mixdog 1.2.3 → 1.2.5

package/src/runtime/media/upstream-error.mjs

@@ -9,20 +9,34 @@
 import { mediaError } from './lanes.mjs';
 
 const CREDIT_HINTS = /credit|spending limit|billing|quota|insufficient|payment/i;
+// Subscription usage caps (ChatGPT plan windows), as opposed to short-lived
+// rate limiting: retrying in a moment does not help until the window resets.
+const USAGE_LIMIT = /usage_?limit/i;
 
-function reason(text) {
+function parseJson(text) {
   try {
-    const parsed = JSON.parse(text);
-    const message = parsed?.error?.message || parsed?.error || parsed?.message;
-    return typeof message === 'string' ? message : '';
+    return JSON.parse(text);
   } catch {
-    return '';
+    return null;
   }
 }
 
+function reason(text) {
+  const parsed = parseJson(text);
+  const message = parsed?.error?.message || parsed?.error || parsed?.message;
+  return typeof message === 'string' ? message : '';
+}
+
+// Raw bodies are only echoed when they are short plain text; HTML error pages
+// and other markup never reach the Studio.
+function rawDetail(text) {
+  const raw = String(text || '').trim();
+  return raw && !raw.startsWith('<') ? raw.slice(0, 300) : '';
+}
+
 /** Build the error a lane throws for a non-OK upstream response. */
 export function upstreamError(label, status, text) {
-  const detail = reason(text) || String(text || '').slice(0, 300);
+  const detail = reason(text) || rawDetail(text);
   if (status === 401 || status === 403) {
     if (CREDIT_HINTS.test(detail)) {
       return mediaError(`${label}: account has no usable balance — ${detail}`, 'MEDIA_BILLING_BLOCKED', status);
@@ -41,3 +55,55 @@ export function upstreamError(label, status, text) {
   }
   return mediaError(`${label} failed (${status})${detail ? `: ${detail}` : ''}`, 'MEDIA_UPSTREAM_FAILED', status);
 }
+
+const header = (headers, name) => String(headers?.get?.(name) || '').trim();
+const epochSeconds = (value) => (Number.isFinite(Number(value)) && Number(value) > 0 ? Math.trunc(Number(value)) : 0);
+
+// Latest reset among the exhausted windows advertised in the rate-limit
+// headers. The family is named after the active limit, with the plain codex
+// family as the fallback the backend also sends.
+function headerResetAt(headers, limitId) {
+  const families = new Set([limitId && `x-${limitId.toLowerCase().replace(/_/g, '-')}`, 'x-codex'].filter(Boolean));
+  let latest = 0;
+  for (const family of families) {
+    for (const window of ['primary', 'secondary']) {
+      const used = Number(header(headers, `${family}-${window}-used-percent`));
+      const resetAt = epochSeconds(header(headers, `${family}-${window}-reset-at`));
+      if (used >= 100 && resetAt > latest) latest = resetAt;
+    }
+  }
+  return latest || null;
+}
+
+/**
+ * Recognize a subscription usage-limit failure. `error` is the upstream error
+ * object (`{ type, code, resets_at }`), from an HTTP body or a stream event.
+ * Returns `{ limitId, resetsAt }` (epoch seconds or null), or null when the
+ * failure is something else.
+ */
+export function usageLimitInfo(error, headers) {
+  const kinds = [error?.type, error?.code, header(headers, 'x-codex-rate-limit-reached-type')];
+  if (!kinds.some((kind) => typeof kind === 'string' && USAGE_LIMIT.test(kind))) return null;
+  const limitId = header(headers, 'x-codex-active-limit') || String(error?.limit_id || error?.metered_feature || '');
+  return { limitId, resetsAt: epochSeconds(error?.resets_at) || headerResetAt(headers, limitId) };
+}
+
+/** usageLimitInfo for a non-OK HTTP response; only 429s are usage limits. */
+export function usageLimitFromResponse(status, text, headers) {
+  if (status !== 429) return null;
+  const parsed = parseJson(text);
+  return usageLimitInfo(parsed?.error && typeof parsed.error === 'object' ? parsed.error : parsed, headers);
+}
+
+function formatResetAt(seconds) {
+  return `${new Date(seconds * 1000).toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+}
+
+/** The error a lane throws when the subscription's usage window is exhausted. */
+export function usageLimitError(label, { limitId = '', resetsAt = null } = {}) {
+  const what = /image/i.test(limitId) ? 'image generation usage limit reached' : 'usage limit reached';
+  const when = resetsAt ? `resets ${formatResetAt(resetsAt)}` : 'try again after the usage window resets';
+  const err = mediaError(`${label}: ${what} — ${when}`, 'MEDIA_USAGE_LIMIT', 429);
+  if (resetsAt) err.resetsAt = new Date(resetsAt * 1000).toISOString();
+  return err;
+}

package/src/runtime/memory/lib/ingest/transcript-rows.mjs

@@ -69,6 +69,7 @@ export function cwdFromTranscriptPath(fp) {
  *  prefix envelopes, drops synthetic reference-files/compaction/ack/
  *  internal-notification rows). */
 export function transcriptRowFromLine(parsed) {
+  if (parsed.memoryEligible === false) return null;
   const role =
     parsed.message?.role ?? (parsed.type === 'user' || parsed.type === 'assistant' ? parsed.type : undefined);
   if (role !== 'user' && role !== 'assistant') return null;

package/src/runtime/memory/lib/pg/process.mjs

@@ -667,13 +667,11 @@ async function listPostmasterRows() {
   }
   const stdout = await execFileText('ps', ['-eo', 'pid=,etimes=,args='], { timeout: 15_000 });
   if (stdout === null) return [];
-  return stdout
-    .split(/\r?\n/)
-    .flatMap((line) => {
-      const match = line.match(/^\s*(\d+)\s+(\d+)\s+(.*postgres.*)$/);
-      if (!match) return [];
-      return [{ pid: Number(match[1]), uptimeSec: Number(match[2]), args: match[3] }];
-    });
+  return stdout.split(/\r?\n/).flatMap((line) => {
+    const match = line.match(/^\s*(\d+)\s+(\d+)\s+(.*postgres.*)$/);
+    if (!match) return [];
+    return [{ pid: Number(match[1]), uptimeSec: Number(match[2]), args: match[3] }];
+  });
 }
 
 const PRISTINE_ROOT_PREFIX = 'mixdog-headless-pristine-';

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -828,7 +828,10 @@ export function stopPgForShutdownSync() {
   } catch {}
   // The postmaster is gone, so drop its advert too (same guarded clear as the
   // async path: never another live owner's); otherwise pg.json outlives the run.
-  patchActiveInstance({ pg_port: null, pg_started_at: null, pg_pgdata: null, pg_runtime_dir: null }, { timeoutMs: 1000 });
+  patchActiveInstance(
+    { pg_port: null, pg_started_at: null, pg_pgdata: null, pg_runtime_dir: null },
+    { timeoutMs: 1000 }
+  );
 }
 
 // ── Owned-cluster shutdown (a host that starts PG through its stores) ────────

package/src/runtime/office/authoring/docx-html-runner.mjs

@@ -39,7 +39,7 @@ export async function runDocxHtmlAuthoring(html, output, { target, signal = null
   const scratch = await mkdtemp(join(tmpdir(), 'mixdog-docx-captures-'));
   let browser;
   try {
-    browser = await launchHtmlBrowser('docx-html-browser');
+    browser = await launchHtmlBrowser('docx-html-browser', { signal });
   } catch (error) {
     await rm(scratch, { recursive: true, force: true }).catch(() => {});
     return htmlFailure(error, startedAt);

package/src/runtime/office/authoring/html-browser.mjs

@@ -2,17 +2,25 @@
 // deadline and abort wiring around the layout work, the failure result, and the photographs of captured elements.
 import { join } from 'node:path';
 
-import { buildPuppeteerLaunchArgs, resolveBrowserLaunchOptions } from '../../shared/browser-launch.mjs';
+import {
+  buildPuppeteerLaunchArgs,
+  launchPuppeteerBrowser,
+  resolveBrowserLaunchOptions,
+} from '../../shared/browser-launch.mjs';
 import { startChildGuardian } from '../../shared/child-guardian.mjs';
 
 /** Launches the local browser the HTML is laid out in, under a guardian that reaps it with this process. */
-export async function launchHtmlBrowser(label) {
+export async function launchHtmlBrowser(label, { signal = null } = {}) {
   const puppeteer = (await import('puppeteer-core')).default;
-  const browser = await puppeteer.launch({
-    headless: true,
-    ...resolveBrowserLaunchOptions(),
-    args: buildPuppeteerLaunchArgs(['--font-render-hinting=none']),
-  });
+  const browser = await launchPuppeteerBrowser(
+    puppeteer,
+    {
+      headless: true,
+      ...resolveBrowserLaunchOptions(),
+      args: buildPuppeteerLaunchArgs(['--font-render-hinting=none']),
+    },
+    { signal }
+  );
   try {
     startChildGuardian({ childPid: browser.process?.()?.pid, label });
   } catch {}
@@ -22,7 +30,9 @@ export async function launchHtmlBrowser(label) {
 /** Runs `work` against the browser under a deadline and an abort signal, and closes the browser afterwards. */
 export async function runInBrowser(browser, { signal, timeoutMs }, work) {
   const abort = () => browser.close().catch(() => {});
-  signal?.addEventListener('abort', abort, { once: true });
+  // A cancel that landed while the browser was launching closes it at once.
+  if (signal?.aborted) abort();
+  else signal?.addEventListener('abort', abort, { once: true });
   let timer = null;
   const running = work();
   const timeout = new Promise((_, reject) => {

package/src/runtime/office/authoring/pdf-html-runner.mjs

@@ -262,7 +262,7 @@ export async function printHtmlPdf(
   await rm(output, { force: true });
   let browser;
   try {
-    browser = await launchHtmlBrowser('pdf-html-browser');
+    browser = await launchHtmlBrowser('pdf-html-browser', { signal });
   } catch (error) {
     return htmlFailure(error, startedAt);
   }

package/src/runtime/office/authoring/pptx-html-measure.mjs

@@ -559,7 +559,7 @@ export async function measureHtmlDeck(
   { sourcePath, shotPath, timeoutMs = 90_000, signal = null, prepare = null }
 ) {
   await writeFile(sourcePath, html, 'utf8');
-  const browser = await launchHtmlBrowser('pptx-html-browser');
+  const browser = await launchHtmlBrowser('pptx-html-browser', { signal });
   const work = async () => {
     const page = await browser.newPage();
     await page.setViewport(viewport(HTML_CANVAS, 1));

package/src/runtime/office/authoring/xlsx-html-runner.mjs

@@ -66,7 +66,7 @@ export async function runXlsxHtmlAuthoring(html, output, { target, signal = null
   const scratch = await mkdtemp(join(tmpdir(), 'mixdog-xlsx-captures-'));
   let browser;
   try {
-    browser = await launchHtmlBrowser('xlsx-html-browser');
+    browser = await launchHtmlBrowser('xlsx-html-browser', { signal });
   } catch (error) {
     await rm(scratch, { recursive: true, force: true }).catch(() => {});
     return htmlFailure(error, startedAt);

package/src/runtime/office/core/office-write-ledger.mjs

@@ -16,11 +16,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { isAbsolute, relative, resolve } from 'node:path';
-import {
-  PATCH_EDIT_BUDGET_BYTES,
-  createSnapshotBudget,
-  reviewFileContent,
-} from '../../shared/bounded-file-read.mjs';
+import { PATCH_EDIT_BUDGET_BYTES, createSnapshotBudget, reviewFileContent } from '../../shared/bounded-file-read.mjs';
 
 const ledgers = new AsyncLocalStorage();
 

package/src/runtime/office/index.mjs

@@ -31,9 +31,8 @@ export async function executeOfficeTool(args = {}, context = {}) {
   const sessionId = String(context.sessionId || '');
   if (!sessionId) return await tracedOfficeTool(args, context);
   const cwd = context.cwd || process.cwd();
-  const { ledger, run } = runWithOfficeWriteLedger(
-    { cwd, dataDir: context.dataDir || defaultOfficeDataDir() },
-    () => tracedOfficeTool(args, context)
+  const { ledger, run } = runWithOfficeWriteLedger({ cwd, dataDir: context.dataDir || defaultOfficeDataDir() }, () =>
+    tracedOfficeTool(args, context)
   );
   try {
     return await run;

package/src/runtime/office/pdf/pdf-analysis.mjs

@@ -261,74 +261,6 @@ export async function extractPdfTextLayout(
 // so the adapter, the tool surface, and tests keep one import.
 export { findPdfText } from './pdf-search.mjs';
 
-// The text run at `index`, joined with the next run on the same line when only
-// the joined text names a category (a label the PDF drew as two runs).
-function categoryLabelAt(items, index, expected) {
-  const item = items[index];
-  const text = String(item?.text || '').trim();
-  if (!text || expected.includes(text)) return text;
-  let nextIndex = index + 1;
-  while (nextIndex < items.length && !String(items[nextIndex]?.text || '').trim()) nextIndex += 1;
-  const next = items[nextIndex];
-  if (!next || Math.abs(Number(next.top) - Number(item.top)) > 1) return text;
-  const joined = `${text}${String(next.text || '').trim()}`;
-  return expected.includes(joined) ? joined : text;
-}
-
-// Every line that carries category labels, keyed by page and baseline.
-function categoryLabelRows(layout, expected) {
-  const rows = [];
-  for (const page of layout?.pages || []) {
-    const items = Array.isArray(page.items) ? page.items : [];
-    for (let index = 0; index < items.length; index += 1) {
-      const item = items[index];
-      const text = categoryLabelAt(items, index, expected);
-      if (!text || !expected.includes(text)) continue;
-      let row = rows.find((entry) => entry.page === page.page && Math.abs(entry.top - Number(item.top)) <= 1);
-      if (!row) {
-        row = { page: page.page, width: Number(page.width) || 0, top: Number(item.top), labels: [] };
-        rows.push(row);
-      }
-      if (!row.labels.some((entry) => entry.text === text)) {
-        row.labels.push({ text, x: Number(item.x) || 0 });
-      }
-    }
-  }
-  return rows;
-}
-
-function categoryRowSpacing(row, expected) {
-  const labels = expected
-    .map((text) => row.labels.find((entry) => entry.text === text))
-    .sort((left, right) => left.x - right.x);
-  const gaps = labels.slice(1).map((entry, index) => entry.x - labels[index].x);
-  return {
-    ...row,
-    labels,
-    span: labels.length > 1 ? labels.at(-1).x - labels[0].x : 0,
-    minimumGap: gaps.length ? Math.min(...gaps) : 0,
-  };
-}
-
-export function evaluatePowerPointCategorySpacing(layout, categories = []) {
-  const expected = [...new Set(categories.map((entry) => String(entry || '').trim()).filter(Boolean))];
-  const complete = categoryLabelRows(layout, expected)
-    .filter((row) => expected.every((text) => row.labels.some((entry) => entry.text === text)))
-    .map((row) => categoryRowSpacing(row, expected))
-    .sort((left, right) => right.span - left.span);
-  const best = complete[0] || null;
-  const requiredGap = best ? best.width * 0.1 : 0;
-  return {
-    ok: expected.length <= 1 || Boolean(best && best.minimumGap >= requiredGap),
-    categories: expected,
-    page: best?.page || 0,
-    labels: best?.labels || [],
-    span: Number((best?.span || 0).toFixed(2)),
-    minimumGap: Number((best?.minimumGap || 0).toFixed(2)),
-    requiredGap: Number(requiredGap.toFixed(2)),
-  };
-}
-
 // A PDF reports the runs it drew, not cells: a cell whose words were drawn as
 // separate runs would count as several columns and break its row against the
 // rows around it. Runs closer than half a line height are the same cell — the

package/src/runtime/session-search/session-search-ingest.mjs

@@ -58,7 +58,7 @@ export async function forgetSessionSearch(sessionId) {
 
 async function loadStoreDeps() {
   const [{ getStoreDir }, { _storedSessionFromFile, STORED_SESSION_UNREADABLE }] = await Promise.all([
-    import('../agent/orchestrator/session/store/paths-heartbeat.mjs'),
+    import('../agent/orchestrator/session/store/session-paths.mjs'),
     import('../agent/orchestrator/session/store/serialize.mjs'),
   ]);
   return {

package/src/runtime/shared/agent-reap-state.mjs

@@ -3,6 +3,19 @@ import { positiveInt } from './numbers.mjs';
 
 export const TAG_TOMBSTONE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 
+// How long a finished agent (completed, failed or cancelled child, or a Lead
+// row) stays listed in the Agents pane, measured from its finish stamp. This is
+// pane visibility only: session reuse and cache reaping keep their own windows
+// (resolveAgentTerminalReapMs).
+export const AGENT_PANE_VISIBLE_MS = 60 * 60 * 1000;
+
+/** Whether a row finished at `finishedAtMs` is still inside the pane window.
+ *  Index rows are always stamped; a row with no usable stamp has no provable
+ *  age and stays listed rather than vanishing on a guess. */
+export function agentPaneVisible(finishedAtMs, now) {
+  return !(finishedAtMs > 0) || now - finishedAtMs < AGENT_PANE_VISIBLE_MS;
+}
+
 export function stampMs(value) {
   if (typeof value === 'number') return Number.isFinite(value) && value > 0 ? value : 0;
   const text = clean(value);

package/src/runtime/shared/atomic-file.d.mts

@@ -23,5 +23,5 @@ export function writeJsonAtomicAsync(
 export function withFileLock<T>(
   lockPath: string,
   task: () => T | Promise<T>,
-  options?: { timeoutMs?: number; staleMs?: number; secret?: boolean }
+  options?: { timeoutMs?: number; staleMs?: number; secret?: boolean; strictOwner?: boolean }
 ): Promise<T>;

package/src/runtime/shared/background-tasks.mjs

@@ -330,13 +330,18 @@ export function settleCancelledBackgroundTask(taskId, { result } = {}) {
 export function cancelBackgroundTasks(options = {}) {
   const reason = clean(options.reason) || 'cancelled';
   const wanted = clean(options.surface);
+  const executionSessionId = clean(options.executionSessionId);
   let cancelled = 0;
   for (const task of [...tasks.values()]) {
     if (wanted && task.surface !== wanted) continue;
     // Scoped teardown must be exact. Legacy tasks without ownership stay
     // visible/recoverable, but may not be claimed by whichever session happens
     // to close first.
-    if (!taskMatchesScope(task, options, { includeUnattributed: false })) continue;
+    if (executionSessionId) {
+      // Delegated work executes in its bound session; before binding it still
+      // belongs to the registering session. Notification ownership is separate.
+      if ((clean(task.meta?.sessionId) || task.ownerSessionId) !== executionSessionId) continue;
+    } else if (!taskMatchesScope(task, options, { includeUnattributed: false })) continue;
     if (TERMINAL_STATUSES.has(task.status)) {
       if (options.notify === false) silenceCancelledNotification(task);
       continue;

package/src/runtime/shared/bounded-line-diff.mjs

@@ -162,14 +162,23 @@ export function lineDiffHunks(oldText, newText, budget, sources = [oldText, newT
   result ||= { hunks: replacementHunks(oldText, newText), exact: false };
   if (key && repeatable) cacheSet(key, result, oldText.length + newText.length);
   // Within its own operation it is final: the budget never grows back.
-  else if (key) (budget.fallbacks ||= new Map()).set(key, result);
+  else if (key) {
+    budget.fallbacks ||= new Map();
+    budget.fallbacks.set(key, result);
+  }
   return result;
 }
 
 /** The `--- `/`+++ ` headers and hunks of `hunks`, as jsdiff formats them,
  *  ending in exactly one newline. */
 export function unifiedHunksBody(oldHeader, newHeader, hunks) {
-  const generated = formatPatch({ oldFileName: oldHeader, newFileName: newHeader, oldHeader: '', newHeader: '', hunks });
+  const generated = formatPatch({
+    oldFileName: oldHeader,
+    newFileName: newHeader,
+    oldHeader: '',
+    newHeader: '',
+    hunks,
+  });
   let end = generated.length;
   // Linear trim: a /\n*$/ regex rescans from every position of a large patch.
   while (end > 0 && generated.charCodeAt(end - 1) === 10) end -= 1;

package/src/runtime/shared/browser-launch.mjs

@@ -88,3 +88,18 @@ export function buildPuppeteerLaunchArgs(extra = []) {
   if (puppeteerNoSandboxEnabled()) args.push('--no-sandbox');
   return args;
 }
+
+// A healthy headless launch answers in a few seconds; the observed CI failures
+// are launches that never print the DevTools endpoint and hit puppeteer's 30 s
+// TimeoutError (Windows runner, Linux runner). Puppeteer closes that child
+// itself, so one fresh attempt is the remedy; a longer wait would only delay
+// the same hang. Any other launch error (missing executable, bad args), or a
+// timeout after `signal` aborted, is not retried.
+export async function launchPuppeteerBrowser(puppeteer, options, { signal = null } = {}) {
+  try {
+    return await puppeteer.launch(options);
+  } catch (error) {
+    if (error?.name !== 'TimeoutError' || signal?.aborted) throw error;
+    return puppeteer.launch(options);
+  }
+}

package/src/runtime/shared/err-text.mjs

@@ -1,6 +1,7 @@
 import { transportErrorText } from './transport-error-text.mjs';
 import { describeError, safeErrorDetails } from './error-presentation.mjs';
 import { oneLine } from './clean.mjs';
+import { TIMEOUT_PHASE, isFirstByteTimeout } from './provider-timeout-phase.mjs';
 
 // HTTP status carried by a provider/transport error, or 0 when absent.
 export function errorHttpStatus(err) {
@@ -185,7 +186,9 @@ export function isCancelLikeError(error) {
 const KIND_LINES = {
   overloaded: 'Provider is busy at capacity.',
   rate_limited: ({ retryAfterMs }) =>
-    retryAfterMs ? `Provider is rate-limited (retry in ${formatDurationMs(retryAfterMs)}).` : 'Provider is rate-limited.',
+    retryAfterMs
+      ? `Provider is rate-limited (retry in ${formatDurationMs(retryAfterMs)}).`
+      : 'Provider is rate-limited.',
   quota_exhausted: 'Provider usage limit reached.',
   entitlement: 'Not included in your plan.',
   billing: 'Out of credits or at spend limit.',
@@ -198,7 +201,38 @@ const KIND_LINES = {
 // A bare message carries none, so its wording keeps the legacy text path.
 function hasTypedEvidence(error) {
   if (!error || typeof error !== 'object') return false;
-  return Boolean(error.errorKind?.kind) || errorHttpStatus(error) > 0 || Boolean(error.code) || Boolean(error.retryAfterMs);
+  return (
+    Boolean(error.errorKind?.kind) || errorHttpStatus(error) > 0 || Boolean(error.code) || Boolean(error.retryAfterMs)
+  );
+}
+
+// The window a provider timeout names (providerTimeoutError's message), or 0.
+const timedOutMs = (text) => Number(/timed out after (\d+)ms/i.exec(text)?.[1]) || 0;
+
+// A provider timeout before the model produced anything (isFirstByteTimeout):
+// the model is slow, not the connection.
+function stillThinkingText(error, text) {
+  const ms = Number(error.waitedMs) || timedOutMs(text);
+  const provider =
+    typeof error.providerLabel === 'string' && error.providerLabel ? error.providerLabel : 'the provider';
+  const attempts = Number(error.attempts) > 0 ? `; attempts: ${Math.floor(Number(error.attempts))}` : '';
+  return `Model still thinking: no output in ${formatDurationMs(ms)}; ${provider} sent nothing yet${attempts}.`;
+}
+
+// Stamped provider timeout phases and stream cuts. Null when the error names
+// neither, so the text rules below decide.
+function typedStreamFailureText(error, text) {
+  if (!error || typeof error !== 'object') return null;
+  if (isFirstByteTimeout(error)) return stillThinkingText(error, text);
+  if (error.timeoutPhase === TIMEOUT_PHASE.IDLE) {
+    const ms = timedOutMs(text);
+    return ms > 0 ? `No progress ${formatDurationMs(ms)}.` : 'No progress.';
+  }
+  // A stream that ended before its finish marker lost its connection.
+  if (error.code === 'TRUNCATED_STREAM' && error.streamCorruption !== true) {
+    return 'Connection to the provider was lost (TRUNCATED_STREAM).';
+  }
+  return null;
 }
 
 export function presentErrorText(error, options = {}) {
@@ -227,6 +261,8 @@ export function presentErrorText(error, options = {}) {
   if (embeddedError) text = embeddedError;
   text = oneLine(stripErrorPrefix(text));
   if (!text) return 'Unknown error';
+  const streamFailure = typedStreamFailureText(error, text);
+  if (streamFailure) return streamFailure;
 
   if (code === 'PROVIDER_PREFIX_MUTATION' || name === 'ProviderPrefixMutationError') {
     return 'Session state changed unexpectedly.';
@@ -282,9 +318,10 @@ export function presentErrorText(error, options = {}) {
     return Number.isFinite(ms) && ms > 0 ? `No first response ${formatDurationMs(ms)}.` : 'No first response.';
   }
 
+  // The agent's own watchdog, worded apart from any provider timeout.
   const firstTransport = /first (?:transport|semantic response) stale\s*\((\d+)ms\)/i.exec(text);
   if (firstTransport) {
-    return `No first response ${formatDurationMs(firstTransport[1])}.`;
+    return `Agent watchdog stopped the run: no model response in ${formatDurationMs(firstTransport[1])}.`;
   }
 
   const firstResponse = /(?:agent\s+)?first response stale\s*\((\d+)ms\)/i.exec(text);
@@ -363,7 +400,8 @@ export function backgroundTaskFailureStatusLabel(status, error, options = {}) {
     /^timeout$/i.test(statusNorm) ||
     watchdog?.kind === 'timeout' ||
     /first response stale/i.test(raw) ||
-    /no first response from/i.test(presented)
+    /no first response from/i.test(presented) ||
+    /^(?:Model still thinking|Agent watchdog stopped the run):/.test(presented)
   )
     head = 'Timeout';
   else if (

package/src/runtime/shared/file-lock.mjs

@@ -278,12 +278,13 @@ function* releaseReclaimGuard(reclaim) {
 
 // A lock is reclaimable when its recorded owner is dead, or when it names no
 // owner at all and has outlived the stale window.
-function lockReclaimable(owner, stat, staleMs) {
+function lockReclaimable(owner, stat, staleMs, strictOwner = false) {
   if (owner.pid !== null) return !ownerIsLive(owner);
+  if (strictOwner) return false;
   return Date.now() - (Number(stat.mtimeMs) || 0) >= Math.max(0, staleMs);
 }
 
-function* tryReclaimStaleLock(lockPath, staleMs) {
+function* tryReclaimStaleLock(lockPath, staleMs, strictOwner = false) {
   let initial;
   try {
     initial = yield ['stat', lockPath];
@@ -291,7 +292,7 @@ function* tryReclaimStaleLock(lockPath, staleMs) {
     return false;
   }
   const owner = yield* readLockOwner(lockPath);
-  if (!lockReclaimable(owner, initial, staleMs)) return false;
+  if (!lockReclaimable(owner, initial, staleMs, strictOwner)) return false;
   const reclaim = yield* tryAcquireReclaimGuard(lockPath);
   if (reclaim === null) return false;
   try {
@@ -303,7 +304,7 @@ function* tryReclaimStaleLock(lockPath, staleMs) {
     }
     const currentOwner = yield* readLockOwner(lockPath);
     if (currentOwner.pid !== owner.pid || currentOwner.token !== owner.token) return false;
-    if (lockReclaimable(currentOwner, current, staleMs)) {
+    if (lockReclaimable(currentOwner, current, staleMs, strictOwner)) {
       try {
         yield ['unlink', lockPath];
         return true;
@@ -429,7 +430,7 @@ function* acquireLock(lockPath, opts, mode, markHeld, timing = null) {
       // The reclaim runs synchronously in both modes: it is a few metadata
       // calls, and an await inside it would let a process exit strand its guard.
       try {
-        if (runSync(tryReclaimStaleLock(lockPath, staleMs))) continue;
+        if (runSync(tryReclaimStaleLock(lockPath, staleMs, opts.strictOwner === true))) continue;
       } catch {}
       if (timeoutMs <= 0) throw contentionError(lockPath, error, yield* describeLockHolder(lockPath));
       if (Date.now() >= deadline) break;

package/src/runtime/shared/llm/anthropic-betas.mjs

@@ -2,7 +2,6 @@ import { EFFORT_BETA_HEADER } from './anthropic-effort.mjs';
 import { normalizeClaudeModelId } from './anthropic-thinking-contract.mjs';
 import { getModelMetadataSync } from './model-catalog.mjs';
 
-const EXTENDED_CACHE_TTL_BETA_HEADER = 'extended-cache-ttl-2025-04-11';
 const INTERLEAVED_THINKING_BETA_HEADER = 'interleaved-thinking-2025-05-14';
 const FAST_MODE_BETA_HEADER = 'fast-mode-2026-02-01';
 const TOOL_SEARCH_BETA_HEADER = 'advanced-tool-use-2025-11-20';
@@ -23,7 +22,7 @@ export function supportsAnthropicFastMode(model) {
 }
 
 export function buildAnthropicBetaHeaders({
-  base = `${INTERLEAVED_THINKING_BETA_HEADER},${EXTENDED_CACHE_TTL_BETA_HEADER}`,
+  base = INTERLEAVED_THINKING_BETA_HEADER,
   fastMode = false,
   toolSearch = false,
   effort = false,

package/src/runtime/shared/llm/provider-model-identities.mjs

@@ -28,6 +28,7 @@ export const ANTIGRAVITY_MODELS = Object.freeze([
     low: 'gemini-3.1-pro-low',
     high: 'gemini-3.1-pro-high',
   }),
+  fallbackModel('gemini-4-argon', 'Gemini 4 Argon', 'gemini-pro', 1048576, 'gemini-4-argon', ['low', 'medium', 'high']),
   fallbackModel('claude-opus-4-6-thinking', 'Claude Opus 4.6 (Thinking)', null, 250000, 'claude-opus-4-6-thinking', [
     'low',
     'medium',

package/src/runtime/shared/model-route-chain.d.mts

@@ -0,0 +1,8 @@
+export function canonicalRouteProvider(value: unknown): string;
+export function routeChain(route: Record<string, unknown>): Record<string, unknown>[];
+export function validateRouteChainProviders(routes: Record<string, unknown>[]): void;
+export function normalizeRouteChain(
+  route: Record<string, unknown>,
+  normalizeLeaf: (route: Record<string, unknown>, fallback: Record<string, unknown>) => Record<string, unknown> | null,
+  fallback?: Record<string, unknown>
+): Record<string, unknown> | null;

package/src/runtime/shared/model-route-chain.mjs

@@ -0,0 +1,48 @@
+const PROVIDER_ALIASES = Object.freeze({
+  'openai-api': 'openai',
+  'xai-api': 'xai',
+  'gemini-api': 'gemini',
+  'anthropic-api': 'anthropic',
+});
+
+export function canonicalRouteProvider(value) {
+  const id = String(value || '').trim();
+  return PROVIDER_ALIASES[id] || id;
+}
+
+export function routeChain(route) {
+  if (!route || typeof route !== 'object' || Array.isArray(route)) return [];
+  const { fallbacks = [], ...primary } = route;
+  if (!Array.isArray(fallbacks)) throw new Error('route.fallbacks must be an array');
+  for (const entry of fallbacks) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry) || Object.hasOwn(entry, 'fallbacks')) {
+      throw new Error('fallback routes must be leaf route objects');
+    }
+  }
+  return [primary, ...fallbacks];
+}
+
+export function validateRouteChainProviders(routes) {
+  const providers = new Set();
+  for (const route of routes) {
+    const provider = canonicalRouteProvider(route.provider);
+    if (!provider || !String(route.model || '').trim()) throw new Error('route requires provider and model');
+    if (providers.has(provider)) throw new Error(`duplicate route provider "${provider}"`);
+    if (providers.size && provider === 'default') throw new Error('follow Main is only allowed as the primary route');
+    providers.add(provider);
+  }
+}
+
+export function normalizeRouteChain(route, normalizeLeaf, fallback = {}) {
+  const raw = routeChain({ ...fallback, ...route });
+  const primary = normalizeLeaf(route, fallback);
+  if (!primary) return null;
+  const routes = raw.map((entry, index) => {
+    const normalized = index === 0 ? primary : normalizeLeaf(entry, {});
+    if (!normalized) throw new Error('fallback route requires provider and model');
+    return { ...normalized, provider: canonicalRouteProvider(normalized.provider) };
+  });
+  validateRouteChainProviders(routes);
+  const [first, ...rest] = routes;
+  return rest.length ? { ...first, fallbacks: rest } : first;
+}