mixdog 1.1.1 → 1.2.0

package/src/runtime/shared/llm/provider-catalog-registry.mjs

@@ -0,0 +1,156 @@
+// Where each mixdog provider's model metadata comes from. One table read by
+// both lookup paths (async list enrichment and the sync lookup), so every
+// provider resolves effort ladders, limits, capabilities and pricing in the
+// same precedence order (see lookupModelMetadata in model-catalog.mjs).
+//
+// Fields:
+//   modelsDev     models.dev provider id holding this provider's rows.
+//   sameEndpoint  true when that models.dev entry describes the endpoint this
+//                 provider actually calls; its effort ladders, limits and
+//                 capabilities then apply. Otherwise it is only the same
+//                 vendor (another endpoint/account plan): it prices the model
+//                 and is a first guess for capabilities and the effort ladder
+//                 the provider's own sources leave undeclared — never limits.
+//   relay         sells other vendors' models; the serving vendor (read off
+//                 the model id) is likewise a first guess for capabilities
+//                 and the effort ladder, and prices a model with no own rates.
+//   rosterFiles   live-roster cache files the provider's listModels persists.
+//   rosterLimitsAuthoritative
+//                 live-roster limits beat catalog limits (the roster reflects
+//                 the account/backend window); otherwise they only fill gaps.
+//   rosterLadderFinal
+//                 a roster row's effort ladder is complete, empty included:
+//                 no guessed ladder is added to a model the roster lists.
+//   seedRow       offline seed row for a model id, applied after fetched data.
+import { mimoSeedRow, museSeedRow } from './provider-seed-rosters.mjs';
+
+function mimoSeedMetadata(model) {
+  const seed = mimoSeedRow(model);
+  return seed
+    ? {
+        contextWindow: seed.contextWindow,
+        outputTokens: seed.outputTokens,
+        supportsReasoning: seed.reasoning === true,
+        supportsVision: seed.vision === true,
+      }
+    : null;
+}
+
+const PROVIDER_CATALOGS = Object.freeze({
+  // api.openai.com — the endpoint models.dev `openai` describes.
+  openai: { modelsDev: 'openai', sameEndpoint: true },
+  // chatgpt.com/backend-api/codex: subscription backend, not the public API.
+  'openai-oauth': {
+    modelsDev: 'openai',
+    sameEndpoint: false,
+    rosterFiles: ['openai-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+  },
+  // api.anthropic.com with a subscription token: account-scoped windows and
+  // effort surface differ from the public API SKU.
+  'anthropic-oauth': {
+    modelsDev: 'anthropic',
+    sameEndpoint: false,
+    rosterFiles: ['anthropic-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+  },
+  // api.anthropic.com with an API key. Shares the OAuth roster file.
+  anthropic: { modelsDev: 'anthropic', sameEndpoint: true, rosterFiles: ['anthropic-oauth-models.json'] },
+  // generativelanguage.googleapis.com — the endpoint models.dev `google` describes.
+  gemini: { modelsDev: 'google', sameEndpoint: true, rosterFiles: ['gemini-models.json'] },
+  // cli-chat-proxy.grok.com, not api.x.ai.
+  'grok-oauth': {
+    modelsDev: 'xai',
+    sameEndpoint: false,
+    rosterFiles: ['grok-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+  },
+  // api.meta.ai/v1 — the endpoint models.dev `meta` describes.
+  'muse-code-oauth': {
+    modelsDev: 'meta',
+    sameEndpoint: true,
+    rosterFiles: ['muse-code-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+    seedRow: museSeedRow,
+  },
+  // token-plan-*.xiaomimimo.com subscription gateway, not the public API.
+  'mimo-oauth': {
+    modelsDev: 'xiaomi',
+    sameEndpoint: false,
+    rosterFiles: ['mimo-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+    seedRow: mimoSeedMetadata,
+  },
+  // Relays: their own models.dev id (when published) is their own endpoint.
+  // Effort tiers live in the wire id; a row without levels has no effort
+  // surface (resolveAntigravityWireModel drops the effort).
+  'antigravity-oauth': { relay: true, rosterFiles: ['antigravity-oauth-models.json'], rosterLadderFinal: true },
+  'cursor-oauth': { relay: true },
+  'cursor-api': { relay: true },
+  'opencode-go': { relay: true },
+});
+
+// Confirmed upstream catalog gaps, keyed provider → model. Each entry patches
+// the mapped models.dev row; a live roster that declares the field still wins.
+const VERIFIED_CORRECTIONS = Object.freeze({
+  'muse-code-oauth': Object.freeze({
+    // models.dev `meta` stops this ladder at xhigh; the Muse OAuth endpoint
+    // accepts reasoning.effort "max" for the contributor tier as for 1.3.
+    'muse-spark-1.3-contributor': Object.freeze({
+      reasoningOptions: Object.freeze([
+        Object.freeze({ type: 'effort', values: Object.freeze(['minimal', 'low', 'medium', 'high', 'xhigh', 'max']) }),
+      ]),
+    }),
+  }),
+});
+
+const key = (provider) =>
+  String(provider || '')
+    .trim()
+    .toLowerCase();
+
+/** Registry entry with defaults; an unlisted provider is its own models.dev id and endpoint. */
+export function providerCatalogEntry(provider) {
+  const p = key(provider);
+  if (!p) return null;
+  const entry = PROVIDER_CATALOGS[p] || {};
+  return {
+    provider: p,
+    modelsDev: entry.modelsDev || p,
+    sameEndpoint: entry.sameEndpoint !== false,
+    relay: entry.relay === true,
+    rosterFiles: entry.rosterFiles || [],
+    rosterLimitsAuthoritative: entry.rosterLimitsAuthoritative === true,
+    rosterLadderFinal: entry.rosterLadderFinal === true,
+    seedRow: entry.seedRow || null,
+  };
+}
+
+export function modelsDevProviderId(provider) {
+  return providerCatalogEntry(provider)?.modelsDev || null;
+}
+
+export function providerRosterFiles(provider) {
+  return providerCatalogEntry(provider)?.rosterFiles || [];
+}
+
+/** Providers owning a live-roster file; a provider reading another's file is skipped. */
+export function rosterProviders() {
+  const seen = new Set();
+  const out = [];
+  for (const [provider, entry] of Object.entries(PROVIDER_CATALOGS)) {
+    const files = entry.rosterFiles || [];
+    if (!files.length || files.every((file) => seen.has(file))) continue;
+    for (const file of files) seen.add(file);
+    out.push(provider);
+  }
+  return out;
+}
+
+export function providerSeedRow(provider, model) {
+  return providerCatalogEntry(provider)?.seedRow?.(String(model || '')) || null;
+}
+
+export function providerMetadataCorrection(provider, model) {
+  return VERIFIED_CORRECTIONS[key(provider)]?.[String(model || '')] || null;
+}

package/src/runtime/shared/llm/provider-seed-rosters.mjs

@@ -0,0 +1,130 @@
+// Offline seed rosters for providers whose discovery endpoint lists bare ids.
+// A seed is the cold-start fallback only: the metadata lookup applies it to
+// fields nothing fetched (live roster, models.dev) supplied, and provider
+// rows never let it override discovered data. Pure data, no provider imports,
+// so the shared sync lookup and the provider transports read one copy.
+
+// ── Muse Code (Meta Muse Spark) ─────────────────────────────────────────────
+export const MUSE_DEFAULT_EFFORT_LEVELS = Object.freeze(['minimal', 'low', 'medium', 'high', 'xhigh']);
+const MUSE_SIX_LEVELS = Object.freeze([...MUSE_DEFAULT_EFFORT_LEVELS, 'max']);
+const MUSE_SPARK_CONTEXT = 1_048_576;
+export const MUSE_SPARK_MAX_OUTPUT = 131_072;
+const STANDARD_COST = { inputCostPerM: 1.25, outputCostPerM: 4.25, cacheReadCostPerM: 0.15, cacheWriteCostPerM: 0 };
+const CONTRIBUTOR_COST = { inputCostPerM: 0.1, outputCostPerM: 0.2, cacheReadCostPerM: 0.002, cacheWriteCostPerM: 0 };
+
+// Only the 1.3 revisions accept `max`.
+const MUSE_SEEDS = Object.freeze({
+  'muse-spark-1.1': { name: 'Muse Spark 1.1', levels: MUSE_DEFAULT_EFFORT_LEVELS, cost: STANDARD_COST },
+  'muse-spark-1.2': { name: 'Muse Spark 1.2', levels: MUSE_DEFAULT_EFFORT_LEVELS, cost: STANDARD_COST },
+  'muse-spark-1.2-contributor': {
+    name: 'Muse Spark 1.2 (C)',
+    levels: MUSE_DEFAULT_EFFORT_LEVELS,
+    cost: CONTRIBUTOR_COST,
+  },
+  'muse-spark-1.3': { name: 'Muse Spark 1.3', levels: MUSE_SIX_LEVELS, cost: STANDARD_COST },
+  'muse-spark-1.3-contributor': { name: 'Muse Spark 1.3 (C)', levels: MUSE_SIX_LEVELS, cost: CONTRIBUTOR_COST },
+});
+export const MUSE_SEED_IDS = Object.freeze(Object.keys(MUSE_SEEDS));
+
+function museEffortRow(id, name, levels, cost) {
+  return {
+    id,
+    name,
+    provider: 'muse-code-oauth',
+    family: 'muse-spark',
+    contextWindow: MUSE_SPARK_CONTEXT,
+    outputTokens: MUSE_SPARK_MAX_OUTPUT,
+    supportsReasoning: true,
+    supportsVision: true,
+    supportsFunctionCalling: true,
+    reasoningLevels: [...levels],
+    reasoningOptions: [{ type: 'effort', values: [...levels] }],
+    ...cost,
+  };
+}
+
+// Revisioned Spark ids the seed does not list inherit the newest seeded
+// revision of their tier (limits, vision, pricing) but take the five-level
+// ladder: only reviewed seeds advertise `max`.
+const SPARK_ID_RE = /^muse-spark-(\d+)\.(\d+)(?:\.(\d+))?(-contributor)?$/i;
+
+function revisionOf(id) {
+  const m = SPARK_ID_RE.exec(id);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3] || 0)] : null;
+}
+
+function compareRevision(a, b) {
+  for (let i = 0; i < 3; i += 1) if (a[i] !== b[i]) return a[i] - b[i];
+  return 0;
+}
+
+function museLineageRow(id) {
+  const match = SPARK_ID_RE.exec(id);
+  if (!match) return null;
+  const contributor = Boolean(match[4]);
+  let template = null;
+  let templateRevision = null;
+  for (const seedId of MUSE_SEED_IDS) {
+    if (SPARK_ID_RE.exec(seedId)[4] ? !contributor : contributor) continue;
+    const candidate = revisionOf(seedId);
+    if (!templateRevision || compareRevision(candidate, templateRevision) > 0) {
+      template = seedId;
+      templateRevision = candidate;
+    }
+  }
+  if (!template) return null;
+  const revision =
+    match[3] && Number(match[3]) !== 0 ? `${match[1]}.${match[2]}.${match[3]}` : `${match[1]}.${match[2]}`;
+  return museEffortRow(
+    id,
+    `Muse Spark ${revision}${contributor ? ' (C)' : ''}`,
+    MUSE_DEFAULT_EFFORT_LEVELS,
+    MUSE_SEEDS[template].cost
+  );
+}
+
+/** Seed row for a seeded id, else the lineage row of a revisioned Spark id, else null. */
+export function museSeedRow(id) {
+  const key = String(id || '');
+  const seed = MUSE_SEEDS[key];
+  if (seed) return museEffortRow(key, seed.name, seed.levels, seed.cost);
+  return museLineageRow(key);
+}
+
+// ── Xiaomi MiMo ─────────────────────────────────────────────────────────────
+const MIMO_SEED_CONTEXT = 1_048_576;
+const MIMO_SEED_OUTPUT = 131_072;
+export const MIMO_SEED_MODELS = Object.freeze(
+  [
+    ['mimo-v2.6-pro', 'MiMo-V2.6-Pro', MIMO_SEED_CONTEXT],
+    ['mimo-v2.6-flash', 'MiMo-V2.6-Flash', MIMO_SEED_CONTEXT],
+    ['mimo-v2.6-pro-ultraspeed', 'MiMo-V2.6-Pro-Ultraspeed', MIMO_SEED_CONTEXT],
+    ['mimo-v2.5-pro', 'MiMo-V2.5-Pro', MIMO_SEED_CONTEXT],
+    ['mimo-v2.5', 'MiMo-V2.5', MIMO_SEED_CONTEXT],
+    ['mimo-v2-pro', 'MiMo-V2-Pro', MIMO_SEED_CONTEXT],
+    ['mimo-v2-omni', 'MiMo-V2-Omni', 262_144],
+  ].map(([id, display_name, context_window]) =>
+    Object.freeze({ id, display_name, context_window, max_output_tokens: MIMO_SEED_OUTPUT })
+  )
+);
+
+/** Exact seed id, else the longest seed whose id is a lineage prefix of the
+ *  model (dated or suffixed variants of a seeded model). */
+export function mimoSeedRow(model) {
+  const id = String(model || '').toLowerCase();
+  let seed = MIMO_SEED_MODELS.find((item) => item.id === id) || null;
+  if (!seed) {
+    for (const item of MIMO_SEED_MODELS) {
+      if (id.startsWith(`${item.id}-`) && (!seed || item.id.length > seed.id.length)) seed = item;
+    }
+  }
+  if (!seed) return null;
+  return {
+    id: String(model),
+    contextWindow: seed.context_window,
+    outputTokens: seed.max_output_tokens,
+    reasoning: true,
+    vision: true,
+    inputModalities: ['text', 'image'],
+  };
+}

package/src/runtime/shared/model-proxy-mode.d.mts

@@ -0,0 +1,3 @@
+export const MODEL_PROXY_ENV: 'MIXDOG_MODEL_PROXY';
+export function modelProxyClientMode(env?: Record<string, string | undefined>): boolean;
+export function serverModelCredentialsDisabledError(what?: string): Error & { code: string };

package/src/runtime/shared/model-proxy-mode.mjs

@@ -0,0 +1,19 @@
+// Remote (SSH) mode switch. With MIXDOG_MODEL_PROXY=client the daemon runs on
+// a server that must never hold model credentials: every model call is
+// executed by the connected desktop client on the user's PC and streamed back
+// (providers/model-proxy-channel.mjs). Read per call so a test or host can
+// flip the environment without reloading modules.
+export const MODEL_PROXY_ENV = 'MIXDOG_MODEL_PROXY';
+
+export function modelProxyClientMode(env = process.env) {
+  return env?.[MODEL_PROXY_ENV] === 'client';
+}
+
+/** The refusal every server-side credential refresh raises in this mode. */
+export function serverModelCredentialsDisabledError(what = 'model credentials') {
+  const error = new Error(
+    `${what} are not available on this server: ${MODEL_PROXY_ENV}=client runs every model call on the client PC.`
+  );
+  error.code = 'MODEL_CREDENTIALS_DISABLED';
+  return error;
+}

package/src/runtime/shared/provider-accounts.mjs

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { updateJsonAtomicSync } from './atomic-file.mjs';
+import { parseJsonText, updateJsonAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 export const ACCOUNT_PROVIDERS = Object.freeze([
@@ -48,7 +48,7 @@ function validate(raw) {
 
 function read(dataDir) {
   try {
-    return validate(JSON.parse(readFileSync(file(dataDir), 'utf8')));
+    return validate(parseJsonText(readFileSync(file(dataDir), 'utf8')));
   } catch (error) {
     if (error.code === 'ENOENT') return validate(null);
     throw error;

package/src/runtime/shared/provider-api-key.mjs

@@ -1,7 +1,8 @@
 import { createRequire } from 'node:module';
+import { modelProxyClientMode } from './model-proxy-mode.mjs';
 
 const require = createRequire(import.meta.url);
-const { getSecret, hasSecret } = require('../../lib/keychain-cjs.cjs');
+const { getSecret, getSecretAsync, hasSecret } = require('../../lib/keychain-cjs.cjs');
 
 // Lightweight API-key lookup shared by pristine startup and the general config
 // loader. This module deliberately has no mixdog-config.json dependency: asking
@@ -41,6 +42,8 @@ function environmentApiKey(provider) {
 /** Presence-only credential probe. On Windows this is a cheap DPAPI-file
  * check; decrypting through PowerShell is reserved for an actual API call. */
 export function hasAgentApiKey(provider) {
+  // Remote mode: this server holds no model credentials (model-proxy-mode.mjs).
+  if (modelProxyClientMode()) return false;
   const id = String(provider || '').trim();
   if (!id) return false;
   if (environmentApiKey(id)) return true;
@@ -52,6 +55,7 @@ export function hasAgentApiKey(provider) {
 }
 
 export function getAgentApiKey(provider) {
+  if (modelProxyClientMode()) return null;
   const id = String(provider || '').trim();
   const environment = environmentApiKey(id);
   if (environment) return environment;
@@ -64,3 +68,19 @@ export function getAgentApiKey(provider) {
   }
   return null;
 }
+
+/** One provider's key read on demand, warming no other account: the
+ *  environment first (getAgentApiKey's precedence), then only this provider's
+ *  keychain entry through the async path (no whole-keyring snapshot). */
+export async function readAgentApiKeyAsync(provider) {
+  if (modelProxyClientMode()) return null;
+  const id = String(provider || '').trim();
+  if (!id) return null;
+  const environment = environmentApiKey(id);
+  if (environment) return environment;
+  try {
+    return (await getSecretAsync(`agent.${id}.apiKey`)) || null;
+  } catch {
+    return null;
+  }
+}

package/src/runtime/shared/schedule-model-ref.mjs

@@ -1,7 +1,8 @@
 // schedule.model wire format shared by the channels-worker scheduler and the
 // engine-side run-now dispatch: either a config.presets id/name (legacy) or a
-// direct "provider/model[@effort][+fast][?parameter=value]" route string written
-// by the desktop schedule editor. Slash-form values become direct route
+// direct "provider/model[@effort][+fast][+noauto][?parameter=value]" route string
+// written by the desktop schedule editor (`+noauto`: Auto effort off for the
+// route; absent means on). Slash-form values become direct route
 // objects, which agent-dispatch consumes without a presets lookup.
 // The optional route fields an automation run carries, from a preset, a
 // maintenance slot or a parsed route ref. One shape so schedule and webhook
@@ -13,6 +14,7 @@ export function modelRouteFields(slot = {}) {
     model: slot.model,
     ...(slot.effort ? { effort: slot.effort } : {}),
     ...(slot.fast === true ? { fast: true } : {}),
+    ...(slot.autoEffort === false ? { autoEffort: false } : {}),
     ...(slot.modelParameters ? { modelParameters: { ...slot.modelParameters } } : {}),
   };
 }
@@ -24,6 +26,7 @@ export function formatScheduleModelRef(route) {
     `${route.provider}/${route.model}` +
     (route.effort ? `@${route.effort}` : '') +
     (route.fast === true ? '+fast' : '') +
+    (route.autoEffort === false ? '+noauto' : '') +
     (parameters.length ? `?${new URLSearchParams(parameters).toString()}` : '')
   );
 }
@@ -37,6 +40,11 @@ export function parseScheduleModelRef(ref) {
   if (slash <= 0) return raw;
   let rest = routeRef.slice(slash + 1);
   let fast = false;
+  let autoEffort = true;
+  if (rest.endsWith('+noauto')) {
+    autoEffort = false;
+    rest = rest.slice(0, -7);
+  }
   if (rest.endsWith('+fast')) {
     fast = true;
     rest = rest.slice(0, -5);
@@ -52,6 +60,7 @@ export function parseScheduleModelRef(ref) {
     model: rest,
     ...(effort ? { effort } : {}),
     ...(fast ? { fast: true } : {}),
+    ...(autoEffort ? {} : { autoEffort: false }),
     ...(query ? { modelParameters: Object.fromEntries(new URLSearchParams(query)) } : {}),
   };
 }

package/src/runtime/shared/semver.d.mts

@@ -0,0 +1 @@
+export function compareSemver(a: string, b: string): number;

package/src/runtime/shared/semver.mjs

@@ -0,0 +1,57 @@
+// SemVer 2.0.0 precedence (§11), dependency-free so both Node and the desktop
+// renderer can use it. A leading `v` is tolerated, build metadata is ignored,
+// and a missing or non-numeric core part reads as 0.
+
+/** Parse a semver-ish string into { parts:[maj,min,patch], prerelease:[ids] }. */
+function parseSemver(value) {
+  const text = String(value || '')
+    .trim()
+    .replace(/^v/i, '')
+    .split('+')[0];
+  const dash = text.indexOf('-');
+  const core = dash === -1 ? text : text.slice(0, dash);
+  const parts = core.split('.').map((n) => {
+    const num = Number.parseInt(n, 10);
+    return Number.isFinite(num) ? num : 0;
+  });
+  while (parts.length < 3) parts.push(0);
+  return { parts, prerelease: dash === -1 ? [] : text.slice(dash + 1).split('.') };
+}
+
+const NUMERIC = /^\d+$/;
+
+// Numeric identifiers compare numerically and rank below alphanumeric ones,
+// which compare in ASCII order.
+function compareIdentifiers(a, b) {
+  const aNumeric = NUMERIC.test(a);
+  const bNumeric = NUMERIC.test(b);
+  if (aNumeric && bNumeric) {
+    const diff = BigInt(a) - BigInt(b);
+    return diff === 0n ? 0 : diff > 0n ? 1 : -1;
+  }
+  if (aNumeric) return -1;
+  if (bNumeric) return 1;
+  return a === b ? 0 : a < b ? -1 : 1;
+}
+
+/**
+ * Compare two semver strings: positive if `a` > `b`, negative if `a` < `b`,
+ * 0 if they have equal precedence. A prerelease ranks below its release, and
+ * of two prereleases sharing every identifier the shorter one is lower.
+ */
+export function compareSemver(a, b) {
+  const pa = parseSemver(a);
+  const pb = parseSemver(b);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa.parts[i] || 0) - (pb.parts[i] || 0);
+    if (diff !== 0) return diff > 0 ? 1 : -1;
+  }
+  const aPre = pa.prerelease.length;
+  const bPre = pb.prerelease.length;
+  if (!aPre || !bPre) return aPre === bPre ? 0 : aPre ? -1 : 1;
+  for (let i = 0; i < Math.min(aPre, bPre); i++) {
+    const diff = compareIdentifiers(pa.prerelease[i], pb.prerelease[i]);
+    if (diff !== 0) return diff;
+  }
+  return Math.sign(aPre - bPre);
+}

package/src/runtime/shared/session-usage-totals.mjs

@@ -0,0 +1,19 @@
+/**
+ * Cumulative per-session accounting as agent pool rows publish it, read off
+ * the counters the session already persists (totalInputTokens /
+ * totalOutputTokens / totalToolCalls, advanced once per provider response).
+ * A counter the session never recorded stays unknown (null), not zero.
+ */
+const counter = (value) => (Number.isFinite(value) && value >= 0 ? value : null);
+
+export function sessionUsageTotals(session) {
+  const input = counter(session?.totalInputTokens);
+  const output = counter(session?.totalOutputTokens);
+  return {
+    usage:
+      input === null && output === null
+        ? null
+        : { inputTokens: input ?? 0, outputTokens: output ?? 0, totalTokens: (input ?? 0) + (output ?? 0) },
+    toolCalls: counter(session?.totalToolCalls),
+  };
+}

package/src/runtime/shared/sharp-electron-linux.mjs

@@ -0,0 +1,25 @@
+// Route sharp to its WebAssembly build when this process runs on Electron's
+// Linux binary (the desktop daemon runs as ELECTRON_RUN_AS_NODE).
+//
+// The Electron executable links the system libglib/libgobject for GTK, so they
+// sit in the global symbol scope before sharp loads. sharp's native addon then
+// binds g_object_* to the system GObject instead of the copy bundled in its
+// libvips, and the first pipeline dies with SIGSEGV inside g_object_unref —
+// one pasted image restarted the whole daemon. sharp itself warns about this
+// (SharpElectronLinux). The wasm build links nothing from the host, so it is
+// immune; plain Node keeps the faster native addon.
+import { registerHooks } from 'node:module';
+
+const NATIVE_SHARP = /^@img\/sharp-linux(?:musl)?-[^/]+\/sharp\.node$/;
+
+export function sharpElectronLinuxRedirect(specifier) {
+  return NATIVE_SHARP.test(specifier) ? '@img/sharp-wasm32/sharp.node' : null;
+}
+
+if (process.versions.electron && process.platform === 'linux') {
+  registerHooks({
+    resolve(specifier, context, nextResolve) {
+      return nextResolve(sharpElectronLinuxRedirect(specifier) || specifier, context);
+    },
+  });
+}

package/src/runtime/shared/singleton-owner.mjs

@@ -13,6 +13,9 @@ function writeJsonAtomic(path, value) {
 
 function acquireClaimLock(path) {
   const lockPath = `${path}.claim.lock`;
+  // A first boot (e.g. a daemon an ssh bootstrap starts on a fresh server)
+  // has no data directory yet: the lock's parent must exist.
+  mkdirSync(dirname(path), { recursive: true });
   for (let i = 0; i < 20; i++) {
     try {
       mkdirSync(lockPath, { recursive: false });
@@ -32,22 +35,32 @@ function acquireClaimLock(path) {
   return null;
 }
 
-export function readSingletonOwner(path) {
+// A live pid alone does not prove the record's process still owns it: the OS
+// reuses pids. `isStale(owner)` lets a caller with a stronger proof (the
+// daemon's published discovery) reject a live-pid record; `stale` reports it.
+export function readSingletonOwner(path, { isStale = null } = {}) {
   const owner = readJsonSafe(path);
-  if (!owner || typeof owner !== 'object') return { owner: null, alive: false };
-  return { owner, alive: isPidAlive(owner.pid) };
+  if (!owner || typeof owner !== 'object') return { owner: null, alive: false, stale: false };
+  const pidAlive = isPidAlive(owner.pid);
+  const stale = pidAlive && typeof isStale === 'function' && isStale(owner) === true;
+  return { owner, alive: pidAlive && !stale, stale };
 }
 
-export function claimSingletonOwner(path, { kind = 'runtime', pid = process.pid, meta = {} } = {}) {
+export function claimSingletonOwner(path, { kind = 'runtime', pid = process.pid, meta = {}, isStale = null } = {}) {
   const owner = {
     kind,
     pid,
     claimedAt: new Date().toISOString(),
     ...meta,
   };
+  const livePeer = (current) =>
+    Boolean(current?.pid) &&
+    Number(current.pid) !== Number(pid) &&
+    isPidAlive(current.pid) &&
+    !(typeof isStale === 'function' && isStale(current) === true);
 
   const current = readJsonSafe(path);
-  if (current?.pid && Number(current.pid) !== Number(pid) && isPidAlive(current.pid)) {
+  if (livePeer(current)) {
     return { owned: false, owner: current };
   }
 
@@ -55,7 +68,7 @@ export function claimSingletonOwner(path, { kind = 'runtime', pid = process.pid,
   if (!lockPath) return { owned: false, owner: readJsonSafe(path) };
   try {
     const lockedCurrent = readJsonSafe(path);
-    if (lockedCurrent?.pid && Number(lockedCurrent.pid) !== Number(pid) && isPidAlive(lockedCurrent.pid)) {
+    if (livePeer(lockedCurrent)) {
       return { owned: false, owner: lockedCurrent };
     }
     writeJsonAtomic(path, owner);
@@ -76,6 +89,23 @@ export function releaseSingletonOwner(path, pid = process.pid) {
   }
 }
 
+// Rewrite the caller's own record (`owner.pid`) under the claim lock: when it
+// still names that pid or is gone, it becomes `owner` ('refreshed'); a record
+// naming another pid is reported, never overwritten ('superseded'); a claim
+// lock held past its wait leaves the record alone ('busy').
+export function refreshSingletonOwner(path, owner) {
+  const lockPath = acquireClaimLock(path);
+  if (!lockPath) return { status: 'busy', owner: null };
+  try {
+    const current = readJsonSafe(path);
+    if (current?.pid && Number(current.pid) !== Number(owner.pid)) return { status: 'superseded', owner: current };
+    writeJsonAtomic(path, owner);
+    return { status: 'refreshed', owner };
+  } finally {
+    rmSync(lockPath, { recursive: true, force: true });
+  }
+}
+
 // Atomic ownership handoff: replace the owner record from fromPid to toOwner
 // under the SAME claim lock, so a concurrent claimSingletonOwner() cannot slip
 // between a release() and a re-claim() and fork a competing daemon. Verifies