mixdog 1.2.4 → 1.2.6

package/src/runtime/shared/file-permissions.mjs

@@ -1,11 +1,288 @@
 import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { execFile, execFileSync } from 'node:child_process';
-import { promisify } from 'node:util';
+import { dirname, join, resolve } from 'node:path';
+import { execFile, execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { MessageChannel, receiveMessageOnPort, SHARE_ENV, Worker } from 'node:worker_threads';
 
-const execFileAsync = promisify(execFile);
 let cachedUserSid = null;
 
+// Resolved per call (not promisified once at load) so the live binding of
+// child_process.execFile is used.
+function execFileAsync(file, args, options) {
+  return new Promise((done, fail) => {
+    execFile(file, args, options, (error, stdout, stderr) => {
+      if (error) fail(Object.assign(error, { stdout, stderr }));
+      else done({ stdout, stderr });
+    });
+  });
+}
+
+// Securing a published secret by spawning PowerShell costs ~150-200 ms per
+// call, and secrets are read far more often than they change. Nothing is
+// cached: every non-fresh async call still reads the file's real DACL and
+// tightens it when it is not owner-only. File metadata (mtime/ctime/size/id)
+// is never treated as evidence of permissions. To make that per-call check
+// cheap, one long-lived PowerShell helper per process answers requests over
+// stdin/stdout ("<id> <base64 path>" in, "<id> ok|fixed|err <base64 detail>"
+// out); concurrent callers share it and are matched by request id. If the
+// helper cannot start, crashes, closes its pipes or misses the request
+// deadline, every request it held (and later ones, once the restart budget is
+// spent) falls back to the spawn-per-call update, so a lost helper never
+// skips a check. A definite ACL failure reported by the helper is an error,
+// exactly like a failed per-call update.
+const ACL_HELPER_REQUEST_TIMEOUT_MS = 15_000;
+// At most this many helper starts per window. A lifetime budget let three
+// unrelated losses (a request deadline missed across a system sleep, an
+// antivirus stall) pin a days-old process to a PowerShell spawn per read.
+const ACL_HELPER_MAX_STARTS = 3;
+const ACL_HELPER_START_WINDOW_MS = 10 * 60_000;
+let aclHelper = null;
+let aclHelperStartTimes = [];
+let aclHelperSeq = 0;
+
+function aclHelperScript(sid) {
+  return [
+    "$ErrorActionPreference = 'Stop';",
+    `$sid = [System.Security.Principal.SecurityIdentifier]::new(${quoteForPowerShell(sid)});`,
+    '$full = [System.Security.AccessControl.FileSystemRights]::FullControl;',
+    '$utf8 = [System.Text.Encoding]::UTF8;',
+    '$out = [Console]::Out;',
+    'while ($null -ne ($line = [Console]::In.ReadLine())) {',
+    '$parts = $line.Split(@([char]32), 2);',
+    'if ($parts.Count -ne 2) { continue };',
+    'try {',
+    '$path = $utf8.GetString([Convert]::FromBase64String($parts[1]));',
+    '$directory = [System.IO.Directory]::Exists($path);',
+    '$current = if ($directory) { [System.IO.Directory]::GetAccessControl($path) }',
+    'else { [System.IO.File]::GetAccessControl($path) };',
+    '$rules = @($current.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]));',
+    '$ownerOnly = $current.AreAccessRulesProtected -and $rules.Count -eq 1 -and',
+    "$rules[0].AccessControlType -eq 'Allow' -and $rules[0].IdentityReference -eq $sid -and",
+    '$rules[0].FileSystemRights -eq $full;',
+    "if ($ownerOnly) { $out.WriteLine($parts[0] + ' ok') } else {",
+    '$acl = if ($directory) { [System.Security.AccessControl.DirectorySecurity]::new() }',
+    'else { [System.Security.AccessControl.FileSecurity]::new() };',
+    '$acl.SetAccessRuleProtection($true, $false);',
+    '$acl.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new(',
+    '$sid, $full, [System.Security.AccessControl.AccessControlType]::Allow));',
+    'if ($directory) { [System.IO.Directory]::SetAccessControl($path, $acl) }',
+    'else { [System.IO.File]::SetAccessControl($path, $acl) };',
+    "$out.WriteLine($parts[0] + ' fixed') }",
+    '} catch {',
+    "$out.WriteLine($parts[0] + ' err ' + [Convert]::ToBase64String($utf8.GetBytes([string]$_.Exception.Message)))",
+    '};',
+    '$out.Flush() }',
+  ].join(' ');
+}
+
+function startAclHelper(icacls, sid) {
+  const now = Date.now();
+  aclHelperStartTimes = aclHelperStartTimes.filter((at) => now - at < ACL_HELPER_START_WINDOW_MS);
+  if (aclHelperStartTimes.length >= ACL_HELPER_MAX_STARTS) return null;
+  aclHelperStartTimes.push(now);
+  const command = powerShellCommand(icacls, aclHelperScript(sid));
+  let child;
+  try {
+    // Long-lived: run from System32 so it never pins the caller's working
+    // directory (a folder a process's cwd sits in cannot be removed).
+    child = spawn(command.executable, command.args, {
+      cwd: dirname(icacls),
+      stdio: ['pipe', 'pipe', 'ignore'],
+      windowsHide: true,
+    });
+  } catch {
+    return null;
+  }
+  const helper = { child, pending: new Map(), buffer: '', dead: false };
+  helper.fail = (cause) => {
+    if (aclHelper === helper) aclHelper = null;
+    if (helper.dead) return;
+    helper.dead = true;
+    const lost = [...helper.pending.values()];
+    helper.pending.clear();
+    for (const request of lost) request.lost(cause);
+    try {
+      child.kill();
+    } catch {}
+  };
+  child.on('error', helper.fail);
+  child.on('exit', () => helper.fail(new Error('Windows ACL helper exited')));
+  child.stdin.on('error', helper.fail);
+  child.stdout.on('error', helper.fail);
+  child.stdout.on('close', () => helper.fail(new Error('Windows ACL helper closed its output')));
+  child.stdout.setEncoding('utf8');
+  child.stdout.on('data', (chunk) => {
+    helper.buffer += chunk;
+    let newline = helper.buffer.indexOf('\n');
+    while (newline >= 0) {
+      const [id, status, detail = ''] = helper.buffer.slice(0, newline).trim().split(' ');
+      helper.buffer = helper.buffer.slice(newline + 1);
+      newline = helper.buffer.indexOf('\n');
+      const request = helper.pending.get(id);
+      if (!request) continue;
+      helper.pending.delete(id);
+      syncAclHelperRef(helper);
+      request.answer(status, Buffer.from(detail, 'base64').toString('utf8'));
+    }
+  });
+  syncAclHelperRef(helper);
+  return helper;
+}
+
+// An idle helper never keeps the process alive; while a request awaits its
+// answer the helper's handles do, so the answer is delivered even when the
+// request's deadline timer is mocked or otherwise not a live handle.
+function syncAclHelperRef(helper) {
+  const method = helper.pending.size > 0 ? 'ref' : 'unref';
+  helper.child[method]();
+  helper.child.stdin[method]?.();
+  helper.child.stdout[method]?.();
+}
+
+/** Resolves `{ status, detail }` from the helper, or `{ lost }` when it could not answer. */
+function askAclHelper(targetPath, icacls, sid) {
+  if (!aclHelper) aclHelper = startAclHelper(icacls, sid);
+  const helper = aclHelper;
+  if (!helper) return Promise.resolve({ lost: new Error('Windows ACL helper unavailable') });
+  return new Promise((done) => {
+    aclHelperSeq += 1;
+    const id = String(aclHelperSeq);
+    const timer = setTimeout(() => {
+      helper.pending.delete(id);
+      syncAclHelperRef(helper);
+      done({ lost: new Error('Windows ACL helper timed out') });
+      helper.fail(new Error('Windows ACL helper timed out'));
+    }, ACL_HELPER_REQUEST_TIMEOUT_MS);
+    helper.pending.set(id, {
+      answer(status, detail) {
+        clearTimeout(timer);
+        done({ status, detail });
+      },
+      lost(cause) {
+        clearTimeout(timer);
+        done({ lost: cause });
+      },
+    });
+    syncAclHelperRef(helper);
+    helper.child.stdin.write(`${id} ${Buffer.from(targetPath, 'utf8').toString('base64')}\n`);
+  });
+}
+
+// ── Sync bridge ─────────────────────────────────────────────────────────
+// Synchronous secret writes (token stores, config) cannot await the helper,
+// and a blocking icacls spawn per write held the event loop (and the write's
+// file lock) for seconds under load. A worker thread owns a second helper;
+// a synchronous caller posts its path and blocks in Atomics.wait only for
+// the answer — milliseconds once the helper runs (prewarmOwnerOnlyAclWin32
+// starts it off the write path). Shared slots: [0] answer counter, [1] the
+// worker exited, [2] the worker is ready. A worker not ready within
+// ACL_SYNC_BRIDGE_READY_MS, or gone, sends the caller to the one-shot
+// update; an answer later than ACL_SYNC_BRIDGE_TIMEOUT_MS fails the write.
+const ACL_SYNC_BRIDGE_READY_MS = 10_000;
+// The helper's own deadline plus its one-shot fallback's, with margin.
+const ACL_SYNC_BRIDGE_TIMEOUT_MS = 2 * ACL_HELPER_REQUEST_TIMEOUT_MS + 5_000;
+let aclSyncBridge = null;
+let aclSyncBridgeBroken = false;
+
+function syncBridge() {
+  if (aclSyncBridge || aclSyncBridgeBroken) return aclSyncBridge;
+  try {
+    const url = new URL('./file-permissions-worker.mjs', import.meta.url);
+    // Bundled copies (the desktop service) ship no worker beside them.
+    if (!existsSync(fileURLToPath(url))) throw new Error('Windows ACL bridge worker is not shipped here');
+    const { port1, port2 } = new MessageChannel();
+    const signal = new Int32Array(new SharedArrayBuffer(12));
+    const worker = new Worker(url, {
+      env: SHARE_ENV,
+      execArgv: [],
+      workerData: { port: port2, signal },
+      transferList: [port2],
+    });
+    const bridge = { worker, port: port1, signal, seq: 0, startedAt: Date.now() };
+    const drop = () => {
+      if (aclSyncBridge === bridge) aclSyncBridge = null;
+    };
+    worker.on('error', drop);
+    worker.on('exit', drop);
+    worker.unref();
+    port1.unref?.();
+    aclSyncBridge = bridge;
+  } catch {
+    aclSyncBridgeBroken = true;
+  }
+  return aclSyncBridge;
+}
+
+function dropSyncBridge(bridge) {
+  if (aclSyncBridge !== bridge) return;
+  aclSyncBridge = null;
+  void bridge.worker.terminate();
+}
+
+/** `{ ok: true }`, `{ ok: false, message, code }` (a definite ACL failure),
+ *  `{ timedOut: true }`, or `{ lost }` when no bridge could answer. */
+function askSyncBridge(targetPath) {
+  const bridge = syncBridge();
+  if (!bridge) return { lost: new Error('Windows ACL bridge unavailable') };
+  bridge.seq += 1;
+  const id = bridge.seq;
+  let seen = Atomics.load(bridge.signal, 0);
+  bridge.port.postMessage({ id, path: targetPath });
+  const deadline = Date.now() + ACL_SYNC_BRIDGE_TIMEOUT_MS;
+  for (;;) {
+    for (let received = receiveMessageOnPort(bridge.port); received; received = receiveMessageOnPort(bridge.port)) {
+      if (received.message?.id === id) return received.message;
+    }
+    const now = Date.now();
+    const ready = Atomics.load(bridge.signal, 2) === 1;
+    if (Atomics.load(bridge.signal, 1) === 1 || (!ready && now - bridge.startedAt >= ACL_SYNC_BRIDGE_READY_MS)) {
+      dropSyncBridge(bridge);
+      return { lost: new Error('Windows ACL bridge exited') };
+    }
+    if (now >= deadline) return { timedOut: true };
+    const wait = ready ? deadline - now : Math.min(deadline - now, bridge.startedAt + ACL_SYNC_BRIDGE_READY_MS - now);
+    Atomics.wait(bridge.signal, 0, seen, Math.max(1, wait));
+    seen = Atomics.load(bridge.signal, 0);
+  }
+}
+
+/** Test hook: synchronous calls skip the bridge (its one-shot fallback runs). */
+export function disableOwnerOnlyAclSyncBridgeForTests() {
+  aclSyncBridgeBroken = true;
+  if (aclSyncBridge) dropSyncBridge(aclSyncBridge);
+}
+
+/** Starts, off any write path, what owner-only enforcement needs on Windows:
+ *  this thread's SID and helper, and the sync bridge with its own helper.
+ *  Best-effort; never rejects. */
+export async function prewarmOwnerOnlyAclWin32({ bridge = true } = {}) {
+  if (process.platform !== 'win32') return;
+  try {
+    const icacls = icaclsPath();
+    if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
+    if (!aclHelper) aclHelper = startAclHelper(icacls, cachedUserSid);
+    if (bridge) syncBridge()?.port.postMessage({ warm: true });
+  } catch {
+    /* enforcement itself reports any failure */
+  }
+}
+
+/** Test/diagnostic hook: whether a helper is attached, its requests awaiting
+ *  an answer, and the starts inside the current restart window. */
+export function ownerOnlyAclHelperStats() {
+  return {
+    alive: aclHelper !== null,
+    pid: aclHelper?.child.pid ?? null,
+    pending: aclHelper?.pending.size ?? 0,
+    recentStarts: aclHelperStartTimes.length,
+  };
+}
+
+/** Test hook: the live helper process, or null. */
+export function ownerOnlyAclHelperForTests() {
+  return aclHelper?.child ?? null;
+}
+
 function systemToolPath(name) {
   const systemRoot = process.env.SystemRoot || process.env.windir;
   return systemRoot ? join(systemRoot, 'System32', name) : null;
@@ -155,6 +432,18 @@ function aclFailure(targetPath, cause, label = 'icacls') {
 export function enforceOwnerOnlyAclWin32(targetPath, { fresh = false } = {}) {
   if (process.platform !== 'win32') return;
   const icacls = icaclsPath();
+  // Fresh files (the temp and lock files of every synchronous secret write,
+  // made while its file lock is held) go to the helper through the sync
+  // bridge: one round trip, no process spawned. Only a bridge that is gone
+  // falls back to the blocking one-shot update below.
+  if (fresh) {
+    const reply = askSyncBridge(resolve(targetPath));
+    if (reply.ok === true) return;
+    if (reply.ok === false) throw Object.assign(new Error(reply.message), { code: reply.code || 'EACLFAIL' });
+    if (reply.timedOut) {
+      throw aclFailure(targetPath, new Error('the Windows ACL bridge did not answer'), 'Windows ACL helper');
+    }
+  }
   if (cachedUserSid === null) cachedUserSid = resolveCurrentUserPrincipal();
   const command = ownerOnlyAclCommand(targetPath, cachedUserSid, fresh, icacls);
   try {
@@ -168,8 +457,25 @@ export function enforceOwnerOnlyAclWin32(targetPath, { fresh = false } = {}) {
   }
 }
 
+// Fresh files (unpublished temp/lock files, one or two per secret write) go
+// through the helper too: never owner-only yet, each is secured explicitly by
+// its DACL replacement. An icacls spawn per write, made inside the write's
+// file lock, kept provider-accounts.json locked for 114 s under heavy load
+// (each spawn blocked the event loop for seconds as well).
 export async function enforceOwnerOnlyAclWin32Async(targetPath, { fresh = false } = {}) {
   if (process.platform !== 'win32') return;
+  const icacls = icaclsPath();
+  if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
+  const reply = await askAclHelper(resolve(targetPath), icacls, cachedUserSid);
+  if (reply.status === 'ok' || reply.status === 'fixed') return;
+  if (reply.status === 'err') {
+    throw aclFailure(targetPath, new Error(reply.detail || 'unknown error'), 'Windows ACL helper');
+  }
+  // The helper could not answer: verify with a one-shot update instead.
+  return applyOwnerOnlyAclAsync(targetPath, fresh);
+}
+
+async function applyOwnerOnlyAclAsync(targetPath, fresh) {
   const icacls = icaclsPath();
   if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
   const command = ownerOnlyAclCommand(targetPath, cachedUserSid, fresh, icacls);

package/src/runtime/shared/git-runner-worker.mjs

@@ -1,80 +1,8 @@
-// Worker-thread body for git-runner.mjs. Starting a child process is a
-// synchronous native call (CreateProcess on Windows, amplified by on-access
-// scanning), so git children are spawned here instead of on the host event
-// loop. Each request resolves to { code, stdout, stderr } or an error with the
-// same codes the in-process runner used (ETIMEDOUT, EMAXBUFFER, spawn errors).
-import { spawn } from 'node:child_process';
+// Worker-thread body for git-runner.mjs: git children are spawned on this
+// thread, never on the host event loop (run-child.mjs). Each request resolves
+// to { code, stdout, stderr } or an error with the same codes the in-process
+// runner used (ETIMEDOUT, EMAXBUFFER, spawn errors).
+import { runChild } from './run-child.mjs';
 import { serveWorkerRequests } from './worker-requests.mjs';
 
-function runGit({ args, cwd, input, env, timeoutMs, maxBytes, stdoutEncoding = 'utf8' }) {
-  return new Promise((resolvePromise, rejectPromise) => {
-    const hasInput = (typeof input === 'string' || ArrayBuffer.isView(input)) && input.length > 0;
-    const child = spawn('git', args, {
-      cwd,
-      ...(env ? { env } : {}),
-      windowsHide: true,
-      stdio: [hasInput ? 'pipe' : 'ignore', 'pipe', 'pipe'],
-    });
-    const stdout = [];
-    const stderr = [];
-    let outputBytes = 0;
-    let stdinError = null;
-    let settled = false;
-    const finish = (error, result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      if (error) rejectPromise(error);
-      else resolvePromise(result);
-    };
-    const timer = setTimeout(() => {
-      const error = new Error(`git ${args.join(' ')} timed out after ${timeoutMs}ms`);
-      error.code = 'ETIMEDOUT';
-      try {
-        child.kill();
-      } catch {}
-      finish(error);
-    }, timeoutMs);
-    const collect = (chunks, chunk) => {
-      const next = Buffer.from(chunk);
-      outputBytes += next.length;
-      if (outputBytes > maxBytes) {
-        const error = new Error(`git ${args.join(' ')} exceeded ${maxBytes} output bytes`);
-        error.code = 'EMAXBUFFER';
-        try {
-          child.kill();
-        } catch {}
-        finish(error);
-        return;
-      }
-      chunks.push(next);
-    };
-    child.stdout.on('data', (chunk) => collect(stdout, chunk));
-    child.stderr.on('data', (chunk) => collect(stderr, chunk));
-    child.once('error', (error) => finish(error));
-    child.once('close', (code) => {
-      const result = {
-        code: Number(code ?? 1),
-        // 'base64' keeps non-UTF-8 bytes (a replayable patch) intact across the thread hop.
-        stdout: Buffer.concat(stdout).toString(stdoutEncoding === 'base64' ? 'base64' : 'utf8'),
-        stderr: Buffer.concat(stderr).toString('utf8'),
-      };
-      // A failed stdin write only matters when git otherwise reported success.
-      if (stdinError && result.code === 0) {
-        finish(stdinError);
-        return;
-      }
-      finish(null, result);
-    });
-    if (child.stdin) {
-      // A short-lived git command can close before stdin is flushed. Keep
-      // that transport race inside this promise instead of an unhandled EPIPE.
-      child.stdin.on('error', (error) => {
-        stdinError = error;
-      });
-      child.stdin.end(input);
-    }
-  });
-}
-
-serveWorkerRequests(runGit);
+serveWorkerRequests((request) => runChild({ ...request, command: 'git' }));

package/src/runtime/shared/llm/http-agent.mjs

@@ -75,8 +75,8 @@ function proxyConfigured() {
  * The shared singleton dispatcher for LLM API requests. Created on first use.
  *
  * keepAliveTimeout (~60s) keeps a socket warm across the typical idle gap
- * between agent turns; connections caps concurrent sockets per origin so a
- * burst of parallel calls can't open an unbounded number of handshakes.
+ * between agent turns; sockets per origin are unbounded unless
+ * MIXDOG_LLM_CONNECTIONS sets a cap.
  *
  * Returns `undefined` when a proxy / any custom (non-default) global dispatcher
  * is configured, so `fetch({ dispatcher: undefined })` falls back to that
@@ -93,7 +93,11 @@ export function getLlmDispatcher() {
     _agent = new (undici().Agent)({
       keepAliveTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MS', 60_000),
       keepAliveMaxTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MAX_MS', 90_000),
-      connections: envInt('MIXDOG_LLM_CONNECTIONS', 16),
+      // No per-origin socket cap by default: each streaming (SSE) response
+      // holds its HTTP/1.1 socket for the whole generation, so a cap of N
+      // queued the (N+1)th concurrent agent until another finished. Rate
+      // limiting is the server's call (429 → admission cooldown).
+      connections: envInt('MIXDOG_LLM_CONNECTIONS', null),
       // undici defaults both of these to 300s, which beheaded the Anthropic
       // NON-STREAMING stall fallback (2026-08-03 regex-chess probe:
       // UND_ERR_HEADERS_TIMEOUT at exactly 300s) — a non-streaming completion

package/src/runtime/shared/llm/provider-catalog-registry.mjs

@@ -93,7 +93,17 @@ const PROVIDER_CATALOGS = Object.freeze({
   },
   'cursor-oauth': { relay: true },
   'cursor-api': { relay: true },
+  // The models.dev listing id of the Go gateway: a relay catalog, not a
+  // selectable provider (the model lookup needs it flagged as a relay).
   'opencode-go': { relay: true },
+  // The Go gateway through an OpenCode Console login; the organization
+  // config's catalog is the live roster.
+  'opencode-go-oauth': {
+    modelsDev: 'opencode-go',
+    relay: true,
+    rosterFiles: ['opencode-go-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+  },
 });
 
 // Confirmed upstream catalog gaps, keyed provider → model. Each entry patches

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -71,6 +71,8 @@ export async function accountProviderSend(provider, instance, send, model, opts
       requestedModel: model,
       pricingModel: result.pricingModel,
       sessionId,
+      // The session this one runs for (an agent's Lead), kept with its spend.
+      ownerSessionId: opts.session?.ownerSessionId || opts.session?.parentSessionId,
       sourceType,
       inputTokens: usage.inputTokens,
       inputTokensKnown: usage.inputTokensKnown,

package/src/runtime/shared/llm/usage-ledger-import.mjs

@@ -10,6 +10,18 @@ import { createHash } from 'node:crypto';
 import { makeUsageRecord, usageRouteKind } from './usage-ledger.mjs';
 import { priceUsage } from './cost.mjs';
 
+function legacyRollupDays(parsed) {
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new SyntaxError('legacy rollup root is not an object');
+  }
+  if (!Object.hasOwn(parsed, 'days')) throw new SyntaxError('legacy rollup days is missing');
+  const { days } = parsed;
+  // A day map is an object. An array is the other accepted collection; null,
+  // strings, and other scalars are not.
+  if (days === null || typeof days !== 'object') throw new SyntaxError('legacy rollup days is not an object or array');
+  return days;
+}
+
 async function optionalFile(path) {
   try {
     return await readFile(path, 'utf8');
@@ -165,9 +177,26 @@ export async function importUsageHistory(ledger, dataDir, { now = Date.now(), re
         session_id: event.sessionId,
       }))
     );
-  const legacy = await optionalFile(join(dataDir, 'usage-rollup.local.json'));
-  if (legacy) ledger.preserveLegacyDays(repriceRestoredDays(JSON.parse(legacy).days));
-  ledger.set('importedThrough', until);
+  // A missing file is absence. Empty, unparsable, or wrong-shaped JSON is not:
+  // skip only this legacy import and leave importedThrough unset so a repair
+  // is retried instead of short-circuiting forever.
+  const legacyPath = join(dataDir, 'usage-rollup.local.json');
+  const legacy = await optionalFile(legacyPath);
+  let legacyReady = true;
+  if (legacy !== null) {
+    let days;
+    try {
+      days = legacyRollupDays(JSON.parse(legacy));
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      legacyReady = false;
+      process.stderr.write(
+        `[usage-ledger] warning: legacy rollup ${legacyPath} is empty, corrupt, or the wrong shape (${error.message}); skipping its import\n`
+      );
+    }
+    if (legacyReady) ledger.preserveLegacyDays(repriceRestoredDays(days));
+  }
+  if (legacyReady) ledger.set('importedThrough', until);
   ledger.set('importReceipt', JSON.stringify({ ...result, until }));
   return result;
 }

package/src/runtime/shared/llm/usage-ledger-rollup.mjs

@@ -292,20 +292,27 @@ function mergeLegacyDays(db, { days, hourly, hourlyDay, fromDay, toDay }) {
  * Compaction requests run under their own provider session id but are
  * recorded under the source session, so this is the whole conversation
  * across compactions. The same route choice as a rollup applies: a gateway
- * summary never doubles a detail record.
+ * summary never doubles a detail record. `ownerIds` adds every session
+ * recorded as run for one of them (a Lead's agents, theirs in turn).
  */
-export function readSessionUsage(db, sessionIds) {
+export function readSessionUsage(db, sessionIds, ownerIds = []) {
   const total = empty();
   const rows = db
     .prepare(`
-            WITH mine AS (
+            WITH RECURSIVE owned(id) AS (
+                SELECT o.session FROM usage_session_owners o JOIN usage_sessions s ON s.id=o.owner
+                WHERE s.value IN (SELECT value FROM json_each(?))
+                UNION
+                SELECT o.session FROM usage_session_owners o JOIN owned ON o.owner=owned.id
+            ), mine AS (
                 SELECT day,route,COUNT(*) AS turns,SUM(input) AS input,SUM(output) AS output,
                     SUM(cache_read) AS cache_read,SUM(cache_write) AS cache_write,
                     SUM(cost_usd) AS cost_usd,SUM(duration_ms) AS duration_ms,
                     SUM(CASE WHEN duration_ms>0 AND output>0 THEN output ELSE 0 END) AS speed_output,
                     SUM(CASE WHEN duration_ms>0 AND output>0 THEN duration_ms ELSE 0 END) AS speed_ms
                 FROM usage_events WHERE session IN (
-                    SELECT id FROM usage_sessions WHERE value IN (SELECT value FROM json_each(?)))
+                    SELECT id FROM usage_sessions WHERE value IN (SELECT value FROM json_each(?))
+                    UNION SELECT id FROM owned)
                 GROUP BY day,route
             ), attributed AS (
                 SELECT printf('%04d-%02d-%02d',m.day/10000,(m.day/100)%100,m.day%100) AS day,
@@ -320,7 +327,7 @@ export function readSessionUsage(db, sessionIds) {
             )
             SELECT a.* FROM attributed a JOIN (${best}) b USING(day,provider,model,rank)
         `)
-    .all(JSON.stringify(sessionIds), '0000-01-01', '9999-12-31');
+    .all(JSON.stringify(ownerIds), JSON.stringify(sessionIds), '0000-01-01', '9999-12-31');
   let speedOutput = 0;
   let speedMs = 0;
   for (const row of rows) {

package/src/runtime/shared/llm/usage-ledger-worker.mjs

@@ -60,7 +60,7 @@ function recordBatch(ledger, rows) {
 const operations = {
   rollup: ({ path, options }) => read(path, (db) => rollupUsage(db, options)),
   rollupDelta: ({ path, options, known, now }) => read(path, (db) => rollupDelta(db, options, known, now)),
-  sessionUsage: ({ path, sessionIds }) => read(path, (db) => readSessionUsage(db, sessionIds)),
+  sessionUsage: ({ path, sessionIds, ownerIds }) => read(path, (db) => readSessionUsage(db, sessionIds, ownerIds)),
   record: ({ path, rows }) => write(path, (ledger) => recordBatch(ledger, rows)),
   recordQuota: ({ path, samples }) => write(path, (ledger) => ledger.recordQuota(samples)),
   quotaHistory: ({ path, options }) => read(path, (db) => readQuotaHistory(db, options)),

package/src/runtime/shared/llm/usage-ledger.mjs

@@ -78,6 +78,13 @@ const COMPACT_SCHEMA = `
     -- One session's lifetime totals (the /context footer) read that session's
     -- records only instead of scanning every record ever written.
     CREATE INDEX IF NOT EXISTS usage_events_session ON usage_events(session);
+    -- The session each session ran for (an agent's Lead), so a Lead's agents
+    -- stay countable after their own session records are gone.
+    CREATE TABLE IF NOT EXISTS usage_session_owners (
+        session INTEGER PRIMARY KEY REFERENCES usage_sessions(id),
+        owner INTEGER NOT NULL REFERENCES usage_sessions(id)
+    );
+    CREATE INDEX IF NOT EXISTS usage_session_owners_owner ON usage_session_owners(owner);
 `;
 
 // Preserve the old read surface. Only storage changes: every field, including
@@ -109,6 +116,7 @@ function compactEventWriter(db) {
   const insertSession = db.prepare('INSERT OR IGNORE INTO usage_sessions(value) VALUES (?)');
   const findSession = db.prepare('SELECT id FROM usage_sessions WHERE value=?');
   const insert = db.prepare('INSERT INTO usage_events VALUES (?,?,?,?,?,?,?,?,?,?,?)');
+  const insertOwner = db.prepare('INSERT OR IGNORE INTO usage_session_owners VALUES (?,?)');
   return (row) => {
     for (const key of ['id', 'provider', 'model', 'kind', 'source_type', 'cost_source', 'origin', 'session_id']) {
       if (row[key] == null) throw new Error(`Usage requires ${key}`);
@@ -133,6 +141,11 @@ function compactEventWriter(db) {
     const route = findRoute.get(signature).id;
     insertSession.run(String(row.session_id));
     const session = findSession.get(String(row.session_id)).id;
+    const owner = row.owner_session_id ? String(row.owner_session_id) : '';
+    if (owner && owner !== String(row.session_id)) {
+      insertSession.run(owner);
+      insertOwner.run(session, findSession.get(owner).id);
+    }
     insert.run(
       id,
       row.ts,
@@ -201,7 +214,6 @@ function migrateUsageLedger(db, path) {
 
 export function usageRouteKind(provider) {
   if (provider === 'mixdog-local') return 'local';
-  if (provider === 'opencode-go') return 'quota-api';
   return provider.endsWith('-oauth') ? 'oauth' : 'api';
 }
 
@@ -273,6 +285,7 @@ export function makeUsageRecord(args) {
     model,
     kind,
     sessionId: ['no-session', '(none)'].includes(args.sessionId) ? '' : text(args.sessionId),
+    ...(args.ownerSessionId ? { ownerSessionId: text(args.ownerSessionId) } : {}),
     sourceType: text(args.sourceType),
     input: priced.input,
     output: num(args.outputTokens),
@@ -453,6 +466,7 @@ export class UsageLedger {
           !this.insert({
             ...row,
             session_id: row.sessionId,
+            owner_session_id: row.ownerSessionId,
             source_type: row.sourceType,
             cache_read: row.cacheRead,
             cache_write: row.cacheWrite,
@@ -558,10 +572,11 @@ export class UsageLedger {
     return this.workerRequest('quotaWindows', { options });
   }
 
-  /** Every request one session made under any of its ids, compactions included, read on the ledger worker. */
-  sessionUsageAsync(sessionIds) {
-    if (this.path === ':memory:') return Promise.resolve().then(() => readSessionUsage(this.db, sessionIds));
-    return this.workerRequest('sessionUsage', { sessionIds });
+  /** Every request one session made under any of its ids, compactions included, read on the ledger worker.
+   *  `ownerIds` adds every session recorded as run for them, transitively. */
+  sessionUsageAsync(sessionIds, ownerIds = []) {
+    if (this.path === ':memory:') return Promise.resolve().then(() => readSessionUsage(this.db, sessionIds, ownerIds));
+    return this.workerRequest('sessionUsage', { sessionIds, ownerIds });
   }
 
   preserveLegacyDays(days) {

package/src/runtime/shared/memory-snapshot.mjs

@@ -22,8 +22,12 @@ const PERIODIC_ATTRIBUTION_FREE_BYTES = 2 * 1024 * 1024 * 1024;
 let periodicTimer = null;
 let lastPressureSnapshotAt = 0;
 
+// Opt-in diagnostics (MIXDOG_MEMORY_SNAPSHOT=1): every sample starts a
+// PowerShell process on Windows (two for a full snapshot, requested exactly
+// when the host is under memory pressure), from every process that loads
+// this module. A normal install never pays for that.
 function enabled() {
-  return process.env.MIXDOG_MEMORY_SNAPSHOT !== '0';
+  return process.env.MIXDOG_MEMORY_SNAPSHOT === '1';
 }
 
 function snapshotPaths() {