mixdog 1.0.11 → 1.1.0

package/src/runtime/shared/llm/model-catalog.mjs

@@ -583,6 +583,8 @@ function lookupModelMetadata(originalId, provider, catalog, modelsDevCatalog) {
       preserveBaseLimits: !nativeLimitsAuthoritative,
     });
   }
+  if (!meta && String(provider || '').startsWith('custom-'))
+    return customCatalogDefaults(originalId, catalog, modelsDevCatalog);
   return meta
     ? {
         ...meta,
@@ -592,16 +594,39 @@ function lookupModelMetadata(originalId, provider, catalog, modelsDevCatalog) {
     : null;
 }
 
+// A user-defined (`custom-*`) provider is in no catalog under its own id, so
+// its discovered models match by bare model id (as listed, then without a
+// `vendor/` route prefix) under the vendor the id names. Only the reasoning
+// capabilities become defaults for the custom row (its overrides win); prices
+// and limits describe the vendor's own API, not the custom endpoint.
+function customCatalogDefaults(originalId, catalog, modelsDevCatalog) {
+  const listed = String(originalId || '');
+  for (const id of new Set([listed, listed.slice(listed.lastIndexOf('/') + 1)])) {
+    if (!id) continue;
+    const vendor = _relayedModelVendor(id) || _modelsDevProviderId(catalog[id]?.litellm_provider);
+    const meta = lookupModelMetadata(id, vendor, catalog, modelsDevCatalog);
+    if (!meta) continue;
+    return {
+      supportsReasoning: meta.supportsReasoning === true,
+      reasoningOptions: Array.isArray(meta.reasoningOptions) ? meta.reasoningOptions : [],
+      reasoningContentField: meta.reasoningContentField || null,
+    };
+  }
+  return null;
+}
+
 function _normalize(entry) {
   if (!entry || typeof entry !== 'object') return null;
   // OpenAI's Priority processing (since renamed Fast mode) columns.
   const fastPricing = litellmPricing(entry, '_priority');
+  const ultrafastPricing = litellmPricing(entry, '_ultrafast');
   return {
     contextWindow: entry.max_input_tokens || entry.max_tokens || null,
     outputTokens: entry.max_output_tokens || null,
     ...litellmPricing(entry),
     ...litellmMediaPricing(entry),
     ...(PRICING_RATE_KEYS.some((key) => fastPricing[key] != null) ? { fastPricing } : {}),
+    ...(PRICING_RATE_KEYS.some((key) => ultrafastPricing[key] != null) ? { ultrafastPricing } : {}),
     ...(entry.off_peak_multiplier ? { offPeakMultiplier: entry.off_peak_multiplier } : {}),
     supportsVision: entry.supports_vision === true,
     supportsFunctionCalling: entry.supports_function_calling === true,

package/src/runtime/shared/llm/reasoning-usage.mjs

@@ -25,8 +25,7 @@ export function reasoningUsage(usage) {
     raw?.thoughts_token_count,
   ];
   const reasoningTokens = values.map(tokenCount).find((value) => value !== null) ?? null;
-  const measured = { reasoningTokens, reasoningTokensComplete: reasoningTokens !== null };
-  return raw?.warmup_usage ? combineReasoningUsage(measured, raw.warmup_usage) : measured;
+  return { reasoningTokens, reasoningTokensComplete: reasoningTokens !== null };
 }
 
 export function combineReasoningUsage(left, right) {

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { getUsageLedger, makeUsageRecord } from './usage-ledger.mjs';
-import { withUsageContext } from './usage-context.mjs';
+import { isNotedUsage, withUsageContext } from './usage-context.mjs';
 import { ACCOUNT_PROVIDERS } from '../provider-accounts.mjs';
 import { currentProviderAccountId } from '../provider-auth-binding.mjs';
 
@@ -10,6 +10,14 @@ import { currentProviderAccountId } from '../provider-auth-binding.mjs';
 const recorded = new WeakSet();
 const hasTokens = (usage) =>
   ['inputTokens', 'outputTokens', 'cachedTokens', 'cacheWriteTokens'].some((key) => Number(usage?.[key]) > 0);
+// One rule for every reported usage object: tokens, or a provider-reported
+// cost (a cost-only report is still a billed request).
+const recordable = (usage) =>
+  hasTokens(usage) ||
+  (usage?.costUsd != null &&
+    usage.costUsd !== '' &&
+    Number.isFinite(Number(usage.costUsd)) &&
+    Number(usage.costUsd) >= 0);
 
 /**
  * Runs at the common provider boundary, not inside optional diagnostic IO.
@@ -92,7 +100,7 @@ export async function accountProviderSend(provider, instance, send, model, opts
   };
   const saveAbandoned = async () => {
     for (const [index, attempt] of (identity.abandonedUsage || []).entries()) {
-      if (hasTokens(attempt.usage)) await save(attempt, `${requestId}:abandoned:${index}`);
+      if (recordable(attempt.usage)) await save(attempt, `${requestId}:abandoned:${index}`);
     }
   };
   let result;
@@ -102,8 +110,10 @@ export async function accountProviderSend(provider, instance, send, model, opts
     await saveAbandoned();
     // Only provider-reported partial usage is recordable; never invent
     // tokens for a failed request or reinterpret an error as a success.
-    if (error?.usage) await save(error);
-    else if (hasTokens(error?.partialUsage))
+    // Usage already noted as an abandoned attempt was just recorded above.
+    if (error?.usage) {
+      if (!isNotedUsage(error.usage)) await save(error);
+    } else if (recordable(error?.partialUsage) && !isNotedUsage(error.partialUsage))
       await save({ usage: error.partialUsage, model: error.partialModel }, requestId, error);
     throw error;
   }

package/src/runtime/shared/llm/usage-context.mjs

@@ -11,9 +11,19 @@ export const noteRequestServiceTier = (tier) => {
   const identity = context.getStore();
   if (identity) identity.requestServiceTier = tier || '';
 };
+// Usage objects already handed to a send's accounting, as given and as
+// stored. Noting is idempotent, and an error that surfaces later carrying the
+// same usage (an earlier attempt's error re-thrown) is not recorded again.
+const notedUsage = new WeakSet();
+export const isNotedUsage = (usage) => typeof usage === 'object' && usage !== null && notedUsage.has(usage);
 // A provider-local retry abandons an attempt the provider still billed; the
 // enclosing send records it alongside its own final usage.
 export const noteAbandonedUsage = (usage, model) => {
   const identity = context.getStore();
-  if (identity && usage) (identity.abandonedUsage ||= []).push({ usage, model });
+  if (!identity || !usage || notedUsage.has(usage)) return;
+  const stored = identity.normalizeAbandonedUsage?.(usage) ?? usage;
+  notedUsage.add(usage);
+  notedUsage.add(stored);
+  identity.abandonedUsage ||= [];
+  identity.abandonedUsage.push({ usage: stored, model });
 };

package/src/runtime/shared/llm/usage-ledger-repair.mjs

@@ -86,7 +86,9 @@ function* planUsageRepair(rows, { providerOverrides = {}, price = priceUsage })
               serviceTier: oldRates?.serviceTier,
               kind,
               ts: row.ts,
-              historical: true,
+              // Same rule as at ingestion: a live record keeps its exact
+              // request time (time-of-day pricing applies); imports do not.
+              historical: signature[6] !== 'live',
             });
       cost = priced.costUsd;
       if (cost !== null && (!Number.isFinite(cost) || cost < 0)) throw new Error('Invalid repair price');

package/src/runtime/shared/llm/usage-ledger-rollup.mjs

@@ -14,7 +14,7 @@
  * here mutates stored rows. Storage, schema and inserts stay in
  * usage-ledger.mjs.
  */
-import { isConversationUsageSource, num } from './usage-rollup.mjs';
+import { isConversationUsageSource, num, usageRollupDayKey } from './usage-rollup.mjs';
 import { normalizeUsageMeasurement, normalizeLegacyUsageDay } from './usage-measurement.mjs';
 
 // A detail and its terminal summary can overlap on the SAME route.
@@ -329,6 +329,110 @@ export function readSessionUsage(db, sessionIds) {
   return { ...usage, speedOutput, speedMs };
 }
 
+const DAY_KEY = (alias) => `printf('%04d-%02d-%02d',${alias}.day/10000,(${alias}.day/100)%100,${alias}.day%100)`;
+const BUMP = (day) => `INSERT INTO day_revisions(day,rev) VALUES(${day},1) ON CONFLICT(day) DO UPDATE SET rev=rev+1;`;
+const TRIGGER_ROWS = { INSERT: ['NEW'], DELETE: ['OLD'], UPDATE: ['OLD', 'NEW'] };
+const triggers = (name, table, events, days) =>
+  events
+    .map(
+      (event) => `CREATE TRIGGER IF NOT EXISTS ${name}_${event.toLowerCase()} AFTER ${event} ON ${table}
+        BEGIN ${TRIGGER_ROWS[event].map((row) => BUMP(days(row))).join(' ')} END;`
+    )
+    .join('\n');
+const ALL = ['INSERT', 'UPDATE', 'DELETE'];
+// Rows that change what a route/session means (price repairs rewrite route
+// signatures) can touch any day, so they bump the global revision ('').
+const GLOBAL_BUMP = BUMP("''");
+
+/**
+ * What a completed day's rollup is a function of is written only through
+ * these tables, so SQLite triggers (in the writer's own transaction, for
+ * every connection and process) bump that day's revision on any insert,
+ * update or delete. A route or session row changing bumps the global
+ * revision instead, invalidating every held day.
+ */
+export const DAY_REVISION_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS day_revisions (day TEXT PRIMARY KEY, rev INTEGER NOT NULL) WITHOUT ROWID;
+    ${triggers('day_rev_events', 'usage_events', ALL, DAY_KEY)}
+    ${triggers('day_rev_daily', 'daily', ALL, (row) => `${row}.day`)}
+    ${triggers('day_rev_sessions', 'day_sessions', ALL, (row) => `${row}.day`)}
+    ${triggers('day_rev_legacy', 'legacy_days', ALL, (row) => `${row}.day`)}
+    CREATE TRIGGER IF NOT EXISTS day_rev_routes_update AFTER UPDATE ON usage_routes BEGIN ${GLOBAL_BUMP} END;
+    CREATE TRIGGER IF NOT EXISTS day_rev_routes_delete AFTER DELETE ON usage_routes BEGIN ${GLOBAL_BUMP} END;
+    CREATE TRIGGER IF NOT EXISTS day_rev_session_names_update AFTER UPDATE ON usage_sessions BEGIN ${GLOBAL_BUMP} END;
+    CREATE TRIGGER IF NOT EXISTS day_rev_session_names_delete AFTER DELETE ON usage_sessions BEGIN ${GLOBAL_BUMP} END;
+`;
+
+// In-window days (those with any stored rollup input) with their revisions.
+function readDayFingerprints(db, fromDay, toDay) {
+  const global = db.prepare("SELECT rev FROM day_revisions WHERE day=''").get()?.rev ?? 0;
+  const revisions = new Map(
+    db
+      .prepare("SELECT day,rev FROM day_revisions WHERE day<>'' AND day BETWEEN ? AND ?")
+      .all(fromDay, toDay)
+      .map((row) => [row.day, row.rev])
+  );
+  const days = db
+    .prepare(
+      `SELECT day FROM daily WHERE day BETWEEN ?1 AND ?2 UNION SELECT day FROM day_sessions WHERE day BETWEEN ?1 AND ?2
+       UNION SELECT day FROM legacy_days WHERE day BETWEEN ?1 AND ?2`
+    )
+    .all(fromDay, toDay);
+  return Object.fromEntries(days.map(({ day }) => [day, `${global}:${revisions.get(day) ?? 0}`]));
+}
+
+const DELTA_DAY_QUERIES = 8;
+
+/**
+ * The part of a whole-day rollup that `known` (day -> fingerprint of the
+ * result the caller already holds) cannot answer: every day that is today or
+ * later, the hourly day, and any day whose fingerprint moved. Returns every
+ * in-window fingerprint plus the recomputed days; assembleRollup() merges
+ * them with the caller's held days into exactly rollupUsage()'s answer. A
+ * rolling (`fromMs`) window has no reusable day totals and is not served here.
+ */
+export function rollupDelta(db, options = {}, known = {}, now = Date.now()) {
+  const { hourlyDay = null, fromDay = '0000-01-01', toDay = '9999-12-31' } = options;
+  const fingerprints = readDayFingerprints(db, fromDay, toDay);
+  const today = usageRollupDayKey(now);
+  const stale = Object.keys(fingerprints).filter(
+    (day) => day === hourlyDay || day >= today || known[day] !== fingerprints[day]
+  );
+  if (stale.length > DELTA_DAY_QUERIES) {
+    const full = rollupUsage(db, { hourlyDay, fromDay, toDay });
+    const fresh = Object.fromEntries(Object.keys(fingerprints).map((day) => [day, full.days[day] ?? null]));
+    return { fingerprints, fresh, ...(full.hourly ? { hourly: full.hourly } : {}) };
+  }
+  const fresh = {};
+  let hourly = hourlyDay ? { rows: [], unallocated: [] } : null;
+  for (const day of stale) {
+    const part = rollupUsage(db, { fromDay: day, toDay: day, hourlyDay: day === hourlyDay ? day : null });
+    fresh[day] = part.days[day] ?? null;
+    if (part.hourly) hourly = part.hourly;
+  }
+  return { fingerprints, fresh, ...(hourly ? { hourly } : {}) };
+}
+
+/** `known` argument for rollupDelta from the caller's completed-day store. */
+export function knownRollupDays(store) {
+  return Object.fromEntries([...store].map(([day, entry]) => [day, entry.fingerprint]));
+}
+
+/** Merge a rollupDelta() answer with the held completed days (day -> {fingerprint,value}). */
+export function assembleRollup(store, delta, now = Date.now()) {
+  const today = usageRollupDayKey(now);
+  const days = {};
+  for (const day of Object.keys(delta.fingerprints).sort()) {
+    let value;
+    if (day in delta.fresh) {
+      value = delta.fresh[day];
+      if (day < today) store.set(day, { fingerprint: delta.fingerprints[day], value });
+    } else value = store.get(day).value;
+    if (value) days[day] = value;
+  }
+  return delta.hourly ? { days, hourly: delta.hourly } : { days };
+}
+
 /** Read cached amounts; group retained attribution separately for distinct sessions. */
 export function rollupUsage(
   db,

package/src/runtime/shared/llm/usage-ledger-worker.mjs

@@ -7,7 +7,7 @@
 import { DatabaseSync } from 'node:sqlite';
 import { serveWorkerRequests } from '../worker-requests.mjs';
 import { UsageLedger } from './usage-ledger.mjs';
-import { readSessionUsage, rollupUsage } from './usage-ledger-rollup.mjs';
+import { readSessionUsage, rollupDelta, rollupUsage } from './usage-ledger-rollup.mjs';
 import { readQuotaHistory, readQuotaWindows } from './usage-ledger-quota.mjs';
 import { applyUsageRepairIfUnchanged, selectUsageRepairCandidates } from './usage-ledger-repair.mjs';
 import { unpricedCountAfter, unpricedPendingCounts } from './usage-pricing-refresh.mjs';
@@ -59,6 +59,7 @@ function recordBatch(ledger, rows) {
 
 const operations = {
   rollup: ({ path, options }) => read(path, (db) => rollupUsage(db, options)),
+  rollupDelta: ({ path, options, known, now }) => read(path, (db) => rollupDelta(db, options, known, now)),
   sessionUsage: ({ path, sessionIds }) => read(path, (db) => readSessionUsage(db, sessionIds)),
   record: ({ path, rows }) => write(path, (ledger) => recordBatch(ledger, rows)),
   recordQuota: ({ path, samples }) => write(path, (ledger) => ledger.recordQuota(samples)),

package/src/runtime/shared/llm/usage-ledger.mjs

@@ -11,7 +11,14 @@ import { createHash, randomUUID } from 'node:crypto';
 import { resolvePluginData } from '../plugin-paths.mjs';
 import { usageRollupDayKey, isConversationUsageSource, num } from './usage-rollup.mjs';
 import { priceUsage } from './cost.mjs';
-import { readSessionUsage, rollupUsage } from './usage-ledger-rollup.mjs';
+import {
+  DAY_REVISION_SCHEMA,
+  assembleRollup,
+  knownRollupDays,
+  readSessionUsage,
+  rollupDelta,
+  rollupUsage,
+} from './usage-ledger-rollup.mjs';
 import { QUOTA_SCHEMA, readQuotaHistory, readQuotaWindows, recordQuotaSamples } from './usage-ledger-quota.mjs';
 import { SHARE_ENV } from 'node:worker_threads';
 import { createWorkerRequestClient } from '../worker-requests.mjs';
@@ -37,6 +44,7 @@ export function usageLedgerWorkerRunning() {
 }
 const stores = new Map();
 const ROLLUP_CACHE_LIMIT = 8;
+const windowShape = (options) => JSON.stringify({ ...options, fromMs: undefined, toMs: undefined });
 const text = (value) => (typeof value === 'string' ? value.slice(0, 300) : '');
 
 // Keep the full identifier, not a shortened hash. The tag also makes arbitrary
@@ -295,6 +303,10 @@ export class UsageLedger {
     this.db.exec('PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;');
     this.rollupStamp = null;
     this.rollups = new Map();
+    // Completed days' rollup results, validated by day revision (trigger-maintained) on every use,
+    // so they survive stamp changes. Rolling-window results by query shape.
+    this.dayRollups = new Map();
+    this.windowRollups = new Map();
     this.pendingRollups = new Map();
     this.writeQueue = [];
     this.writing = null;
@@ -340,6 +352,7 @@ export class UsageLedger {
             );
             CREATE TABLE IF NOT EXISTS legacy_days (day TEXT PRIMARY KEY, document TEXT NOT NULL);
             ${QUOTA_SCHEMA}
+            ${DAY_REVISION_SCHEMA}
             PRAGMA user_version=2;
         `);
     this.prepareStatements();
@@ -575,13 +588,52 @@ export class UsageLedger {
    * shared between callers and must be treated as read-only.
    */
   rollup(options = {}) {
-    this.syncRollupStamp();
+    const stamp = this.syncRollupStamp();
     const key = JSON.stringify(options);
-    const result = this.rollups.get(key) ?? rollupUsage(this.db, options);
+    const result = this.rollups.get(key) ?? this.reusableWindow(options, stamp) ?? this.computeRollup(options, stamp);
     this.rememberRollup(key, result);
     return result;
   }
 
+  /**
+   * A rolling window re-asked under an unchanged ledger is the same answer as
+   * long as no record sits in the part of the window that moved (aged out at
+   * the start, or newly reachable at the end): one indexed probe instead of
+   * a rebuild. Windows of the same shape are keyed without their edges.
+   */
+  reusableWindow(options, stamp) {
+    if (options.fromMs == null || options.toMs == null) return null;
+    const held = this.windowRollups.get(windowShape(options));
+    if (!held || held.stamp !== stamp) return null;
+    const moved = this.db
+      .prepare('SELECT 1 FROM usage_events WHERE (ts>=? AND ts<?) OR (ts>? AND ts<=?) LIMIT 1')
+      .get(
+        Math.min(held.fromMs, options.fromMs),
+        Math.max(held.fromMs, options.fromMs),
+        Math.min(held.toMs, options.toMs),
+        Math.max(held.toMs, options.toMs)
+      );
+    return moved ? null : held.result;
+  }
+
+  rememberWindow(options, stamp, result) {
+    if (options.fromMs == null || options.toMs == null) return;
+    const shape = windowShape(options);
+    this.windowRollups.delete(shape);
+    this.windowRollups.set(shape, { stamp, fromMs: options.fromMs, toMs: options.toMs, result });
+    if (this.windowRollups.size > ROLLUP_CACHE_LIMIT) this.windowRollups.delete(this.windowRollups.keys().next().value);
+  }
+
+  computeRollup(options, stamp) {
+    if (options.fromMs != null) {
+      const result = rollupUsage(this.db, options);
+      this.rememberWindow(options, stamp, result);
+      return result;
+    }
+    const now = Date.now();
+    return assembleRollup(this.dayRollups, rollupDelta(this.db, options, knownRollupDays(this.dayRollups), now), now);
+  }
+
   /**
    * rollup() with the query run on the shared rollup worker's own read-only
    * connection, so a changed ledger never costs the event loop the full
@@ -598,14 +650,29 @@ export class UsageLedger {
       this.rememberRollup(key, cached);
       return cached;
     }
+    const reused = this.reusableWindow(options, stamp);
+    if (reused) {
+      this.rememberRollup(key, reused);
+      return reused;
+    }
     let pending = this.pendingRollups.get(key);
     if (!pending) {
-      pending = this.workerRequest('rollup', { options })
+      const now = Date.now();
+      const request =
+        options.fromMs != null
+          ? this.workerRequest('rollup', { options })
+          : this.workerRequest('rollupDelta', { options, known: knownRollupDays(this.dayRollups), now }).then((delta) =>
+              assembleRollup(this.dayRollups, delta, now)
+            );
+      pending = request
         .then((result) => {
           // A newer stamp cleared the cache meanwhile; never file this
           // answer under it. The worker may have read commits newer than
           // `stamp`, which only means the next stamp change discards it.
-          if (this.rollupStamp === stamp) this.rememberRollup(key, result);
+          if (this.rollupStamp === stamp) {
+            this.rememberRollup(key, result);
+            this.rememberWindow(options, stamp, result);
+          }
           return result;
         })
         .finally(() => {

package/src/runtime/shared/onnx-runtime-support.mjs

@@ -0,0 +1,6 @@
+// onnxruntime-node ships no macOS Intel (darwin-x64) native binding since
+// 1.23, so the features built on it (memory embeddings, the Auto effort
+// judge) are unavailable there; everything else runs normally.
+export function onnxRuntimeSupported(platform = process.platform, arch = process.arch) {
+  return !(platform === 'darwin' && arch === 'x64');
+}

package/src/runtime/shared/orchestration.mjs

@@ -1,18 +1,26 @@
 // Orchestration is independent of workflow instructions and agent definitions.
 export const ORCHESTRATION_MODES = Object.freeze(['none', 'focused', 'balanced', 'swarm']);
 
+export const DEFAULT_ORCHESTRATION_MODE = 'balanced';
+
 export function normalizeOrchestrationMode(value, fallback = 'none') {
   return ORCHESTRATION_MODES.includes(value) ? value : fallback;
 }
 
+// Before the setting existed, Solo/Headless disabled delegation; Cowork (the
+// old `default` pack) and custom workflows enabled it. Solo was the shipped
+// default workflow then, so only a non-Solo choice is an explicit user choice.
+// Used for sessions recorded without a mode and by the one-time file
+// separation; the live config never infers a mode from the workflow.
+export function legacyWorkflowOrchestrationMode(active) {
+  return active && active !== 'solo' && active !== 'headless' ? 'swarm' : 'none';
+}
+
 export function configuredOrchestrationMode(config) {
   if (Object.hasOwn(config || {}, 'orchestrationMode')) {
-    return normalizeOrchestrationMode(config.orchestrationMode);
+    return normalizeOrchestrationMode(config.orchestrationMode, DEFAULT_ORCHESTRATION_MODE);
   }
-  // Before this setting existed, Solo/Headless disabled delegation; Cowork
-  // (the old `default` pack) and custom workflows enabled it.
-  const legacy = config?.workflow?.active;
-  return legacy && legacy !== 'solo' && legacy !== 'headless' ? 'swarm' : 'none';
+  return DEFAULT_ORCHESTRATION_MODE;
 }
 
 export function normalizeWorkflowSelection(config) {
@@ -31,5 +39,5 @@ export function sessionOrchestrationMode(session) {
   if (workflow?.delegatesAgents === false || (workflow?.agentsConfigured === true && workflow?.agents?.length === 0))
     return 'none';
   if (workflow?.delegatesAgents === true) return 'swarm';
-  return workflow ? configuredOrchestrationMode({ workflow: { active: workflow.id } }) : 'swarm';
+  return workflow ? legacyWorkflowOrchestrationMode(workflow.id) : 'swarm';
 }

package/src/runtime/shared/pristine-execution-contract.json

@@ -36,11 +36,16 @@
     "MIXDOG_STALL_FIRST_BYTE_ABORT_S",
     "MIXDOG_CACHE_MESSAGES_TTL",
     "MIXDOG_OAI_TRANSPORT",
-    "MIXDOG_OPENAI_OAUTH_WS_WARMUP",
     "MIXDOG_OAI_WS_DUMP_DIR",
     "MIXDOG_SESSION_TRANSCRIPT_LOG",
     "MIXDOG_SEARCH_SERVER_BIN",
-    "MIXDOG_USAGE_LOG"
+    "MIXDOG_USAGE_LOG",
+    "MIXDOG_AUTO_EFFORT",
+    "MIXDOG_AUTO_EFFORT_STEPS",
+    "MIXDOG_EFFORT_JUDGE_DIR",
+    "MIXDOG_EFFORT_DECISIONS_LOG",
+    "MIXDOG_EFFORT_JUDGE_COLD_WAIT_MS",
+    "MIXDOG_EFFORT_JUDGE_TIMEOUT_MS"
   ],
   "oauthProviders": {
     "anthropic-oauth": {

package/src/runtime/shared/projects.mjs

@@ -9,7 +9,8 @@
  */
 import { homedir } from 'node:os';
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { basename, isAbsolute, join, resolve } from 'node:path';
+import { withFileLockSync, writeJsonAtomicSync } from './atomic-file.mjs';
 
 const MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
 const PROJECTS_FILE = process.env.MIXDOG_PROJECTS_FILE
@@ -29,11 +30,19 @@ function normalizeKey(absPath) {
   return process.platform === 'win32' ? text.replace(/[\\/]+$/, '').toLowerCase() : text.replace(/\/+$/, '');
 }
 
-function readStore() {
+function readStore(strict = false) {
   try {
-    if (!existsSync(PROJECTS_FILE)) return { projects: [] };
+    if (!strict && !existsSync(PROJECTS_FILE)) return { projects: [] };
     const raw = readFileSync(PROJECTS_FILE, 'utf8');
     const parsed = JSON.parse(raw);
+    if (
+      strict &&
+      (!Array.isArray(parsed?.projects) ||
+        parsed.projects.some(
+          (entry) => !entry || typeof entry.path !== 'string' || !entry.path.trim() || !isAbsolute(entry.path)
+        ))
+    )
+      throw new TypeError('Project registry is invalid.');
     const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
     return {
       projects: projects
@@ -45,20 +54,23 @@ function readStore() {
           ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
         })),
     };
-  } catch {
+  } catch (error) {
+    if (strict && error?.code !== 'ENOENT') throw error;
     return { projects: [] };
   }
 }
 
-function writeStore(store) {
-  try {
-    mkdirSync(dirname(PROJECTS_FILE), { recursive: true });
-    const tmp = `${PROJECTS_FILE}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
-    renameSync(tmp, PROJECTS_FILE);
-  } catch {
-    /* best-effort persistence */
-  }
+// Serialize the entire read/modify/write across cooperating processes, not
+// just publication. Unlike the generic JSON updater, a corrupt registry must
+// never be repaired into an empty document. Preserve synchronous return values
+// and no-op behavior; failed reads, lock acquisition and writes propagate.
+function mutateStore(mutator) {
+  return withFileLockSync(`${PROJECTS_FILE}.lock`, () => {
+    const store = readStore(true);
+    const { value, changed } = mutator(store);
+    if (changed) writeJsonAtomicSync(PROJECTS_FILE, store, { lock: false });
+    return value;
+  });
 }
 
 /**
@@ -118,6 +130,13 @@ export function listProjects() {
   return projects.slice().sort(compareProjects);
 }
 
+/** Permission checks must not mistake unreadable/corrupt storage for removal.
+ * Mutations also use strict reads; only ordinary listing remains tolerant. */
+export function listProjectsStrict() {
+  const { projects } = readStore(true);
+  return projects.slice().sort(compareProjects);
+}
+
 /**
  * Register a project by path. Derives the display name from the last path
  * segment, dedupes by normalized absolute path, and persists. Does NOT create
@@ -126,20 +145,16 @@ export function listProjects() {
 export function addProject(rawPath) {
   const absPath = toAbsolute(rawPath);
   if (!absPath) return null;
-  const store = readStore();
-  const key = normalizeKey(absPath);
-  const existing = store.projects.find((entry) => normalizeKey(entry.path) === key);
-  if (existing) {
-    ensureProjectIdMarker(absPath, existing.name);
-    return existing;
-  }
-  const entry = {
-    name: basename(absPath) || absPath,
-    path: absPath,
-    addedAt: Date.now(),
-  };
-  store.projects.push(entry);
-  writeStore(store);
+  const entry = mutateStore((store) => {
+    const key = normalizeKey(absPath);
+    const existing = store.projects.find((item) => normalizeKey(item.path) === key);
+    if (existing) return { value: existing, changed: false };
+    const added = { name: basename(absPath) || absPath, path: absPath, addedAt: Date.now() };
+    store.projects.push(added);
+    return { value: added, changed: true };
+  });
+  // Auxiliary markers stay best-effort and outside the registry's lock. A
+  // failed registration must not create a marker that suggests it succeeded.
   ensureProjectIdMarker(absPath, entry.name);
   return entry;
 }
@@ -152,13 +167,14 @@ export function addProject(rawPath) {
 export function touchProjectSelected(rawPath) {
   const absPath = toAbsolute(rawPath);
   if (!absPath) return null;
-  const store = readStore();
-  const key = normalizeKey(absPath);
-  const entry = store.projects.find((item) => normalizeKey(item.path) === key);
-  if (!entry) return null;
-  entry.lastSelectedAt = Date.now();
-  writeStore(store);
-  ensureProjectIdMarker(absPath, entry.name);
+  const entry = mutateStore((store) => {
+    const key = normalizeKey(absPath);
+    const selected = store.projects.find((item) => normalizeKey(item.path) === key);
+    if (!selected) return { value: null, changed: false };
+    selected.lastSelectedAt = Date.now();
+    return { value: selected, changed: true };
+  });
+  if (entry) ensureProjectIdMarker(absPath, entry.name);
   return entry;
 }
 
@@ -166,12 +182,13 @@ export function touchProjectSelected(rawPath) {
 export function removeProject(rawPath) {
   const absPath = toAbsolute(rawPath);
   if (!absPath) return false;
-  const store = readStore();
-  const key = normalizeKey(absPath);
-  const next = store.projects.filter((entry) => normalizeKey(entry.path) !== key);
-  if (next.length === store.projects.length) return false;
-  writeStore({ projects: next });
-  return true;
+  return mutateStore((store) => {
+    const key = normalizeKey(absPath);
+    const next = store.projects.filter((entry) => normalizeKey(entry.path) !== key);
+    if (next.length === store.projects.length) return { value: false, changed: false };
+    store.projects = next;
+    return { value: true, changed: true };
+  });
 }
 
 /**
@@ -182,14 +199,14 @@ export function removeProject(rawPath) {
 export function renameProject(rawPath, nextName) {
   const absPath = toAbsolute(rawPath);
   if (!absPath) return null;
-  const store = readStore();
-  const key = normalizeKey(absPath);
-  const entry = store.projects.find((item) => normalizeKey(item.path) === key);
-  if (!entry) return null;
-  const trimmed = String(nextName || '').trim();
-  entry.name = trimmed || basename(absPath) || absPath;
-  writeStore(store);
-  return entry;
+  return mutateStore((store) => {
+    const key = normalizeKey(absPath);
+    const entry = store.projects.find((item) => normalizeKey(item.path) === key);
+    if (!entry) return { value: null, changed: false };
+    const trimmed = String(nextName || '').trim();
+    entry.name = trimmed || basename(absPath) || absPath;
+    return { value: entry, changed: true };
+  });
 }
 
 /** Whether a path currently exists on disk. */