mixdog 0.9.174 → 1.0.0

package/src/standalone/agent-tool.mjs

@@ -1,151 +1 @@
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { ensureProcessListenerHeadroom } from '../runtime/shared/process-listener-headroom.mjs';
-import { AGENT_TOOL } from './agent-tool/tool-def.mjs';
-import { agentScope, envTimeoutMs, callerSessionForContext, terminalPidForContext } from './agent-tool/helpers.mjs';
-import { createTagRegistry } from './agent-tool/tag-registry.mjs';
-import { createJobViews } from './agent-tool/job-views.mjs';
-import { liveAgentStatusRow } from './agent-tool/job-views/session-progress.mjs';
-import { createSpawnFlow } from './agent-tool/spawn-flow.mjs';
-import { createSendFlow } from './agent-tool/send-flow.mjs';
-import { createCloseFlow } from './agent-tool/close-flow.mjs';
-import { createTerminalTrace } from './agent-tool/terminal-trace.mjs';
-import { createAgentExecute } from './agent-tool/execute.mjs';
-import { createTurnReviewCollector } from './agent-tool/turn-review.mjs';
-// Re-export the static tool descriptor so importers of this facade keep the
-// identical public surface (`import { AGENT_TOOL } from './agent-tool.mjs'`).
-export { AGENT_TOOL };
-export { resolveAgentSpawnPreset } from './agent-tool/spawn-preset.mjs';
-
-ensureProcessListenerHeadroom(64);
-
-const STANDALONE_SOURCE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-
-// Independent hard cap for the spawn *prep* phase (ensureProvider /
-// prepareAgentSession / catalog+rules load). Kept separate from the
-// first-response watchdog so prep cannot hang a whole fanout before the model
-// request starts. Set MIXDOG_AGENT_SPAWN_PREP_TIMEOUT_MS=0 to fully disable the
-// cap and restore strictly-unbounded prep.
-const DEFAULT_SPAWN_PREP_TIMEOUT_MS = envTimeoutMs('MIXDOG_AGENT_SPAWN_PREP_TIMEOUT_MS', 120_000);
-
-// The standalone agent tool: tag registry + job views + spawn/send/close flows
-// composed under one dispatcher (agent-tool/execute.mjs).
-export function createStandaloneAgent({
-  cfgMod,
-  reg,
-  mgr,
-  dataDir,
-  cwd: defaultCwd,
-  mcpScopeId = null,
-  onSubagentEvent,
-  notifySessionCompletion,
-  sessionSurface = null,
-  awaitKeychainPrewarm = async () => {},
-  isKeychainPrewarmReady = () => true,
-}) {
-  const canUseSessionSurface = (session) =>
-    typeof sessionSurface?.runTurn === 'function' && sessionSurface.canRun?.(session) !== false;
-  const statusListeners = new Set();
-  const notifyStatusChange = () => {
-    for (const listener of [...statusListeners]) {
-      try {
-        listener();
-      } catch {
-        /* status observers never affect agent lifecycle */
-      }
-    }
-  };
-  // Optional bridge to the standard hook bus for SubagentStart / SubagentStop.
-  // Best-effort: a hook error must never affect worker spawn/finish.
-  function emitSubagentEvent(phase, agent, extra = {}) {
-    if (typeof onSubagentEvent !== 'function') return;
-    try {
-      onSubagentEvent(phase, { agent_type: agent || null, ...extra });
-    } catch {
-      /* best-effort */
-    }
-  }
-
-  const registry = createTagRegistry({ dataDir, cfgMod, mgr });
-  const views = createJobViews({ ...registry, mgr, reg, cfgMod, DEFAULT_SPAWN_PREP_TIMEOUT_MS });
-  const spawnFlow = createSpawnFlow({
-    ...registry,
-    ...views,
-    mgr,
-    defaultCwd,
-    mcpScopeId,
-    emitSubagentEvent,
-    notifyStatusChange,
-    notifySessionCompletion,
-    sessionSurface,
-    cfgMod,
-    dataDir,
-    STANDALONE_SOURCE_ROOT,
-    DEFAULT_SPAWN_PREP_TIMEOUT_MS,
-    createTurnReviewCollector,
-  });
-  const sendFlow = createSendFlow({
-    mgr,
-    defaultCwd,
-    sessionSurface,
-    canUseSessionSurface,
-    registry,
-    views,
-    spawnFlow,
-  });
-  const closeFlow = createCloseFlow({ mgr, registry, views });
-  const terminalTrace = createTerminalTrace({ registry });
-  const execute = createAgentExecute({
-    mgr,
-    defaultCwd,
-    awaitKeychainPrewarm,
-    registry,
-    views,
-    spawnFlow,
-    sendFlow,
-    closeFlow,
-    terminalTrace,
-  });
-
-  function getStatus(context = {}) {
-    if (!isKeychainPrewarmReady()) {
-      void awaitKeychainPrewarm();
-      return { workers: [], jobs: [], scope: null };
-    }
-    const scopedContext = agentScope({}, context);
-    const ownerSession = callerSessionForContext(scopedContext);
-    const pid = terminalPidForContext(scopedContext);
-    let scope = { allTerminals: true };
-    if (ownerSession) scope = { sessionId: ownerSession };
-    else if (pid) scope = { clientHostPid: pid };
-    return {
-      workers: views.list({ scanSessions: false, context: scopedContext }).map(liveAgentStatusRow),
-      jobs: views.listJobs(scopedContext).map(liveAgentStatusRow),
-      scope,
-    };
-  }
-
-  function recoverWorkers(context = {}) {
-    if (!isKeychainPrewarmReady()) {
-      void awaitKeychainPrewarm();
-      return [];
-    }
-    const scopedContext = agentScope({ recover: true }, context);
-    registry.refreshTagsFromSessions({ scanSessions: true, context: scopedContext });
-    return views.list({ scanSessions: false, context: scopedContext });
-  }
-
-  return {
-    tools: [AGENT_TOOL],
-    execute,
-    onStatusChange: (listener) => {
-      if (typeof listener !== 'function') return () => {};
-      statusListeners.add(listener);
-      return () => statusListeners.delete(listener);
-    },
-    getStatus,
-    recoverWorkers,
-    upsertLeadSession: registry.upsertLeadSession,
-    closeAll: closeFlow.closeAll,
-  };
-}
+export * from '../session-runtime/services/agent-tool.mjs';

package/src/standalone/channel-worker.mjs

@@ -1,140 +1 @@
-// Standalone channel worker: the TUI/session-runtime side of the machine-global
-// channel daemon. Owns start/execute/stop; the pieces live under
-// ./channel-worker/:
-//   client-heartbeat — this process's liveness file for the daemon's sweep
-//   daemon-spawn     — launching a daemon when discovery finds none
-//   daemon-attach    — the one live attachment, with re-attach on loss
-import { randomUUID } from 'node:crypto';
-import { mkdirSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { setTimeout as delay } from 'node:timers/promises';
-import { appendBuffered } from '../runtime/shared/buffered-appender.mjs';
-import { ensurePrivateRuntimeRoot, resolveRuntimeRoot } from '../runtime/shared/runtime-root.mjs';
-import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../lib/mixdog-debug.cjs';
-import { readChannelDiscovery } from './channel-client.mjs';
-import { createClientHeartbeat, pruneStaleChannelClientHeartbeats } from './channel-worker/client-heartbeat.mjs';
-import { createDaemonAttachment } from './channel-worker/daemon-attach.mjs';
-import { daemonEnv, spawnDaemonCandidate } from './channel-worker/daemon-spawn.mjs';
-
-export { pruneStaleChannelClientHeartbeats };
-
-const CHANNEL_TOOLS = new Set(['activate_channel_bridge', 'reload_config', 'rebind_current_transcript']);
-const CALL_RETRIES = 3;
-
-function logLine(path, line) {
-  try {
-    mkdirSync(dirname(path), { recursive: true });
-    appendBuffered(path, `[${new Date().toISOString()}] ${line}\n`);
-  } catch {}
-}
-
-export function createStandaloneChannelWorker({
-  rootDir,
-  dataDir,
-  cwd = process.cwd(),
-  leadPid = null,
-  getSessionId = () => null,
-  onNotify,
-} = {}) {
-  if (!rootDir) throw new Error('channels runtime rootDir is required');
-  if (!dataDir) throw new Error('channels runtime dataDir is required');
-
-  const proxyId = randomUUID();
-  let nextCallId = 1;
-  let stopPromise = null;
-  const logPath = join(dataDir, 'daemon.log');
-  rotateBoundedLog(logPath, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES);
-  const log = (line) => logLine(logPath, line);
-
-  const runtimeDir = ensurePrivateRuntimeRoot(resolveRuntimeRoot());
-  const heartbeat = createClientHeartbeat({ clientDir: join(runtimeDir, 'channel-clients'), cwd });
-  heartbeat.start();
-
-  // A session runtime may outlive the process that first spawned the machine
-  // daemon. That process may be gone after daemon recovery, so callers that
-  // own a live runtime can override the inherited identity.
-  const daemonLeadPid = Number(leadPid) || Number(process.env.MIXDOG_SUPERVISOR_PID) || process.pid;
-  const discoveryPath = join(runtimeDir, 'daemon.json');
-  const attachment = createDaemonAttachment({
-    discoverChannel: () => readChannelDiscovery(discoveryPath),
-    spawnDaemon: () =>
-      spawnDaemonCandidate({
-        cwd,
-        env: daemonEnv({ rootDir, dataDir, runtimeDir, leadPid: daemonLeadPid }),
-        dataDir,
-        log,
-      }),
-    leadPid: daemonLeadPid,
-    cwd,
-    getSessionId,
-    onNotify,
-    log,
-  });
-
-  function status() {
-    return {
-      running: Boolean(attachment.current()),
-      pid: attachment.pid(),
-      pending: 0,
-      mode: 'daemon',
-    };
-  }
-
-  function start() {
-    if (stopPromise) return stopPromise.then(() => start());
-    attachment.resume();
-    heartbeat.start();
-    return attachment.ensureAttached().then(() => status());
-  }
-
-  async function execute(name, args = {}, { timeoutMs = 120_000 } = {}) {
-    if (!CHANNEL_TOOLS.has(name)) throw new Error(`unknown channel tool: ${name}`);
-    await start();
-    let lastError = null;
-    // callId is stable across retries so the daemon dedups a retried transport
-    // failure to a single side-effect.
-    const callId = `ch_${proxyId}_${nextCallId++}`;
-    for (let attempt = 0; attempt < CALL_RETRIES; attempt += 1) {
-      const daemon = await attachment.ensureAttached();
-      try {
-        return await daemon.call(name, args || {}, { timeoutMs, callId });
-      } catch (error) {
-        if (!error?.daemonTransportError) throw error;
-        lastError = error;
-        attachment.invalidate('transport failure', daemon);
-        await delay(200 * (attempt + 1));
-      }
-    }
-    throw lastError || new Error('channel service call failed');
-  }
-
-  /** Resolves true when a live client was detached, false when there was none. */
-  function stop(reason = 'standalone shutdown', options = {}) {
-    attachment.requestStop();
-    heartbeat.stop();
-    if (stopPromise) return stopPromise;
-    const { client, inFlightAttach } = attachment.detach();
-    stopPromise = Promise.all([
-      client
-        ? client
-            .close(reason, { preserveRemoteIntent: options.preserveRemoteIntent === true })
-            .then(() => true)
-            .catch(() => true)
-        : Promise.resolve(false),
-      Promise.resolve(inFlightAttach).catch(() => null),
-    ])
-      .then(([detached]) => detached)
-      .finally(() => {
-        stopPromise = null;
-      });
-    return stopPromise;
-  }
-
-  return {
-    start,
-    execute,
-    stop,
-    status,
-    isChannelTool: (name) => CHANNEL_TOOLS.has(name),
-  };
-}
+export * from '../session-runtime/services/channel-worker.mjs';

package/src/standalone/daemon-agent-control.mjs

@@ -16,7 +16,7 @@ export function createCanonicalAgentControl({ getSessionService, getSessionRunti
       return Promise.reject(new Error('canonical session service is not ready'));
     }
     canonicalAgentToolPromise ??= Promise.all([
-      import('./agent-tool.mjs'),
+      import('../session-runtime/services/agent-tool.mjs'),
       import('../runtime/agent/orchestrator/config.mjs'),
       import('../runtime/agent/orchestrator/providers/registry.mjs'),
     ])

package/src/standalone/daemon-desktop-runtime.mjs

@@ -15,9 +15,9 @@ export function createDesktopRuntime({ getLocalSessionBridge }) {
       if (!bridge) throw new Error('daemon-local session client is unavailable');
       return bridge.attach(options);
     },
-    loadProjects: () => import('./projects.mjs'),
+    loadProjects: () => import('../runtime/shared/projects.mjs'),
     loadSessionStore: () => import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
-    loadStatuslineSegments: () => import('../ui/statusline-segments.mjs'),
+    loadStatuslineSegments: () => import('../runtime/shared/statusline/statusline-segments.mjs'),
     loadConfig: () => import('../runtime/shared/config.mjs'),
     loadDocumentPreview: () => import('../runtime/office/pdf/document-preview.mjs'),
     async executeCodeGraphTool(name, args, cwd) {

package/src/standalone/daemon-stored-session-views.mjs

@@ -6,7 +6,7 @@
 //
 // Inputs: `desktopRuntime` (lazy module loaders) and `dataDir` (goal
 // snapshots). Output: the read-only half of the session-service options.
-import { listStoredActiveGoalSessionIds, readStoredGoalSnapshot } from '../session-runtime/goal-runtime.mjs';
+import { listStoredActiveGoalSessionIds, readStoredGoalSnapshot } from '../runtime/agent/orchestrator/runtime-core/goal-runtime.mjs';
 
 export function createStoredSessionViews({ desktopRuntime, dataDir }) {
   return {

package/src/standalone/daemon.mjs

@@ -54,16 +54,18 @@ import {
 } from '../runtime/agent/orchestrator/providers/stream-json-pool.mjs';
 import { createAgentDispatchBroker } from './agent-dispatch-broker.mjs';
 import { createChannelTransport } from './channel-transport.mjs';
-import { createChannelSessionRouter } from './channel-session-router.mjs';
+import { createChannelSessionRouter } from '../session-runtime/services/channel-session-router.mjs';
 import { createSessionTransport } from './session-transport.mjs';
 import { createSessionService } from './session-service.mjs';
 import { createLocalSessionBridge } from './daemon-local-session-bridge.mjs';
 import { createStoredSessionViews } from './daemon-stored-session-views.mjs';
-import { createDaemonSessionRuntimeHost } from './session-runtime-host-factory.mjs';
-import { getStandaloneMemoryRuntime } from './memory-runtime-proxy.mjs';
+import { createInlineSessionRuntimeHost } from './session-runtime-inline-host.mjs';
+import { getStandaloneMemoryRuntime } from '../session-runtime/services/memory-runtime-proxy.mjs';
 import { createBootPhaseProfiler } from './boot-phase-profiler.mjs';
 import { createDaemonBootCoordinator } from './daemon-boot-coordinator.mjs';
 import { createDaemonLog } from './daemon-log.mjs';
+import { daemonCrashCaptureDir } from '../session-runtime/services/daemon-crash-capture/paths.mjs';
+import { installDaemonExitRecorder, reconcileLostDaemonCaptures } from '../session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs';
 import { createDaemonTelemetry } from './daemon-telemetry.mjs';
 import { createLagProfiler } from './daemon-lag-profiler.mjs';
 import { createChannelsRuntimeLoader } from './daemon-channels-loader.mjs';
@@ -102,6 +104,10 @@ const {
   installRedirect: installDaemonLogRedirect,
 } = createDaemonLog({ logPath: LOG_PATH });
 
+// Every way this process ends leaves a reason + exit code in its crash-capture
+// sidecar (the launcher usually cannot: it is often gone before the daemon).
+const exitRecorder = installDaemonExitRecorder({ dataDir: DATA_DIR });
+
 let channels = null;
 let transport = null;
 let sessionTransport = null;
@@ -167,6 +173,7 @@ const SHUTDOWN_BUDGET_MS = 15_000;
 async function shutdown(reason, code = 0) {
   if (shuttingDown) return;
   shuttingDown = true;
+  exitRecorder.setReason(`shutdown: ${reason}`, code);
   if (shutdownRecheckTimer) {
     clearTimeout(shutdownRecheckTimer);
     shutdownRecheckTimer = null;
@@ -177,6 +184,7 @@ async function shutdown(reason, code = 0) {
   // clean path still exits the moment teardown finishes.
   const forcedExit = setTimeout(() => {
     log('shutdown budget exceeded, forcing exit');
+    exitRecorder.setReason(`shutdown: ${reason} (budget exceeded, forced exit)`, code);
     process.exit(code);
   }, SHUTDOWN_BUDGET_MS);
   forcedExit.unref?.();
@@ -410,6 +418,7 @@ function claimDaemonOwnership(bootPhases) {
   });
   if (!claim.owned) {
     log(`live peer holds owner lock (pid=${claim.owner?.pid}) — exiting for attach`);
+    exitRecorder.setReason(`lost singleton claim to live peer pid=${claim.owner?.pid}`, 0);
     process.exit(0);
   }
   bootPhases.mark('owner-claimed');
@@ -525,6 +534,15 @@ function announceDaemonReady({ port, token, startedAt, bootPhases }) {
   // memory-pressure file is too sparse to be that record.
   daemonTelemetry.emit('boot');
   daemonTelemetry.start();
+  // Off the ready path: settle earlier boots that ended with no recorded exit
+  // (killed together with their launcher's process tree).
+  setImmediate(() => {
+    try {
+      const marked = reconcileLostDaemonCaptures({ dir: daemonCrashCaptureDir({ dataDir: DATA_DIR }) });
+      if (marked > 0)
+        log(`previous daemon boot(s) ended without an exit record: ${marked} marked unrecorded-termination`);
+    } catch {}
+  });
 }
 
 /** The channels front door: pointer-routed calls over HTTP+SSE. Creating the
@@ -593,7 +611,7 @@ async function main() {
   // projects (a small JSON list, most recently selected first) are the cwds
   // sessions open; prewarm their probes on the git worker, off the boot path.
   void Promise.all([
-    import('./projects.mjs'),
+    import('../runtime/shared/projects.mjs'),
     import('../runtime/agent/orchestrator/tools/builtin/runtime-capabilities.mjs'),
   ])
     .then(([projects, capabilities]) =>
@@ -648,7 +666,15 @@ async function main() {
     getSessionRuntimeHost: () => sessionRuntimeHost,
     cwd: CWD,
   });
-  sessionRuntimeHost = createDaemonSessionRuntimeHost({
+  const requestedRuntimeMode = String(process.env.MIXDOG_SESSION_RUNTIME_MODE || '')
+    .trim()
+    .toLowerCase();
+  if (requestedRuntimeMode && requestedRuntimeMode !== 'inline') {
+    log(
+      `MIXDOG_SESSION_RUNTIME_MODE=${requestedRuntimeMode} is no longer supported; using the inline session runtime host`
+    );
+  }
+  sessionRuntimeHost = createInlineSessionRuntimeHost({
     cwd: CWD,
     log,
     measureBootPhase: bootPhases.measure,
@@ -740,6 +766,13 @@ process.on('SIGTERM', () => {
 process.on('SIGINT', () => {
   void shutdown('SIGINT');
 });
+// Console close / Ctrl+Break: the default action ends the process with no hook.
+process.on('SIGHUP', () => {
+  void shutdown('SIGHUP');
+});
+process.on('SIGBREAK', () => {
+  void shutdown('SIGBREAK');
+});
 process.on('message', (msg) => {
   if (msg && msg.type === 'shutdown') void shutdown('IPC shutdown');
 });

package/src/standalone/fair-call-scheduler.mjs

@@ -1,198 +1 @@
-import { positiveInt } from '../runtime/shared/numbers.mjs';
-import { abortError, detach, schedulerError } from './fair-call-scheduler/queue-item.mjs';
-import { createOwnerGroups } from './fair-call-scheduler/owner-groups.mjs';
-
-function activeLimit(value, fallback) {
-  if (value === null || value === Infinity) return Infinity;
-  return positiveInt(value, fallback);
-}
-
-/**
- * Owner-fair async dispatcher with an optional active limit.
- *
- * One owner may borrow the entire queue while it is alone. When another owner
- * appears, new admissions are divided by weight and a completely full queue
- * evicts one tail item from the largest borrower so the newcomer always gets a
- * seat. Running work is never revoked. Per-owner queues and the fairness
- * arithmetic live in fair-call-scheduler/owner-groups.
- */
-export function createFairCallScheduler({
-  name = 'daemon call',
-  activeMax = 32,
-  queueMax = 256,
-  minOwnerQueue = 8,
-  dispatchBurst = 8,
-  yieldUnbounded = false,
-  schedule = setImmediate,
-  now = Date.now,
-} = {}) {
-  const maxActive = activeLimit(activeMax, 32);
-  const maxQueued = positiveInt(queueMax, 256);
-  const ownerFloor = Math.max(1, Math.min(maxQueued, positiveInt(minOwnerQueue, 8)));
-  const maxBurst = positiveInt(dispatchBurst, 8);
-  const groups = createOwnerGroups({ maxQueued, ownerFloor });
-  const state = { active: 0, queued: 0, scheduled: false, closed: false, closeError: null };
-
-  function dequeued() {
-    state.queued = Math.max(0, state.queued - 1);
-  }
-
-  function rejectBorrowedTail(incoming) {
-    const borrower = groups.largestBorrower(incoming);
-    if (!borrower) return false;
-    const displaced = borrower.queue.pop();
-    dequeued();
-    detach(displaced);
-    displaced.reject(
-      schedulerError(`${name} queue rebalanced for another client; retry after running work completes`, 503)
-    );
-    groups.maybeDeleteGroup(borrower);
-    return true;
-  }
-
-  function runAdmitted(run, signal) {
-    // Admission reserves capacity, but invocation occurs in a later microtask.
-    // Recheck that boundary without revoking work that has already started.
-    if (signal?.aborted) throw abortError(signal);
-    if (state.closed) throw state.closeError;
-    return run();
-  }
-
-  /**
-   * Occupy an active slot for `group` while `run` executes, hand the outcome
-   * to `settle` when the call was queued, then release the slot and re-dispatch.
-   */
-  function occupy(group, run, signal, settle = null) {
-    state.active += 1;
-    group.active += 1;
-    let outcome = Promise.resolve().then(() => runAdmitted(run, signal));
-    if (settle) outcome = outcome.then(settle.resolve, settle.reject);
-    return outcome.finally(() => {
-      state.active = Math.max(0, state.active - 1);
-      group.active = Math.max(0, group.active - 1);
-      groups.maybeDeleteGroup(group);
-      scheduleDispatch();
-    });
-  }
-
-  function dispatch() {
-    state.scheduled = false;
-    let started = 0;
-    while (!state.closed && state.active < maxActive && state.queued > 0 && started < maxBurst) {
-      const group = groups.pickGroup();
-      const item = group?.queue.shift();
-      if (!group || !item) break;
-      dequeued();
-      detach(item);
-      started += 1;
-      void occupy(group, item.run, item.signal, item);
-    }
-    // A bounded burst amortizes loopback dispatch without letting synchronous
-    // setup monopolize the supervisor's socket/control-plane turn.
-    scheduleDispatch();
-  }
-
-  function scheduleDispatch() {
-    if (state.closed || state.scheduled || state.active >= maxActive || state.queued === 0) return;
-    state.scheduled = true;
-    schedule(dispatch);
-  }
-
-  function admissionError(group) {
-    if (groups.hasCompetitor(group) && group.queue.length >= groups.fairQueueLimit(group)) {
-      return schedulerError(`${name} client queue is full; retry after this client's running work completes`, 429);
-    }
-    if (state.queued >= maxQueued && !rejectBorrowedTail(group)) {
-      return schedulerError(`${name} queue is full`, 503);
-    }
-    return null;
-  }
-
-  function queueItem(group, run, signal) {
-    return new Promise((resolve, reject) => {
-      const item = { run, resolve, reject, signal, onAbort: null, queuedAt: now() };
-      if (signal) {
-        item.onAbort = () => {
-          const index = group.queue.indexOf(item);
-          if (index < 0) return;
-          group.queue.splice(index, 1);
-          dequeued();
-          detach(item);
-          groups.maybeDeleteGroup(group);
-          reject(abortError(signal));
-        };
-        signal.addEventListener('abort', item.onAbort, { once: true });
-      }
-      group.queue.push(item);
-      state.queued += 1;
-    });
-  }
-
-  function enqueue(owner, run, { weight = 1, signal = null } = {}) {
-    if (state.closed) return Promise.reject(schedulerError(`${name} scheduler is closed`));
-    if (typeof run !== 'function') return Promise.reject(new TypeError('scheduled call must be a function'));
-    if (signal?.aborted) return Promise.reject(abortError(signal));
-    const group = groups.groupFor(owner, weight);
-    // Default daemon lanes are unbounded. Do not enqueue them only to bounce
-    // through setImmediate: independent loopback calls start in this microtask,
-    // while finite operator-configured lanes retain the fair queue below.
-    if (maxActive === Infinity && !yieldUnbounded && state.queued === 0) {
-      return occupy(group, run, signal);
-    }
-    const refused = admissionError(group);
-    if (refused) {
-      groups.maybeDeleteGroup(group);
-      return Promise.reject(refused);
-    }
-    const promise = queueItem(group, run, signal);
-    scheduleDispatch();
-    return promise;
-  }
-
-  function close(reason = `${name} scheduler is closed`) {
-    if (state.closed) return;
-    state.closed = true;
-    const error = schedulerError(reason);
-    state.closeError = error;
-    for (const group of groups.all()) {
-      for (const item of group.queue.splice(0)) {
-        detach(item);
-        item.reject(error);
-      }
-    }
-    state.queued = 0;
-    for (const group of [...groups.all()]) groups.maybeDeleteGroup(group);
-  }
-
-  function snapshot() {
-    let oldestQueuedAt = Infinity;
-    let owners = 0;
-    for (const group of groups.all()) {
-      if (group.active || group.queue.length) owners += 1;
-      for (const item of group.queue) {
-        oldestQueuedAt = Math.min(oldestQueuedAt, Number(item.queuedAt) || Infinity);
-      }
-    }
-    return {
-      active: state.active,
-      queued: state.queued,
-      owners,
-      activeMax: Number.isFinite(maxActive) ? maxActive : null,
-      dispatchBurst: maxBurst,
-      queueMax: maxQueued,
-      oldestWaitMs: Number.isFinite(oldestQueuedAt) ? Math.max(0, now() - oldestQueuedAt) : 0,
-    };
-  }
-
-  return {
-    enqueue,
-    close,
-    snapshot,
-    get active() {
-      return state.active;
-    },
-    get queued() {
-      return state.queued;
-    },
-  };
-}
+export * from '../runtime/shared/fair-call-scheduler.mjs';

package/src/standalone/folder-dialog.mjs

@@ -276,6 +276,12 @@ async function runUnixPicker(cmd, args) {
   return { available: true, path: String(result.stdout || '').trim() || null };
 }
 
+/** AppleScript for the macOS picker; backslashes and quotes in the title are escaped. */
+export function macosChooseScript(title) {
+  const safeTitle = String(title).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  return `set f to choose folder with prompt "${safeTitle}"\nPOSIX path of f`;
+}
+
 /**
  * Open the native folder picker.
  * @returns {Promise<{ available: boolean, path: string|null, reason?: string }>}
@@ -298,20 +304,18 @@ export async function pickFolder({ title = 'Select a project folder', initialPat
     ]);
     // Could not run PowerShell / Common File Dialog → fall back to manual typing.
     if (spawnFailed(result)) return { available: false, path: null };
-    const path = String(result.stdout || '').trim();
-    if (!result.ok && !path) return { available: false, path: null };
-    return { available: true, path: path || null };
+    const selected = String(result.stdout || '').trim();
+    if (!result.ok && !selected) return { available: false, path: null };
+    return { available: true, path: selected || null };
   }
 
   if (platform === 'darwin') {
-    const safeTitle = String(title).replace(/"/g, '\\"');
-    const script = `set f to choose folder with prompt "${safeTitle}"\nPOSIX path of f`;
-    const result = await runCapture('osascript', ['-e', script]);
+    const result = await runCapture('osascript', ['-e', macosChooseScript(title)]);
     // Could not run osascript (spawn failure / timeout) → manual fallback.
     if (spawnFailed(result)) return { available: false, path: null };
     // osascript exits non-zero (code 1) on user cancel; treat as cancel.
-    const path = String(result.stdout || '').trim();
-    return { available: true, path: path || null };
+    const selected = String(result.stdout || '').trim();
+    return { available: true, path: selected || null };
   }
 
   // Linux / other unix: prefer zenity, then kdialog.