mixdog 1.2.5 → 1.3.0

package/src/runtime/shared/file-permissions.mjs

@@ -1,11 +1,288 @@
 import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { execFile, execFileSync } from 'node:child_process';
-import { promisify } from 'node:util';
+import { dirname, join, resolve } from 'node:path';
+import { execFile, execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { MessageChannel, receiveMessageOnPort, SHARE_ENV, Worker } from 'node:worker_threads';
 
-const execFileAsync = promisify(execFile);
 let cachedUserSid = null;
 
+// Resolved per call (not promisified once at load) so the live binding of
+// child_process.execFile is used.
+function execFileAsync(file, args, options) {
+  return new Promise((done, fail) => {
+    execFile(file, args, options, (error, stdout, stderr) => {
+      if (error) fail(Object.assign(error, { stdout, stderr }));
+      else done({ stdout, stderr });
+    });
+  });
+}
+
+// Securing a published secret by spawning PowerShell costs ~150-200 ms per
+// call, and secrets are read far more often than they change. Nothing is
+// cached: every non-fresh async call still reads the file's real DACL and
+// tightens it when it is not owner-only. File metadata (mtime/ctime/size/id)
+// is never treated as evidence of permissions. To make that per-call check
+// cheap, one long-lived PowerShell helper per process answers requests over
+// stdin/stdout ("<id> <base64 path>" in, "<id> ok|fixed|err <base64 detail>"
+// out); concurrent callers share it and are matched by request id. If the
+// helper cannot start, crashes, closes its pipes or misses the request
+// deadline, every request it held (and later ones, once the restart budget is
+// spent) falls back to the spawn-per-call update, so a lost helper never
+// skips a check. A definite ACL failure reported by the helper is an error,
+// exactly like a failed per-call update.
+const ACL_HELPER_REQUEST_TIMEOUT_MS = 15_000;
+// At most this many helper starts per window. A lifetime budget let three
+// unrelated losses (a request deadline missed across a system sleep, an
+// antivirus stall) pin a days-old process to a PowerShell spawn per read.
+const ACL_HELPER_MAX_STARTS = 3;
+const ACL_HELPER_START_WINDOW_MS = 10 * 60_000;
+let aclHelper = null;
+let aclHelperStartTimes = [];
+let aclHelperSeq = 0;
+
+function aclHelperScript(sid) {
+  return [
+    "$ErrorActionPreference = 'Stop';",
+    `$sid = [System.Security.Principal.SecurityIdentifier]::new(${quoteForPowerShell(sid)});`,
+    '$full = [System.Security.AccessControl.FileSystemRights]::FullControl;',
+    '$utf8 = [System.Text.Encoding]::UTF8;',
+    '$out = [Console]::Out;',
+    'while ($null -ne ($line = [Console]::In.ReadLine())) {',
+    '$parts = $line.Split(@([char]32), 2);',
+    'if ($parts.Count -ne 2) { continue };',
+    'try {',
+    '$path = $utf8.GetString([Convert]::FromBase64String($parts[1]));',
+    '$directory = [System.IO.Directory]::Exists($path);',
+    '$current = if ($directory) { [System.IO.Directory]::GetAccessControl($path) }',
+    'else { [System.IO.File]::GetAccessControl($path) };',
+    '$rules = @($current.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]));',
+    '$ownerOnly = $current.AreAccessRulesProtected -and $rules.Count -eq 1 -and',
+    "$rules[0].AccessControlType -eq 'Allow' -and $rules[0].IdentityReference -eq $sid -and",
+    '$rules[0].FileSystemRights -eq $full;',
+    "if ($ownerOnly) { $out.WriteLine($parts[0] + ' ok') } else {",
+    '$acl = if ($directory) { [System.Security.AccessControl.DirectorySecurity]::new() }',
+    'else { [System.Security.AccessControl.FileSecurity]::new() };',
+    '$acl.SetAccessRuleProtection($true, $false);',
+    '$acl.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new(',
+    '$sid, $full, [System.Security.AccessControl.AccessControlType]::Allow));',
+    'if ($directory) { [System.IO.Directory]::SetAccessControl($path, $acl) }',
+    'else { [System.IO.File]::SetAccessControl($path, $acl) };',
+    "$out.WriteLine($parts[0] + ' fixed') }",
+    '} catch {',
+    "$out.WriteLine($parts[0] + ' err ' + [Convert]::ToBase64String($utf8.GetBytes([string]$_.Exception.Message)))",
+    '};',
+    '$out.Flush() }',
+  ].join(' ');
+}
+
+function startAclHelper(icacls, sid) {
+  const now = Date.now();
+  aclHelperStartTimes = aclHelperStartTimes.filter((at) => now - at < ACL_HELPER_START_WINDOW_MS);
+  if (aclHelperStartTimes.length >= ACL_HELPER_MAX_STARTS) return null;
+  aclHelperStartTimes.push(now);
+  const command = powerShellCommand(icacls, aclHelperScript(sid));
+  let child;
+  try {
+    // Long-lived: run from System32 so it never pins the caller's working
+    // directory (a folder a process's cwd sits in cannot be removed).
+    child = spawn(command.executable, command.args, {
+      cwd: dirname(icacls),
+      stdio: ['pipe', 'pipe', 'ignore'],
+      windowsHide: true,
+    });
+  } catch {
+    return null;
+  }
+  const helper = { child, pending: new Map(), buffer: '', dead: false };
+  helper.fail = (cause) => {
+    if (aclHelper === helper) aclHelper = null;
+    if (helper.dead) return;
+    helper.dead = true;
+    const lost = [...helper.pending.values()];
+    helper.pending.clear();
+    for (const request of lost) request.lost(cause);
+    try {
+      child.kill();
+    } catch {}
+  };
+  child.on('error', helper.fail);
+  child.on('exit', () => helper.fail(new Error('Windows ACL helper exited')));
+  child.stdin.on('error', helper.fail);
+  child.stdout.on('error', helper.fail);
+  child.stdout.on('close', () => helper.fail(new Error('Windows ACL helper closed its output')));
+  child.stdout.setEncoding('utf8');
+  child.stdout.on('data', (chunk) => {
+    helper.buffer += chunk;
+    let newline = helper.buffer.indexOf('\n');
+    while (newline >= 0) {
+      const [id, status, detail = ''] = helper.buffer.slice(0, newline).trim().split(' ');
+      helper.buffer = helper.buffer.slice(newline + 1);
+      newline = helper.buffer.indexOf('\n');
+      const request = helper.pending.get(id);
+      if (!request) continue;
+      helper.pending.delete(id);
+      syncAclHelperRef(helper);
+      request.answer(status, Buffer.from(detail, 'base64').toString('utf8'));
+    }
+  });
+  syncAclHelperRef(helper);
+  return helper;
+}
+
+// An idle helper never keeps the process alive; while a request awaits its
+// answer the helper's handles do, so the answer is delivered even when the
+// request's deadline timer is mocked or otherwise not a live handle.
+function syncAclHelperRef(helper) {
+  const method = helper.pending.size > 0 ? 'ref' : 'unref';
+  helper.child[method]();
+  helper.child.stdin[method]?.();
+  helper.child.stdout[method]?.();
+}
+
+/** Resolves `{ status, detail }` from the helper, or `{ lost }` when it could not answer. */
+function askAclHelper(targetPath, icacls, sid) {
+  if (!aclHelper) aclHelper = startAclHelper(icacls, sid);
+  const helper = aclHelper;
+  if (!helper) return Promise.resolve({ lost: new Error('Windows ACL helper unavailable') });
+  return new Promise((done) => {
+    aclHelperSeq += 1;
+    const id = String(aclHelperSeq);
+    const timer = setTimeout(() => {
+      helper.pending.delete(id);
+      syncAclHelperRef(helper);
+      done({ lost: new Error('Windows ACL helper timed out') });
+      helper.fail(new Error('Windows ACL helper timed out'));
+    }, ACL_HELPER_REQUEST_TIMEOUT_MS);
+    helper.pending.set(id, {
+      answer(status, detail) {
+        clearTimeout(timer);
+        done({ status, detail });
+      },
+      lost(cause) {
+        clearTimeout(timer);
+        done({ lost: cause });
+      },
+    });
+    syncAclHelperRef(helper);
+    helper.child.stdin.write(`${id} ${Buffer.from(targetPath, 'utf8').toString('base64')}\n`);
+  });
+}
+
+// ── Sync bridge ─────────────────────────────────────────────────────────
+// Synchronous secret writes (token stores, config) cannot await the helper,
+// and a blocking icacls spawn per write held the event loop (and the write's
+// file lock) for seconds under load. A worker thread owns a second helper;
+// a synchronous caller posts its path and blocks in Atomics.wait only for
+// the answer — milliseconds once the helper runs (prewarmOwnerOnlyAclWin32
+// starts it off the write path). Shared slots: [0] answer counter, [1] the
+// worker exited, [2] the worker is ready. A worker not ready within
+// ACL_SYNC_BRIDGE_READY_MS, or gone, sends the caller to the one-shot
+// update; an answer later than ACL_SYNC_BRIDGE_TIMEOUT_MS fails the write.
+const ACL_SYNC_BRIDGE_READY_MS = 10_000;
+// The helper's own deadline plus its one-shot fallback's, with margin.
+const ACL_SYNC_BRIDGE_TIMEOUT_MS = 2 * ACL_HELPER_REQUEST_TIMEOUT_MS + 5_000;
+let aclSyncBridge = null;
+let aclSyncBridgeBroken = false;
+
+function syncBridge() {
+  if (aclSyncBridge || aclSyncBridgeBroken) return aclSyncBridge;
+  try {
+    const url = new URL('./file-permissions-worker.mjs', import.meta.url);
+    // Bundled copies (the desktop service) ship no worker beside them.
+    if (!existsSync(fileURLToPath(url))) throw new Error('Windows ACL bridge worker is not shipped here');
+    const { port1, port2 } = new MessageChannel();
+    const signal = new Int32Array(new SharedArrayBuffer(12));
+    const worker = new Worker(url, {
+      env: SHARE_ENV,
+      execArgv: [],
+      workerData: { port: port2, signal },
+      transferList: [port2],
+    });
+    const bridge = { worker, port: port1, signal, seq: 0, startedAt: Date.now() };
+    const drop = () => {
+      if (aclSyncBridge === bridge) aclSyncBridge = null;
+    };
+    worker.on('error', drop);
+    worker.on('exit', drop);
+    worker.unref();
+    port1.unref?.();
+    aclSyncBridge = bridge;
+  } catch {
+    aclSyncBridgeBroken = true;
+  }
+  return aclSyncBridge;
+}
+
+function dropSyncBridge(bridge) {
+  if (aclSyncBridge !== bridge) return;
+  aclSyncBridge = null;
+  void bridge.worker.terminate();
+}
+
+/** `{ ok: true }`, `{ ok: false, message, code }` (a definite ACL failure),
+ *  `{ timedOut: true }`, or `{ lost }` when no bridge could answer. */
+function askSyncBridge(targetPath) {
+  const bridge = syncBridge();
+  if (!bridge) return { lost: new Error('Windows ACL bridge unavailable') };
+  bridge.seq += 1;
+  const id = bridge.seq;
+  let seen = Atomics.load(bridge.signal, 0);
+  bridge.port.postMessage({ id, path: targetPath });
+  const deadline = Date.now() + ACL_SYNC_BRIDGE_TIMEOUT_MS;
+  for (;;) {
+    for (let received = receiveMessageOnPort(bridge.port); received; received = receiveMessageOnPort(bridge.port)) {
+      if (received.message?.id === id) return received.message;
+    }
+    const now = Date.now();
+    const ready = Atomics.load(bridge.signal, 2) === 1;
+    if (Atomics.load(bridge.signal, 1) === 1 || (!ready && now - bridge.startedAt >= ACL_SYNC_BRIDGE_READY_MS)) {
+      dropSyncBridge(bridge);
+      return { lost: new Error('Windows ACL bridge exited') };
+    }
+    if (now >= deadline) return { timedOut: true };
+    const wait = ready ? deadline - now : Math.min(deadline - now, bridge.startedAt + ACL_SYNC_BRIDGE_READY_MS - now);
+    Atomics.wait(bridge.signal, 0, seen, Math.max(1, wait));
+    seen = Atomics.load(bridge.signal, 0);
+  }
+}
+
+/** Test hook: synchronous calls skip the bridge (its one-shot fallback runs). */
+export function disableOwnerOnlyAclSyncBridgeForTests() {
+  aclSyncBridgeBroken = true;
+  if (aclSyncBridge) dropSyncBridge(aclSyncBridge);
+}
+
+/** Starts, off any write path, what owner-only enforcement needs on Windows:
+ *  this thread's SID and helper, and the sync bridge with its own helper.
+ *  Best-effort; never rejects. */
+export async function prewarmOwnerOnlyAclWin32({ bridge = true } = {}) {
+  if (process.platform !== 'win32') return;
+  try {
+    const icacls = icaclsPath();
+    if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
+    if (!aclHelper) aclHelper = startAclHelper(icacls, cachedUserSid);
+    if (bridge) syncBridge()?.port.postMessage({ warm: true });
+  } catch {
+    /* enforcement itself reports any failure */
+  }
+}
+
+/** Test/diagnostic hook: whether a helper is attached, its requests awaiting
+ *  an answer, and the starts inside the current restart window. */
+export function ownerOnlyAclHelperStats() {
+  return {
+    alive: aclHelper !== null,
+    pid: aclHelper?.child.pid ?? null,
+    pending: aclHelper?.pending.size ?? 0,
+    recentStarts: aclHelperStartTimes.length,
+  };
+}
+
+/** Test hook: the live helper process, or null. */
+export function ownerOnlyAclHelperForTests() {
+  return aclHelper?.child ?? null;
+}
+
 function systemToolPath(name) {
   const systemRoot = process.env.SystemRoot || process.env.windir;
   return systemRoot ? join(systemRoot, 'System32', name) : null;
@@ -155,6 +432,18 @@ function aclFailure(targetPath, cause, label = 'icacls') {
 export function enforceOwnerOnlyAclWin32(targetPath, { fresh = false } = {}) {
   if (process.platform !== 'win32') return;
   const icacls = icaclsPath();
+  // Fresh files (the temp and lock files of every synchronous secret write,
+  // made while its file lock is held) go to the helper through the sync
+  // bridge: one round trip, no process spawned. Only a bridge that is gone
+  // falls back to the blocking one-shot update below.
+  if (fresh) {
+    const reply = askSyncBridge(resolve(targetPath));
+    if (reply.ok === true) return;
+    if (reply.ok === false) throw Object.assign(new Error(reply.message), { code: reply.code || 'EACLFAIL' });
+    if (reply.timedOut) {
+      throw aclFailure(targetPath, new Error('the Windows ACL bridge did not answer'), 'Windows ACL helper');
+    }
+  }
   if (cachedUserSid === null) cachedUserSid = resolveCurrentUserPrincipal();
   const command = ownerOnlyAclCommand(targetPath, cachedUserSid, fresh, icacls);
   try {
@@ -168,8 +457,25 @@ export function enforceOwnerOnlyAclWin32(targetPath, { fresh = false } = {}) {
   }
 }
 
+// Fresh files (unpublished temp/lock files, one or two per secret write) go
+// through the helper too: never owner-only yet, each is secured explicitly by
+// its DACL replacement. An icacls spawn per write, made inside the write's
+// file lock, kept provider-accounts.json locked for 114 s under heavy load
+// (each spawn blocked the event loop for seconds as well).
 export async function enforceOwnerOnlyAclWin32Async(targetPath, { fresh = false } = {}) {
   if (process.platform !== 'win32') return;
+  const icacls = icaclsPath();
+  if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
+  const reply = await askAclHelper(resolve(targetPath), icacls, cachedUserSid);
+  if (reply.status === 'ok' || reply.status === 'fixed') return;
+  if (reply.status === 'err') {
+    throw aclFailure(targetPath, new Error(reply.detail || 'unknown error'), 'Windows ACL helper');
+  }
+  // The helper could not answer: verify with a one-shot update instead.
+  return applyOwnerOnlyAclAsync(targetPath, fresh);
+}
+
+async function applyOwnerOnlyAclAsync(targetPath, fresh) {
   const icacls = icaclsPath();
   if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
   const command = ownerOnlyAclCommand(targetPath, cachedUserSid, fresh, icacls);

package/src/runtime/shared/git-runner-worker.mjs

@@ -1,80 +1,8 @@
-// Worker-thread body for git-runner.mjs. Starting a child process is a
-// synchronous native call (CreateProcess on Windows, amplified by on-access
-// scanning), so git children are spawned here instead of on the host event
-// loop. Each request resolves to { code, stdout, stderr } or an error with the
-// same codes the in-process runner used (ETIMEDOUT, EMAXBUFFER, spawn errors).
-import { spawn } from 'node:child_process';
+// Worker-thread body for git-runner.mjs: git children are spawned on this
+// thread, never on the host event loop (run-child.mjs). Each request resolves
+// to { code, stdout, stderr } or an error with the same codes the in-process
+// runner used (ETIMEDOUT, EMAXBUFFER, spawn errors).
+import { runChild } from './run-child.mjs';
 import { serveWorkerRequests } from './worker-requests.mjs';
 
-function runGit({ args, cwd, input, env, timeoutMs, maxBytes, stdoutEncoding = 'utf8' }) {
-  return new Promise((resolvePromise, rejectPromise) => {
-    const hasInput = (typeof input === 'string' || ArrayBuffer.isView(input)) && input.length > 0;
-    const child = spawn('git', args, {
-      cwd,
-      ...(env ? { env } : {}),
-      windowsHide: true,
-      stdio: [hasInput ? 'pipe' : 'ignore', 'pipe', 'pipe'],
-    });
-    const stdout = [];
-    const stderr = [];
-    let outputBytes = 0;
-    let stdinError = null;
-    let settled = false;
-    const finish = (error, result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      if (error) rejectPromise(error);
-      else resolvePromise(result);
-    };
-    const timer = setTimeout(() => {
-      const error = new Error(`git ${args.join(' ')} timed out after ${timeoutMs}ms`);
-      error.code = 'ETIMEDOUT';
-      try {
-        child.kill();
-      } catch {}
-      finish(error);
-    }, timeoutMs);
-    const collect = (chunks, chunk) => {
-      const next = Buffer.from(chunk);
-      outputBytes += next.length;
-      if (outputBytes > maxBytes) {
-        const error = new Error(`git ${args.join(' ')} exceeded ${maxBytes} output bytes`);
-        error.code = 'EMAXBUFFER';
-        try {
-          child.kill();
-        } catch {}
-        finish(error);
-        return;
-      }
-      chunks.push(next);
-    };
-    child.stdout.on('data', (chunk) => collect(stdout, chunk));
-    child.stderr.on('data', (chunk) => collect(stderr, chunk));
-    child.once('error', (error) => finish(error));
-    child.once('close', (code) => {
-      const result = {
-        code: Number(code ?? 1),
-        // 'base64' keeps non-UTF-8 bytes (a replayable patch) intact across the thread hop.
-        stdout: Buffer.concat(stdout).toString(stdoutEncoding === 'base64' ? 'base64' : 'utf8'),
-        stderr: Buffer.concat(stderr).toString('utf8'),
-      };
-      // A failed stdin write only matters when git otherwise reported success.
-      if (stdinError && result.code === 0) {
-        finish(stdinError);
-        return;
-      }
-      finish(null, result);
-    });
-    if (child.stdin) {
-      // A short-lived git command can close before stdin is flushed. Keep
-      // that transport race inside this promise instead of an unhandled EPIPE.
-      child.stdin.on('error', (error) => {
-        stdinError = error;
-      });
-      child.stdin.end(input);
-    }
-  });
-}
-
-serveWorkerRequests(runGit);
+serveWorkerRequests((request) => runChild({ ...request, command: 'git' }));

package/src/runtime/shared/google-oauth-client.mjs

@@ -0,0 +1,24 @@
+// Mixdog's own Google OAuth client (a "Desktop app" client, marked "Use this
+// client for an AI-powered agent"), used by the Gmail, Google Calendar and
+// Google Drive catalog connectors instead of dynamic client registration,
+// which Google does not offer. Google treats desktop clients as public: the
+// id and its non-confidential secret ship with the app, and every sign-in
+// uses PKCE (S256), state and a loopback redirect
+// (developers.google.com/identity/protocols/oauth2/native-app).
+//
+// The values come only from the environment; the source ships none, so a
+// build without them offers no built-in Google sign-in (the user's own
+// Google client still works).
+
+const value = (name) => String(process.env[name] || '').trim();
+
+/** `{ clientId, clientSecret }` of Mixdog's Google client, or null when this
+ *  build has none. */
+export function googleOAuthClient() {
+  const clientId = value('MIXDOG_GOOGLE_OAUTH_CLIENT_ID');
+  if (!clientId) return null;
+  return { clientId, clientSecret: value('MIXDOG_GOOGLE_OAUTH_CLIENT_SECRET') };
+}
+
+/** Google issues a refresh token only for `access_type=offline`. */
+export const GOOGLE_AUTH_PARAMS = Object.freeze({ access_type: 'offline' });

package/src/runtime/shared/held-request-host.d.mts

@@ -0,0 +1,12 @@
+export interface HeldRequestPushEvent {
+  sessionId: string;
+  agentId: string;
+  agentName: string;
+  requestId: string;
+}
+export function registerHeldRequestResolver(resolver: (id: string, decision: unknown) => boolean): () => void;
+export function resolveHeldRequest(id: string, decision: unknown): boolean;
+export function registerHeldRequestNotifier(notifier: (event: HeldRequestPushEvent) => void): () => void;
+export function notifyHeldRequest(event: Partial<HeldRequestPushEvent>): void;
+export function recordRunOwner(sessionId: string, agentId: string): void;
+export function runOwnerOf(sessionId: string): string;

package/src/runtime/shared/held-request-host.mjs

@@ -0,0 +1,71 @@
+// Runtime ↔ desktop-service channel for held requests of unattended runs
+// (session-runtime/held-requests.mjs). The daemon's held-request registry
+// registers the resolver; the desktop service hosted in this daemon registers
+// a notifier that sends the sanitized phone push. The session API answers a
+// held request through resolveHeldRequest, whatever session it was sent from.
+//
+// Deliberately dependency-free: the desktop service bundle imports this file
+// too, and both copies share one registry through a global symbol.
+
+const KEY = Symbol.for('mixdog.heldRequestHost.v1');
+
+function registry() {
+  globalThis[KEY] ??= { resolver: null, notifiers: [], runOwners: new Map() };
+  return globalThis[KEY];
+}
+
+const RUN_OWNER_LIMIT = 500;
+/** Remember which agent an unattended run session belongs to, so its pushes
+ *  follow that agent's notification mute after the run ends (bounded, newest kept). */
+export function recordRunOwner(sessionId, agentId) {
+  const owners = registry().runOwners;
+  owners.delete(sessionId);
+  owners.set(String(sessionId), String(agentId));
+  while (owners.size > RUN_OWNER_LIMIT) owners.delete(owners.keys().next().value);
+}
+
+export function runOwnerOf(sessionId) {
+  return registry().runOwners.get(String(sessionId || '')) || '';
+}
+
+/** `resolver(id, decision) → boolean` (true when `id` was a pending held request). */
+export function registerHeldRequestResolver(resolver) {
+  registry().resolver = resolver;
+  return () => {
+    if (registry().resolver === resolver) registry().resolver = null;
+  };
+}
+
+export function resolveHeldRequest(id, decision) {
+  const { resolver } = registry();
+  return typeof resolver === 'function' && String(id || '').startsWith('held_')
+    ? resolver(id, decision) === true
+    : false;
+}
+
+/** `notifier({ sessionId, agentId, agentName, requestId })`: one per desktop service. */
+export function registerHeldRequestNotifier(notifier) {
+  const entry = { notifier };
+  registry().notifiers.push(entry);
+  return () => {
+    const list = registry().notifiers;
+    const index = list.indexOf(entry);
+    if (index >= 0) list.splice(index, 1);
+  };
+}
+
+/** Hand one held request to every registered notifier. Carries ids and the
+ *  agent's name only: never the tool, its arguments or any text. */
+export function notifyHeldRequest({ sessionId, agentId, agentName, requestId }) {
+  const event = {
+    sessionId: String(sessionId || ''),
+    agentId: String(agentId || ''),
+    agentName: String(agentName || ''),
+    requestId: String(requestId || ''),
+  };
+  for (const { notifier } of registry().notifiers) {
+    try {
+      notifier(event);
+    } catch {}
+  }
+}

package/src/runtime/shared/llm/http-agent.mjs

@@ -75,8 +75,8 @@ function proxyConfigured() {
  * The shared singleton dispatcher for LLM API requests. Created on first use.
  *
  * keepAliveTimeout (~60s) keeps a socket warm across the typical idle gap
- * between agent turns; connections caps concurrent sockets per origin so a
- * burst of parallel calls can't open an unbounded number of handshakes.
+ * between agent turns; sockets per origin are unbounded unless
+ * MIXDOG_LLM_CONNECTIONS sets a cap.
  *
  * Returns `undefined` when a proxy / any custom (non-default) global dispatcher
  * is configured, so `fetch({ dispatcher: undefined })` falls back to that
@@ -93,7 +93,11 @@ export function getLlmDispatcher() {
     _agent = new (undici().Agent)({
       keepAliveTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MS', 60_000),
       keepAliveMaxTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MAX_MS', 90_000),
-      connections: envInt('MIXDOG_LLM_CONNECTIONS', 16),
+      // No per-origin socket cap by default: each streaming (SSE) response
+      // holds its HTTP/1.1 socket for the whole generation, so a cap of N
+      // queued the (N+1)th concurrent agent until another finished. Rate
+      // limiting is the server's call (429 → admission cooldown).
+      connections: envInt('MIXDOG_LLM_CONNECTIONS', null),
       // undici defaults both of these to 300s, which beheaded the Anthropic
       // NON-STREAMING stall fallback (2026-08-03 regex-chess probe:
       // UND_ERR_HEADERS_TIMEOUT at exactly 300s) — a non-streaming completion

package/src/runtime/shared/llm/provider-catalog-registry.mjs

@@ -93,7 +93,17 @@ const PROVIDER_CATALOGS = Object.freeze({
   },
   'cursor-oauth': { relay: true },
   'cursor-api': { relay: true },
+  // The models.dev listing id of the Go gateway: a relay catalog, not a
+  // selectable provider (the model lookup needs it flagged as a relay).
   'opencode-go': { relay: true },
+  // The Go gateway through an OpenCode Console login; the organization
+  // config's catalog is the live roster.
+  'opencode-go-oauth': {
+    modelsDev: 'opencode-go',
+    relay: true,
+    rosterFiles: ['opencode-go-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+  },
 });
 
 // Confirmed upstream catalog gaps, keyed provider → model. Each entry patches

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -71,6 +71,8 @@ export async function accountProviderSend(provider, instance, send, model, opts
       requestedModel: model,
       pricingModel: result.pricingModel,
       sessionId,
+      // The session this one runs for (an agent's Lead), kept with its spend.
+      ownerSessionId: opts.session?.ownerSessionId || opts.session?.parentSessionId,
       sourceType,
       inputTokens: usage.inputTokens,
       inputTokensKnown: usage.inputTokensKnown,

package/src/runtime/shared/llm/usage-ledger-import.mjs

@@ -10,6 +10,18 @@ import { createHash } from 'node:crypto';
 import { makeUsageRecord, usageRouteKind } from './usage-ledger.mjs';
 import { priceUsage } from './cost.mjs';
 
+function legacyRollupDays(parsed) {
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new SyntaxError('legacy rollup root is not an object');
+  }
+  if (!Object.hasOwn(parsed, 'days')) throw new SyntaxError('legacy rollup days is missing');
+  const { days } = parsed;
+  // A day map is an object. An array is the other accepted collection; null,
+  // strings, and other scalars are not.
+  if (days === null || typeof days !== 'object') throw new SyntaxError('legacy rollup days is not an object or array');
+  return days;
+}
+
 async function optionalFile(path) {
   try {
     return await readFile(path, 'utf8');
@@ -165,9 +177,26 @@ export async function importUsageHistory(ledger, dataDir, { now = Date.now(), re
         session_id: event.sessionId,
       }))
     );
-  const legacy = await optionalFile(join(dataDir, 'usage-rollup.local.json'));
-  if (legacy) ledger.preserveLegacyDays(repriceRestoredDays(JSON.parse(legacy).days));
-  ledger.set('importedThrough', until);
+  // A missing file is absence. Empty, unparsable, or wrong-shaped JSON is not:
+  // skip only this legacy import and leave importedThrough unset so a repair
+  // is retried instead of short-circuiting forever.
+  const legacyPath = join(dataDir, 'usage-rollup.local.json');
+  const legacy = await optionalFile(legacyPath);
+  let legacyReady = true;
+  if (legacy !== null) {
+    let days;
+    try {
+      days = legacyRollupDays(JSON.parse(legacy));
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      legacyReady = false;
+      process.stderr.write(
+        `[usage-ledger] warning: legacy rollup ${legacyPath} is empty, corrupt, or the wrong shape (${error.message}); skipping its import\n`
+      );
+    }
+    if (legacyReady) ledger.preserveLegacyDays(repriceRestoredDays(days));
+  }
+  if (legacyReady) ledger.set('importedThrough', until);
   ledger.set('importReceipt', JSON.stringify({ ...result, until }));
   return result;
 }