mixdog 0.9.84 → 0.9.86

package/src/runtime/media/adapters/gemini-video.mjs

@@ -16,7 +16,7 @@ const OMNI_TIMEOUT_MS = 600_000;
 const POLL_INTERVAL_MS = 8_000;
 const TOTAL_TIMEOUT_MS = 900_000;
 
-export function isOmniModel(model) {
+function isOmniModel(model) {
   return /omni/i.test(String(model || ''));
 }
 

package/src/runtime/media/renditions.mjs

@@ -30,7 +30,7 @@ const EXTENSION_MIME = { '.webp': 'image/webp', '.png': 'image/png' };
 const POSTER_TIMEOUT_MS = 20_000;
 const MAX_POSTER_BYTES = 32 * 1024 * 1024;
 
-export const MEDIA_VARIANTS = Object.keys(SPECS);
+const MEDIA_VARIANTS = Object.keys(SPECS);
 
 /** Spec for a variant name, or null when the caller asked for the original. */
 export function renditionSpec(variant) {

package/src/runtime/media/store.mjs

@@ -222,7 +222,7 @@ async function prewarmThumbs(assets) {
   await Promise.all(workers).catch(() => {});
 }
 
-export function getMediaAsset(id) {
+function getMediaAsset(id) {
   ensureDirs();
   return readIndex().find((entry) => entry.id === id) || null;
 }

package/src/runtime/memory/index.mjs

@@ -73,6 +73,7 @@ import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandid
 import { resolveProjectId, resolveProjectScope } from './lib/project-id-resolver.mjs'
 import { openTraceDatabase, closeTraceDatabase, insertTraceEvents, enqueueTraceEvents, insertAgentCalls, registerTraceExitDrain } from './lib/trace-store.mjs'
 import { updateJsonAtomicSync, writeJsonAtomicSync } from '../shared/atomic-file.mjs'
+import { safeIpcSend } from '../shared/safe-ipc-send.mjs'
 import { resolvePluginData, mixdogHome } from '../shared/plugin-paths.mjs'
 import { parsePeriod, formatTs, coreRecallTerms, normalizeRecallProjectScope, sessionRecallTerms, interleaveRawRows, renderEntryLines, renderSessionGroupedLines } from './lib/recall-format.mjs'
 import { readBody, sendJson, sendError, isLocalOrigin, normalizeCoreProjectId } from './lib/http-wire.mjs'
@@ -646,6 +647,14 @@ export { TOOL_DEFS, handleToolCall, buildSessionCoreMemoryPayload }
 export { MEMORY_INSTRUCTIONS_TEXT as instructions }
 export { acquireLock, releaseLock }
 export { cwdFromTranscriptPath }
+function sendMemoryWorkerMessage(message) {
+  return safeIpcSend(process, message, {
+    onError: (error) => {
+      const code = error?.code ? ` code=${error.code}` : ''
+      __mixdogMemoryLog(`[memory-worker] IPC send failed${code}: ${error?.message || error}\n`)
+    },
+  })
+}
 export async function init() {
   if (_initialized) return
   __mixdogMemoryLog(`[boot-time] tag=memory-init-start tMs=${Date.now()}\n`)
@@ -683,7 +692,7 @@ export async function init() {
   }
   if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
     __mixdogMemoryLog(`[boot-time] tag=memory-ready tMs=${Date.now()}\n`)
-    process.send({ type: 'ready', port: boundPort })
+    sendMemoryWorkerMessage({ type: 'ready', port: boundPort })
   }
   __mixdogMemoryLog(`[memory-service] init() complete (entries unified mode, version=${PLUGIN_VERSION})\n`)
   touchDaemonIdleTimer('init')
@@ -888,7 +897,7 @@ if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
         entry.cancelled = true
         entry.ac.abort()
         _inFlightCalls.delete(msg.callId)
-        process.send({ type: 'result', callId: msg.callId, error: 'cancelled' })
+        sendMemoryWorkerMessage({ type: 'result', callId: msg.callId, error: 'cancelled' })
       }
       return
     }
@@ -902,9 +911,9 @@ if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
       } finally {
         _inFlightCalls.delete(msg.callId)
       }
-      if (!entry.cancelled) process.send({ type: 'result', callId: msg.callId, result })
+      if (!entry.cancelled) sendMemoryWorkerMessage({ type: 'result', callId: msg.callId, result })
     } catch (e) {
-      if (!entry.cancelled) process.send({ type: 'result', callId: msg.callId, error: e.message })
+      if (!entry.cancelled) sendMemoryWorkerMessage({ type: 'result', callId: msg.callId, error: e.message })
     }
   })
   init().catch(e => {
@@ -929,7 +938,7 @@ if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
     __mixdogMemoryLog(`[memory-worker] init failed: ${detail}\n`)
     // Signal degraded state to parent before exiting so it records the failure
     // rather than treating this as a normal pre-ready crash.
-    try { process.send({ type: 'ready', degraded: true, error: detail.slice(0, 800) }) } catch {}
+    sendMemoryWorkerMessage({ type: 'ready', degraded: true, error: detail.slice(0, 800) })
     process.exit(1)
   })
 }

package/src/runtime/memory/lib/agent-ipc.mjs

@@ -12,6 +12,7 @@
  * Uses a module-level pending map keyed by callId. Parent-side handler
  * lives in server.mjs spawnWorker's message listener.
  */
+import { safeIpcSend } from '../../shared/safe-ipc-send.mjs'
 
 const pending = new Map()
 let listenerInstalled = false
@@ -28,6 +29,11 @@ function installListener() {
     if (msg.ok) entry.resolve(msg.result)
     else entry.reject(new Error(msg.error || 'agent_ipc_response error'))
   })
+  process.once('disconnect', () => {
+    const error = new Error('agent-ipc: parent IPC disconnected')
+    for (const [, entry] of pending) entry.reject(error)
+    pending.clear()
+  })
 }
 
 function nextCallId() {
@@ -61,9 +67,7 @@ export function callAgentDispatch(opts = {}, prompt) {
       if (!pending.has(callId)) return
       pending.delete(callId)
       if (process.connected) {
-        try {
-          process.send({ type: 'agent_ipc_cancel', callId }, undefined, {}, () => {})
-        } catch {}
+        safeIpcSend(process, { type: 'agent_ipc_cancel', callId })
       }
       reject(new Error(`agent-ipc: timed out after ${timeoutMs}ms`))
     }, timeoutMs)
@@ -80,8 +84,7 @@ export function callAgentDispatch(opts = {}, prompt) {
     // Pass a write callback so a closed-channel write surfaces as an async
     // error here (rejecting this Promise) instead of bubbling to the process
     // 'error' event and crashing the daemon with ERR_IPC_CHANNEL_CLOSED.
-    try {
-      process.send({
+    safeIpcSend(process, {
         type: 'agent_ipc_request',
         callId,
         tool: 'agent_dispatch',
@@ -94,17 +97,13 @@ export function callAgentDispatch(opts = {}, prompt) {
           prompt: String(prompt ?? ''),
           timeout: timeoutMs,
         },
-      }, undefined, {}, (err) => {
-        if (!err) return
+      }, {
+        onError: (err) => {
         if (!pending.has(callId)) return
         pending.delete(callId)
         clearTimeout(timer)
         reject(err)
+        },
       })
-    } catch (e) {
-      pending.delete(callId)
-      clearTimeout(timer)
-      reject(e)
-    }
   })
 }

package/src/runtime/shared/atomic-file.mjs

@@ -11,6 +11,15 @@ import {
   unlinkSync,
   writeFileSync,
 } from 'fs';
+import {
+  link as linkAsync,
+  mkdir as mkdirAsync,
+  open as openAsync,
+  readFile as readFileAsync,
+  rename as renameAsync,
+  unlink as unlinkAsync,
+  writeFile as writeFileAsync,
+} from 'node:fs/promises';
 import { dirname, basename, join } from 'path';
 import { randomBytes } from 'crypto';
 import { execFile, execFileSync } from 'child_process';
@@ -76,6 +85,25 @@ export function renameWithRetrySync(src, dst, opts = {}) {
   throw lastErr;
 }
 
+export async function renameWithRetry(src, dst, opts = {}) {
+  const backoffs = Array.isArray(opts.backoffs) && opts.backoffs.length > 0
+    ? opts.backoffs
+    : DEFAULT_BACKOFFS_MS;
+  let lastErr = null;
+  for (let attempt = 0; attempt <= backoffs.length; attempt++) {
+    try {
+      await renameAsync(src, dst);
+      return true;
+    } catch (err) {
+      lastErr = err;
+      if (!RETRY_CODES.has(err?.code) || attempt >= backoffs.length) break;
+      const jitter = Math.floor(Math.random() * Math.min(50, Math.max(1, backoffs[attempt])));
+      await _asyncSleep(backoffs[attempt] + jitter);
+    }
+  }
+  throw lastErr;
+}
+
 export function withFileLockSync(lockPath, fn, opts = {}) {
   const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_LOCK_TIMEOUT_MS;
   const staleMs = Number.isFinite(opts.staleMs) ? opts.staleMs : 30000;
@@ -90,10 +118,15 @@ export function withFileLockSync(lockPath, fn, opts = {}) {
     } catch (err) {
       lastErr = err;
       if (!LOCK_WAIT_CODES.has(err?.code)) throw err;
-      // try-once semantics: timeoutMs:0 makes a single openSync attempt and
-      // never sleeps — on contention it throws ELOCKCONTENDED immediately so
-      // the main loop is never blocked by Atomics.wait. No stale-reclaim,
-      // since reclaim would require waiting on the guard.
+      // Reclaim is itself try-once: the guard is acquired atomically and never
+      // waited on. This lets timeoutMs:0 recover a dead/pidless corpse without
+      // weakening its no-sleep contract.
+      try {
+        if (_tryReclaimStaleLock(lockPath, staleMs)) continue;
+      } catch {}
+      // try-once semantics: timeoutMs:0 makes one guarded reclaim attempt and
+      // never sleeps — live contention throws ELOCKCONTENDED immediately so
+      // the main loop is never blocked by Atomics.wait.
       if (timeoutMs <= 0) {
         const contErr = new Error(`atomic lock contended (try-once): ${lockPath} [${_describeLockHolder(lockPath)}]`);
         contErr.code = 'ELOCKCONTENDED';
@@ -102,9 +135,6 @@ export function withFileLockSync(lockPath, fn, opts = {}) {
       }
       // Reclaim only when owner death is positively established. Age, an
       // unreadable owner, or a same-pid foreign token remain contended.
-      try {
-        if (_tryReclaimStaleLock(lockPath, staleMs)) continue;
-      } catch {}
       if (Date.now() >= deadline) break;
       const base = DEFAULT_BACKOFFS_MS[Math.min(attempt, DEFAULT_BACKOFFS_MS.length - 1)];
       const jitter = Math.floor(Math.random() * Math.min(75, Math.max(1, base)));
@@ -195,14 +225,19 @@ function _lockOwnedBySelf(lockPath) {
 //
 // Reclaim decision table (owner = identity recorded in the lock file):
 //   owner pid DEAD (ESRCH) → reclaim
-//   owner pid NULL/uncertain or same-pid foreign token → back off
+//   owner pid NULL/uncertain and lock age >= staleMs → reclaim
+//   owner pid NULL/uncertain and lock age < staleMs → back off
+//   same-pid foreign token → back off
 //   owner token MISMATCH on guarded re-read (new holder took over) → back off
 //   owner LIVE → back off regardless of age
 function _tryReclaimStaleLock(lockPath, staleMs) {
-  try { statSync(lockPath); } catch { return false; }
+  let initial;
+  try { initial = statSync(lockPath); } catch { return false; }
   const owner = _readLockOwner(lockPath);
   const dead = owner.pid !== null && !_ownerIsLive(owner);
-  if (!dead) return false;
+  const pidlessStale = owner.pid === null
+    && Date.now() - (Number(initial.mtimeMs) || 0) >= Math.max(0, staleMs);
+  if (!dead && !pidlessStale) return false;
   const reclaim = _tryAcquireReclaimGuard(lockPath, staleMs);
   if (reclaim === null) return false;
   try {
@@ -215,7 +250,9 @@ function _tryReclaimStaleLock(lockPath, staleMs) {
     // corpse — so we never yank a freshly-acquired live lock.
     if (curOwner.pid !== owner.pid || curOwner.token !== owner.token) return false;
     const curDead = curOwner.pid !== null && !_ownerIsLive(curOwner);
-    if (curDead) {
+    const curPidlessStale = curOwner.pid === null
+      && Date.now() - (Number(cur.mtimeMs) || 0) >= Math.max(0, staleMs);
+    if (curDead || curPidlessStale) {
       try { unlinkSync(lockPath); return true; } catch { return false; }
     }
     return false;
@@ -279,6 +316,11 @@ export async function withFileLock(lockPath, fn, opts = {}) {
     } catch (err) {
       lastErr = err;
       if (!LOCK_WAIT_CODES.has(err?.code)) throw err;
+      // The guarded reclaim is non-blocking, so try-once callers can recover
+      // stale corpses while still returning immediately for a live holder.
+      try {
+        if (_tryReclaimStaleLock(lockPath, staleMs)) continue;
+      } catch {}
       if (timeoutMs <= 0) {
         const contErr = new Error(`atomic lock contended (try-once): ${lockPath} [${_describeLockHolder(lockPath)}]`);
         contErr.code = 'ELOCKCONTENDED';
@@ -288,9 +330,6 @@ export async function withFileLock(lockPath, fn, opts = {}) {
       // Stale-lock reclaim (shared with the sync variant): dead owner pid,
       // a same-pid-but-foreign-token corpse from a reused pid, or a
       // pidless/empty corpse lock. A live foreign holder is never stolen.
-      try {
-        if (_tryReclaimStaleLock(lockPath, staleMs)) continue;
-      } catch {}
       if (Date.now() >= deadline) break;
       const base = DEFAULT_BACKOFFS_MS[Math.min(attempt, DEFAULT_BACKOFFS_MS.length - 1)];
       const jitter = Math.floor(Math.random() * Math.min(75, Math.max(1, base)));
@@ -585,62 +624,60 @@ export function updateJsonAtomicSync(filePath, mutator, opts = {}) {
   }, opts);
 }
 
-// ── Async atomic file write (non-blocking secret ACL) ───────────────
-// Mirror of writeFileAtomicSync, but the owner-only ACL enforcement on the
-// temp and final path runs through the async icacls variant so a debounced
-// timer flush never blocks the event loop on a subprocess. The tiny
-// writeFileSync/renameSync of a small JSON payload stay synchronous (they are
-// not the hitch); only the icacls calls — the actual blockers — are awaited.
+// ── Async atomic file write ─────────────────────────────────────────
+// Mirror of writeFileAtomicSync using promise-based filesystem calls and async
+// ACL enforcement. Large summary/pending-message JSON writes therefore never
+// block the host event loop on read/write/fsync/rename.
 // The truncate renameFallback branch is intentionally omitted: it only ever
 // applied to non-secret writes (opts.secret !== true), and every async caller
 // here is a secret config write, so behavior is identical.
 export async function writeFileAtomicAsync(filePath, data, opts = {}) {
   const run = async () => {
     const dir = dirname(filePath);
-    mkdirSync(dir, { recursive: true });
+    await mkdirAsync(dir, { recursive: true });
     const tmp = join(dir, `.${basename(filePath)}.${randomBytes(12).toString('hex')}.tmp`);
     try {
       const writeOpts = { encoding: opts.encoding || 'utf8', flag: 'wx', mode: opts.mode !== undefined ? opts.mode : 0o600 };
-      writeFileSync(tmp, data, writeOpts);
+      await writeFileAsync(tmp, data, writeOpts);
       if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(tmp);
       if (opts.fsync !== false) {
         let fd = null;
         try {
-          fd = openSync(tmp, 'r');
-          fsyncSync(fd);
+          fd = await openAsync(tmp, 'r');
+          await fd.sync();
         } catch (err) {
           if (!['EPERM', 'ENOTSUP', 'EINVAL'].includes(err?.code)) throw err;
         } finally {
-          try { if (fd !== null) closeSync(fd); } catch {}
+          try { if (fd !== null) await fd.close(); } catch {}
         }
       }
       if (opts.createOnly === true) {
         try {
-          linkSync(tmp, filePath);
+          await linkAsync(tmp, filePath);
         } catch (err) {
-          try { unlinkSync(tmp); } catch {}
+          try { await unlinkAsync(tmp); } catch {}
           if (err?.code === 'EEXIST') return false;
           throw err;
         }
-        try { unlinkSync(tmp); } catch {}
+        try { await unlinkAsync(tmp); } catch {}
       } else {
-        renameWithRetrySync(tmp, filePath, opts);
+        await renameWithRetry(tmp, filePath, opts);
       }
       if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(filePath);
       if (opts.fsyncDir === true) {
         let dfd = null;
         try {
-          dfd = openSync(dir, 'r');
-          fsyncSync(dfd);
+          dfd = await openAsync(dir, 'r');
+          await dfd.sync();
         } catch (err) {
           if (!['EPERM', 'ENOTSUP', 'EINVAL', 'EACCES'].includes(err?.code)) throw err;
         } finally {
-          try { if (dfd !== null) closeSync(dfd); } catch {}
+          try { if (dfd !== null) await dfd.close(); } catch {}
         }
       }
       return true;
     } catch (err) {
-      try { if (existsSync(tmp)) unlinkSync(tmp); } catch {}
+      try { await unlinkAsync(tmp); } catch {}
       throw err;
     }
   };
@@ -656,20 +693,21 @@ export function writeJsonAtomicAsync(filePath, value, opts = {}) {
 
 // Async read-modify-write. Same lock path (`${filePath}.lock`) and protocol
 // as updateJsonAtomicSync, so it is mutually exclusive with the sync variant.
-// The critical section itself is synchronous (readFileSync + writeJsonAtomicSync);
-// only the lock WAIT is async, so the event loop is never blocked on contention.
+// The lock wait and filesystem critical section are both asynchronous. JSON
+// parse/mutation/stringify remain synchronous CPU work, but no disk operation
+// or rename retry sleeps on the host event loop.
 export async function updateJsonAtomic(filePath, mutator, opts = {}) {
   const { lock: _lock, ...writeOpts } = opts;
-  return withFileLock(`${filePath}.lock`, () => {
+  return withFileLock(`${filePath}.lock`, async () => {
     let cur = null;
     try {
-      cur = JSON.parse(readFileSync(filePath, 'utf8'));
+      cur = JSON.parse(await readFileAsync(filePath, 'utf8'));
     } catch {
       cur = null;
     }
     const next = mutator(cur);
     if (next === undefined) return cur;
-    writeJsonAtomicSync(filePath, next, { ...writeOpts, lock: false });
+    await writeJsonAtomicAsync(filePath, next, { ...writeOpts, lock: false });
     return next;
   }, opts);
 }

package/src/runtime/shared/automation-attachments.mjs

@@ -7,11 +7,11 @@
  * {type:'file'}), so provider media normalization treats them identically.
  */
 
-export const AUTOMATION_ATTACHMENT_KINDS = ['image', 'text', 'pdf'];
+const AUTOMATION_ATTACHMENT_KINDS = ['image', 'text', 'pdf'];
 export const MAX_AUTOMATION_ATTACHMENTS = 8;
 // Base64 total across image/pdf items; text totals separately.
-export const MAX_AUTOMATION_BINARY_TOTAL = 8_000_000;
-export const MAX_AUTOMATION_TEXT_TOTAL = 200_000;
+const MAX_AUTOMATION_BINARY_TOTAL = 8_000_000;
+const MAX_AUTOMATION_TEXT_TOTAL = 200_000;
 
 /** Validate + strip a stored/list attachments value to the persisted shape (or null). */
 export function normalizeAutomationAttachments(value) {

package/src/runtime/shared/child-guardian.mjs

@@ -8,6 +8,20 @@ function positiveInt(value) {
   return Number.isInteger(n) && n > 0 ? n : null;
 }
 
+export function childGuardianSpawnEnv(env = process.env) {
+  return {
+    PATH: env.PATH || '',
+    SystemRoot: env.SystemRoot || env.WINDIR || '',
+    WINDIR: env.WINDIR || env.SystemRoot || '',
+    // Desktop's engine runs inside an Electron utility process, where
+    // process.execPath points at electron.exe. Without Node mode Electron
+    // ignores --eval, starts a full app process, and the intended guardian
+    // loop never runs — every completed shell then leaks ~100 MB until the
+    // desktop exits.
+    ELECTRON_RUN_AS_NODE: '1',
+  };
+}
+
 function guardianScript({ parentPid, childPid, childGroupPid, platform, pollMs, orphanGraceMs, forceGraceMs }) {
   return `
 const { spawnSync } = require('node:child_process');
@@ -88,11 +102,7 @@ export function startChildGuardian({
       }),
     ], {
       stdio: 'ignore',
-      env: {
-        PATH: process.env.PATH || '',
-        SystemRoot: process.env.SystemRoot || process.env.WINDIR || '',
-        WINDIR: process.env.WINDIR || process.env.SystemRoot || '',
-      },
+      env: childGuardianSpawnEnv(),
       ...detachedSpawnOpts,
     });
     guardian.unref?.();

package/src/runtime/shared/child-spawn-gate.mjs

@@ -3,25 +3,19 @@
 // ── Module-global child-spawn semaphore ──────────────────────────────────
 //
 // Single-daemon premise: tool execution is in-process, so a module-level
-// singleton semaphore bounds the number of concurrent child processes (rg,
-// mixdog-graph, …) across ALL agents/workers in this daemon. The goal is to
-// absorb the over-saturation tail — when N agents fire grep/code_graph at
-// once each child no longer fans out across every core, and the rg 20s
-// deadline stops tripping en masse — WITHOUT serializing: up to the cap run
-// concurrently, only the overflow queues and drains as slots free.
+// singleton semaphore CAN bound the number of concurrent child processes (rg,
+// mixdog-graph, …) across ALL agents/workers in this daemon. By default the
+// gate is UNBOUNDED — parallel waves must never queue behind it — and it only
+// becomes a real cap when MIXDOG_CHILD_SPAWN_MAX_INFLIGHT is set explicitly.
 //
 // IMPORTANT: this is a resource-control knob and is deliberately NOT exposed
 // on any tool JSON schema / tool parameter surface. The only tuning surface
-// is the internal constant + the MIXDOG_CHILD_SPAWN_MAX_INFLIGHT env override.
-
-import os from 'node:os';
+// is the MIXDOG_CHILD_SPAWN_MAX_INFLIGHT env override.
 
 function _defaultMaxInflight() {
   const override = Number(process.env.MIXDOG_CHILD_SPAWN_MAX_INFLIGHT);
   if (Number.isFinite(override) && override >= 1) return Math.floor(override);
-  let cpus = 0;
-  try { cpus = os.cpus()?.length || 0; } catch { cpus = 0; }
-  return Math.max(4, cpus || 4);
+  return Infinity;
 }
 
 const MAX_INFLIGHT = _defaultMaxInflight();

package/src/runtime/shared/err-text.mjs

@@ -146,6 +146,7 @@ export function presentErrorText(error, options = {}) {
     return 'Context too large.';
   }
   if (/\bcompact(?:ion)?\b.*\b(?:failed|error|overflow)\b|\b(?:failed|error)\b.*\bcompact(?:ion)?\b/i.test(text)) {
+    if (String(surface).toLowerCase().includes('compact')) return capText(text, max);
     return 'Compact failed.';
   }
 

package/src/runtime/shared/resource-admission.mjs

@@ -4,10 +4,14 @@ import { requestMemoryPressureSnapshot } from './memory-snapshot.mjs';
 
 const MB = 1024 * 1024;
 
+// Concurrency defaults are UNBOUNDED by design: parallel agent/shell waves
+// must never serialize behind an admission queue. The only default guards are
+// the memory-pressure checks below; hard caps exist solely as opt-in env
+// overrides (MIXDOG_MAX_CONCURRENT_AGENTS / _SHELLS / _HIGH_LOAD).
 export const RESOURCE_ADMISSION_DEFAULTS = Object.freeze({
-  maxAgents: 4,
-  maxShells: 4,
-  maxHighLoad: 6,
+  maxAgents: Infinity,
+  maxShells: Infinity,
+  maxHighLoad: Infinity,
   maxQueue: 32,
   minFreeMemoryMb: 1024,
   maxRssMb: 3072,

package/src/runtime/shared/safe-ipc-send.mjs

@@ -0,0 +1,34 @@
+function ipcUnavailableError() {
+  return Object.assign(new Error('IPC channel unavailable'), {
+    code: 'ERR_IPC_CHANNEL_CLOSED',
+  });
+}
+
+export function safeIpcSend(proc, message, { onError, onComplete } = {}) {
+  const report = (error) => {
+    if (!error) return;
+    try { onError?.(error); } catch {}
+  };
+  const complete = (error = null) => {
+    try { onComplete?.(error); } catch {}
+  };
+
+  if (!proc || typeof proc.send !== 'function' || proc.connected !== true) {
+    const error = ipcUnavailableError();
+    report(error);
+    complete(error);
+    return false;
+  }
+
+  try {
+    proc.send(message, undefined, {}, (error) => {
+      report(error);
+      complete(error || null);
+    });
+    return true;
+  } catch (error) {
+    report(error);
+    complete(error);
+    return false;
+  }
+}

package/src/runtime/shared/turn-snapshot.mjs

@@ -47,9 +47,6 @@ function publicAgentReviews(sessionId) {
   return [...turn.agents.values()].map((review) => ({ ...review }));
 }
 
-/** Compatibility no-op: apply_patch tracking has no project warmup cost. */
-export function prewarmTurnSnapshot() {}
-
 /** Start a new user turn and invalidate the prior turn's child review group. */
 export async function beginTurnSnapshot(_worktree, sessionId) {
   const ownerSessionId = clean(sessionId);