '-';
+}
+
+export function fmtTime(ts) {
+  const n = Number(ts);
+  if (!Number.isFinite(n) || n <= 0) return '-';
+  return new Date(n)
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d+Z$/, 'Z');
+}
+
+export function compactText(value, max = 140) {
+  const s = String(value || '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  return s.length > max ? `${s.slice(0, Math.max(0, max - 1))}…` : s;
+}
+
+export function shortId(id) {
+  const s = String(id || '');
+  if (s.length <= 18) return s;
+  return `${s.slice(0, 10)}…${s.slice(-6)}`;
+}
+
+export function padTable(rows) {
+  if (!rows.length) return [];
+  const widths = [];
+  for (const row of rows) {
+    row.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] || 0, String(cell ?? '').length);
+    });
+  }
+  return rows.map((row) => row.map((cell, i) => String(cell ?? '').padEnd(widths[i])).join('  '));
+}
+
+export function fmtKindCounts(counts, limit = 3) {
+  const shown = (counts || []).slice(0, limit).map((x) => `${x.kind}×${x.count}`);
+  const hidden = Math.max(0, (counts || []).length - shown.length);
+  return `${shown.join(', ')}${hidden ? ` +${hidden}` : ''}` || '-';
+}