mixdog 1.3.0 → 1.3.1

package/src/runtime/shared/handoff-artifacts.mjs

@@ -0,0 +1,61 @@
+// The files a bot's or agent's turn handed back (session-runtime/
+// handoff-attachments.mjs collectTurnArtifacts) as the rows that carry them
+// show them: one model-facing line per file — the attachment id that forwards
+// it, or its path when it is too large or of a type no prompt carries — and
+// the message attachment records of the stored ones. Only those records
+// authorize forwarding by id; the lines are information for the model.
+import { escapeHarnessTags } from './shell-output-summary.mjs';
+import { normalizeMessageAttachments } from './transcript-metadata.mjs';
+
+const sizeLabel = (size) => {
+  const bytes = Number(size) || 0;
+  if (bytes >= 1_048_576) return `${(bytes / 1_048_576).toFixed(1)} MB`;
+  return bytes >= 1024 ? `${Math.round(bytes / 1024)} KB` : `${bytes} B`;
+};
+
+const oneLine = (value) => escapeHarnessTags(String(value ?? '').replace(/[\r\n]+/g, ' '));
+
+/** `files` ({ name, mimeType, size, path, id? }) normalized: bounded strings,
+ *  ids only of the attachment-store shape. */
+export function normalizeHandoffFiles(files) {
+  return (Array.isArray(files) ? files : [])
+    .filter((file) => file && typeof file === 'object' && typeof file.path === 'string' && file.path)
+    .slice(0, 8)
+    .map((file) => ({
+      name: String(file.name || 'file').slice(0, 200),
+      path: file.path.slice(0, 1024),
+      kind: ['image', 'file', 'text'].includes(file.kind) ? file.kind : 'file',
+      mimeType: String(file.mimeType || 'application/octet-stream').slice(0, 100),
+      size: Number(file.size) >= 0 ? Number(file.size) : 0,
+      ...(/^[a-f0-9]{64}$/.test(String(file.id ?? '')) ? { id: file.id } : {}),
+    }));
+}
+
+/** The model-facing list of `files`, empty when there are none. `ids`: the
+ *  row also records the stored files as its attachments (a task report), so
+ *  their ids can be forwarded; a plain-text handoff (an agent completion)
+ *  lists paths only — an id named in text is never trusted. */
+export function artifactLines(files, omitted = 0, { ids = true } = {}) {
+  const list = normalizeHandoffFiles(files);
+  if (!list.length) return [];
+  const attachable = (file) => (ids ? ` [attachment:${file.id}]` : ' (attachable: forward it by path)');
+  return [
+    `Files from this turn (forward one with attachments: [${ids ? 'id or path' : 'path'}]; link a path to show it):`,
+    ...list.map(
+      (file) =>
+        `- ${oneLine(file.name)} (${oneLine(file.mimeType)}, ${sizeLabel(file.size)}) — ${oneLine(file.path)}${
+          file.id ? attachable(file) : ' (too large or unsupported to attach; link the path)'
+        }`
+    ),
+    ...(omitted > 0 ? [`- …and ${omitted} more file(s)`] : []),
+  ];
+}
+
+/** The message attachment records of `files` (the stored ones). */
+export function artifactRecords(files) {
+  return normalizeMessageAttachments(
+    normalizeHandoffFiles(files)
+      .filter((file) => file.id)
+      .map((file) => ({ ...file, attachmentRef: file.id }))
+  );
+}

package/src/runtime/shared/llm/provider-model-identities.mjs

@@ -28,7 +28,12 @@ export const ANTIGRAVITY_MODELS = Object.freeze([
     low: 'gemini-3.1-pro-low',
     high: 'gemini-3.1-pro-high',
   }),
-  fallbackModel('gemini-4-argon', 'Gemini 4 Argon', 'gemini-pro', 1048576, 'gemini-4-argon', ['low', 'medium', 'high']),
+  // The gateway serves Argon only through per-tier ids; bare `gemini-4-argon` is a 404.
+  fallbackModel('gemini-4-argon', 'Gemini 4 Argon', 'gemini-pro', 1048576, {
+    low: 'gemini-4-argon-low',
+    medium: 'gemini-4-argon-medium',
+    high: 'gemini-4-argon-high',
+  }),
   fallbackModel('claude-opus-4-6-thinking', 'Claude Opus 4.6 (Thinking)', null, 250000, 'claude-opus-4-6-thinking', [
     'low',
     'medium',

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -63,6 +63,12 @@ export async function accountProviderSend(provider, instance, send, model, opts
     if (!ledger) return;
     recorded.add(owner);
     const usage = result.usage || UNMEASURED_USAGE;
+    const durationMs = timed ? Date.now() - startedAt : 0;
+    // The one measured request time: the loop's speed figures read it, so
+    // the composer and the ledger show the same span.
+    if (timed && result && typeof result === 'object') {
+      Object.defineProperty(result, 'usageDurationMs', { value: durationMs, configurable: true, writable: true });
+    }
     const row = makeUsageRecord({
       id: result.responseId ? undefined : id,
       ts: Date.now(),
@@ -88,7 +94,7 @@ export async function accountProviderSend(provider, instance, send, model, opts
       // The account this send is bound to, so quota history can tell one
       // connected subscription's records from another's.
       account: ACCOUNT_PROVIDERS.includes(provider) ? currentProviderAccountId(provider) : '',
-      durationMs: timed ? Date.now() - startedAt : 0,
+      durationMs,
     });
     // Committed by the ledger worker (batched with concurrent sends); the
     // send still settles only once its row is durable, as before, but the

package/src/runtime/shared/model-route-fallback.mjs

@@ -1,10 +1,84 @@
-import { providerErrorKind } from '../agent/orchestrator/providers/provider-error-kind.mjs';
+import {
+  boundedCauseChain,
+  providerErrorKind,
+  typedCodeKind,
+} from '../agent/orchestrator/providers/provider-error-kind.mjs';
 import { readStreamOutcome } from '../agent/orchestrator/providers/lib/stream-outcome.mjs';
+import { namesUnavailableModel } from './error-presentation.mjs';
 
-const ELIGIBLE = new Set(['rate_limited', 'quota_exhausted', 'overloaded', 'transient']);
+// When a route's model fails, does the next model in its fallback chain get
+// the request? Only for a refusal scoped to THIS provider, account or model —
+// another provider may serve the identical request:
+//   quota_exhausted / entitlement / billing — the plan or account is spent;
+//   rate_limited / overloaded / service_tier_unavailable — this provider is
+//     saturated once its own retries are spent;
+//   auth / permission — the provider's own sign-in refresh already failed, or
+//     the account, region or tier is refused;
+//   transient — only when the server answered (a typed status or code): its
+//     retry ladder is spent. A bare network failure would fail on every
+//     provider, so it stays with the transport recovery;
+//   invalid_request on 404/410, a typed model code, or provider wording with
+//     the model as the refused subject (namesUnavailableModel) — the model is
+//     unknown, retired or not offered to this account.
+// A request that fails the same way on any model never hops: request too
+// large, a refused tool schema or other invalid request, a policy refusal,
+// a cancel, a stall and any untyped failure. A context overflow hops only to
+// a model with a larger window (`contextGrows`); compaction runs first.
+// Whatever the kind, nothing may have been produced: no visible or buffered
+// output, no tool call started or dispatched.
+const PROVIDER_SCOPED_KINDS = new Set([
+  'quota_exhausted',
+  'entitlement',
+  'billing',
+  'rate_limited',
+  'overloaded',
+  'service_tier_unavailable',
+  'auth',
+  'permission',
+]);
+const MODEL_UNAVAILABLE_CODES = new Set(['model_not_found', 'model_not_supported']);
 
-export function canFallbackRoute(error, { signal, outcome = readStreamOutcome(error), committed = false } = {}) {
-  if (signal?.aborted || committed || outcome.userAbort || outcome.stallObserved) return false;
+/** 'hop', 'context' (a context overflow: hop only to a larger window) or 'stay'. */
+// A recovery layer may wrap the provider failure (a context overflow it could
+// not compact away): what the original request exposed lives on the cause.
+// Every node of the chain counts, so a wrapper never launders exposure.
+function chainOutcome(error) {
+  return readStreamOutcome(...(error && typeof error === 'object' ? boundedCauseChain(error) : [error]));
+}
+
+export function routeFallbackVerdict(error, { signal, outcome = chainOutcome(error), committed = false } = {}) {
+  if (signal?.aborted || committed || outcome.userAbort || outcome.stallObserved) return 'stay';
+  if (!outcome.replaySafe || outcome.observedOutput || outcome.toolCallsStarted || outcome.pendingToolInput) {
+    return 'stay';
+  }
+  const { kind, status, code } = providerErrorKind(error);
+  if (PROVIDER_SCOPED_KINDS.has(kind)) return 'hop';
+  if (kind === 'transient') return status >= 408 || typedCodeKind(error) === 'transient' ? 'hop' : 'stay';
+  if (kind === 'invalid_request') {
+    return status === 404 || status === 410 || MODEL_UNAVAILABLE_CODES.has(code) || namesUnavailableModel(error)
+      ? 'hop'
+      : 'stay';
+  }
+  return kind === 'context_overflow' ? 'context' : 'stay';
+}
+
+export function canFallbackRoute(error, { contextGrows = false, ...options } = {}) {
+  const verdict = routeFallbackVerdict(error, options);
+  return verdict === 'hop' || (verdict === 'context' && contextGrows === true);
+}
+
+const CAPACITY_KINDS = new Set(['rate_limited', 'quota_exhausted', 'overloaded', 'transient']);
+
+/**
+ * The narrower rule a stateless tool route (native web search) keeps: only a
+ * capacity refusal the server stated (429 / 503, or an account-pool quota
+ * refusal) moves to the next provider; a denied or failed credential
+ * surfaces so the user fixes that route.
+ */
+// It also keeps its stricter stream guards: any started or terminal stream
+// stays on its route, since a tool call cannot prove nothing was generated.
+export function canFallbackCapacityRoute(error, { signal, outcome = readStreamOutcome(error) } = {}) {
+  if (signal?.aborted || outcome.userAbort || outcome.stallObserved) return false;
   if (
     !outcome.replaySafe ||
     outcome.observedOutput ||
@@ -15,8 +89,6 @@ export function canFallbackRoute(error, { signal, outcome = readStreamOutcome(er
   )
     return false;
   const { kind, status } = providerErrorKind(error);
-  if (!ELIGIBLE.has(kind)) return false;
-  // A rejected HTTP request or a provider account-pool refusal proves no
-  // generation started. A transport disconnect alone does not.
+  if (!CAPACITY_KINDS.has(kind)) return false;
   return status === 429 || status === 503 || (kind === 'quota_exhausted' && error?.quotaExhausted != null);
 }

package/src/runtime/shared/plain-preview.mjs

@@ -5,23 +5,28 @@
 /** `text` without markdown syntax, whitespace folded to single spaces. */
 export function plainPreviewText(text) {
   // HTML comments never show in markdown (a greeting's suggestions ride one).
-  return String(text ?? '')
-    .replace(/<!--[\s\S]*?(?:-->|$)/g, ' ')
-    .replace(/^[ \t]*(`{3,}|~{3,})[^\n]*$/gm, ' ')
-    .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
-    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
-    .replace(/^[ \t]{0,3}#{1,6}[ \t]+/gm, '')
-    .replace(/^[ \t]*>[ \t]?/gm, '')
-    .replace(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/gm, '')
-    .replace(/^[ \t]*(?:[-*_][ \t]*){3,}$/gm, ' ')
-    .replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, '$2')
-    .replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?!\w)/g, '$1$2')
-    .replace(/(^|[^\w_])_(?=\S)([^_\n]*?\S)_(?!\w)/g, '$1$2')
-    .replace(/~~(?=\S)([\s\S]*?\S)~~/g, '$1')
-    .replace(/`+([^`\n]*)`+/g, '$1')
-    .replace(/\s+/g, ' ')
-    .trim()
-    .slice(0, PREVIEW_CAP);
+  return (
+    String(text ?? '')
+      .replace(/<!--[\s\S]*?(?:-->|$)/g, ' ')
+      .replace(/^[ \t]*(`{3,}|~{3,})[^\n]*$/gm, ' ')
+      .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
+      .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+      .replace(/^[ \t]{0,3}#{1,6}[ \t]+/gm, '')
+      .replace(/^[ \t]*>[ \t]?/gm, '')
+      .replace(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/gm, '')
+      .replace(/^[ \t]*(?:[-*_][ \t]*){3,}$/gm, ' ')
+      .replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, '$2')
+      .replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?!\w)/g, '$1$2')
+      .replace(/(^|[^\w_])_(?=\S)([^_\n]*?\S)_(?!\w)/g, '$1$2')
+      .replace(/~~(?=\S)([\s\S]*?\S)~~/g, '$1')
+      .replace(/`+([^`\n]*)`+/g, '$1')
+      .replace(/\s+/g, ' ')
+      // A summary stored before newlines were kept already folded its list: a
+      // dash or bullet right after a sentence end is a marker, not a hyphen.
+      .replace(/([.!?。…:：])\s[-*+•]\s+(?=\S)/g, '$1 ')
+      .trim()
+      .slice(0, PREVIEW_CAP)
+  );
 }
 
 /** A safety cap only: the row clamps the shown text to two lines. */

package/src/runtime/shared/sensitive-path-rules.d.mts

@@ -0,0 +1,15 @@
+export interface SensitiveScope {
+  root: string[];
+  /** Subfolders of the root that stay reachable. */
+  except: readonly string[];
+  /** Whole tree (a registered private root) or Mixdog's secret subset. */
+  whole: boolean;
+}
+export function sensitivePathSegments(path: string): string[];
+export function matchesSensitivePath(
+  path: string,
+  within?: readonly SensitiveScope[],
+  options?: { envTemplates?: boolean }
+): boolean;
+export function mixdogSensitiveScopes(extraData?: readonly string[]): SensitiveScope[];
+export function isSensitiveLocalPath(path: string, options?: { extraData?: readonly string[] }): boolean;

package/src/runtime/shared/sensitive-path-rules.mjs

@@ -0,0 +1,256 @@
+// The credential / secret file deny list, shared by every lane that hands a
+// local file to someone else: the desktop's remote (paired-device) file lanes
+// (apps/desktop/src/main/remote-sensitive-paths.ts adds its registered private
+// roots and async canonicalization) and the runtime's attachment hand-offs
+// between bots and agents (session-runtime/handoff-attachments.mjs).
+//
+// Matching is on SEGMENTS of a path, lower-cased on every platform, so a
+// denied name cannot hide behind letter case, trailing dots/spaces or an NTFS
+// stream suffix. Callers pass the canonical (realpath) form as well as the
+// lexical one, so a link cannot reach a denied place under an innocent name.
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+/** A directory with this name anywhere on the path holds credentials. `.git`
+ *  is one of them: its config carries remotes with embedded tokens and
+ *  credential helpers, and its objects hold every secret ever committed. */
+const SECRET_DIRECTORIES = new Set([
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.mozilla',
+  '.password-store',
+  '.git',
+]);
+
+/** Consecutive segments anywhere on the path that name a credential store:
+ *  CLI configs, browser profiles and OS credential stores. */
+const SECRET_SEQUENCES = [
+  // Tool credentials in the user's home.
+  ['.docker', 'config.json'],
+  ['.config', 'gcloud'],
+  ['appdata', 'roaming', 'gcloud'],
+  ['.config', 'gh'],
+  ['appdata', 'roaming', 'github cli'],
+  ['.config', 'git', 'credentials'],
+  ['.cargo', 'credentials'],
+  ['.cargo', 'credentials.toml'],
+  ['.terraform.d', 'credentials.tfrc.json'],
+  ['.claude', '.credentials.json'],
+  ['.codex', 'auth.json'],
+  ['.gemini', 'oauth_creds.json'],
+  // Browser profiles: cookies, saved logins, session tokens.
+  ['google', 'chrome', 'user data'],
+  ['microsoft', 'edge', 'user data'],
+  ['bravesoftware', 'brave-browser'],
+  ['chromium', 'user data'],
+  ['vivaldi', 'user data'],
+  ['opera software'],
+  ['mozilla', 'firefox'],
+  ['application support', 'google', 'chrome'],
+  ['application support', 'microsoft edge'],
+  ['application support', 'firefox'],
+  ['application support', 'chromium'],
+  ['application support', 'bravesoftware'],
+  ['application support', 'vivaldi'],
+  ['library', 'safari'],
+  ['library', 'cookies'],
+  ['.config', 'google-chrome'],
+  ['.config', 'chromium'],
+  ['.config', 'microsoft-edge'],
+  ['.config', 'bravesoftware'],
+  ['.config', 'vivaldi'],
+  ['snap', 'firefox'],
+  ['snap', 'chromium'],
+  ['.var', 'app', 'org.mozilla.firefox'],
+  ['.var', 'app', 'com.google.chrome'],
+  // OS credential stores.
+  ['microsoft', 'credentials'],
+  ['microsoft', 'protect'],
+  ['microsoft', 'vault'],
+  ['windows', 'system32', 'config'],
+  ['library', 'keychains'],
+  ['.local', 'share', 'keyrings'],
+  ['.local', 'share', 'kwalletd'],
+  ['etc', 'shadow'],
+  ['etc', 'gshadow'],
+  ['etc', 'ssh'],
+  ['etc', 'ssl', 'private'],
+];
+
+const KEY_EXTENSIONS = new Set([
+  '.pem',
+  '.key',
+  '.p12',
+  '.pfx',
+  '.p8',
+  '.ppk',
+  '.jks',
+  '.keystore',
+  '.kdbx',
+  '.keychain',
+  '.keychain-db',
+]);
+const CREDENTIAL_FILES = new Set([
+  '.netrc',
+  '_netrc',
+  '.npmrc',
+  '.pypirc',
+  '.git-credentials',
+  '.pgpass',
+  '.vault-token',
+  '.htpasswd',
+  '.dockercfg',
+  '.envrc',
+  '.s3cfg',
+  'kubeconfig',
+]);
+/** Environment files: every `.env*` name (`.env`, `.env.local`, `.envrc`,
+ *  `.environment`, and the `.env.example` templates too — a template is
+ *  checked in often enough with real values that no name is exempt) and
+ *  `<stage>.env`. */
+const ENV_FILE = /^(?:\.env.*|[^.]{1,64}(?:\.[^.]{1,64}){0,3}\.env)$/;
+/** The dotenv templates a person may still open on purpose from a paired
+ *  device (the desktop's remote file lanes, `envTemplates: true`); automatic
+ *  transfers between bots and agents never get this allowance. */
+const ENV_TEMPLATES = new Set(['.env.example', '.env.sample', '.env.template', '.env.dist']);
+/** Credential JSON a cloud or OAuth client writes or downloads:
+ *  `credentials.json`, `*credentials*.json`, `service-account*.json`,
+ *  `client_secret*.json`. */
+const CREDENTIAL_JSON = /^(?:.*credential.*|service[-_ ]?account.*|client[-_]?secret.*)\.json$/;
+/** OpenSSH private keys (`id_ed25519`, `id_rsa_work`, `id_ecdsa_sk`, any
+ *  `id_<type>`): no extension, so the public `.pub` half and documents named
+ *  after a key type (`id_rsa_notes.md`) are not keys. */
+const SSH_PRIVATE_KEY = /^id_[a-z0-9]{2,16}(?:[_-][^._-]{1,32}){0,3}$/;
+/** A copy an editor or tool leaves beside a file (`x.bak`, `x.old`, `x~`,
+ *  `x.1`): it holds what the original holds. */
+const BACKUP_SUFFIX = /(?:\.(?:bak|backup|old|orig|prev|save|sav|swp|swo|tmp|copy|\d{1,3})|~)$/;
+const MAX_BACKUP_SUFFIXES = 3;
+
+/** The name a backup copy was made of (`.npmrc.bak.1` → `.npmrc`). */
+function backupOriginal(name) {
+  let original = name;
+  for (let strip = 0; strip < MAX_BACKUP_SUFFIXES; strip += 1) {
+    const next = original.replace(BACKUP_SUFFIX, '');
+    if (next === original || !next) break;
+    original = next;
+  }
+  return original;
+}
+
+/** A file whose own name says it holds a secret, wherever it lives: a
+ *  credential file, a dotenv file, a key or keystore, or a backup of one. */
+function secretFileName(name, { envTemplates = false } = {}) {
+  const original = backupOriginal(name);
+  if (CREDENTIAL_FILES.has(original) || CREDENTIAL_JSON.test(original)) return true;
+  if (ENV_FILE.test(original)) return !(envTemplates && ENV_TEMPLATES.has(original));
+  const dot = original.lastIndexOf('.');
+  if (dot >= 0 && KEY_EXTENSIONS.has(original.slice(dot))) return true;
+  return SSH_PRIVATE_KEY.test(original);
+}
+
+// Mixdog's own state. Its home and data folders also hold what tools write
+// (tool results, shell output, media), which stay reachable; only the files
+// and folders that carry provider tokens, API keys, pairing and bridge secrets
+// are denied.
+const MIXDOG_SECRET_DIRECTORIES = new Set([
+  'secrets',
+  'mcp-oauth',
+  'provider-accounts',
+  'telegram',
+  'relay-data',
+  'dev-profile',
+]);
+const MIXDOG_SECRET_FILE =
+  /^\.?(mixdog-config|provider-accounts|relay-hook-device|auth\.json|[a-z0-9-]+-oauth(-credentials)?\.json|[a-z0-9-]+-bridge\.json)/;
+const MIXDOG_SECRET_EXTENSIONS = new Set(['.dpapi', '.token']);
+
+function mixdogSecret(rest) {
+  if (rest.some((segment) => MIXDOG_SECRET_DIRECTORIES.has(segment))) return true;
+  const name = rest[rest.length - 1] ?? '';
+  const dot = name.lastIndexOf('.');
+  return MIXDOG_SECRET_FILE.test(name) || MIXDOG_SECRET_EXTENSIONS.has(dot >= 0 ? name.slice(dot) : '');
+}
+
+/** The segments of a path as the rules compare them: no extended-path prefix,
+ *  no NTFS stream suffix, no trailing dots or spaces, lower case. */
+export function sensitivePathSegments(path) {
+  return String(path)
+    .replace(/^[\\/]{2}[?.][\\/]/, '')
+    .split(/[\\/]+/)
+    .map((segment) =>
+      segment
+        .split(':')[0]
+        .replace(/[. ]+$/, '')
+        .toLowerCase()
+    )
+    .filter(Boolean);
+}
+
+function hasRun(segments, run) {
+  for (let start = 0; start + run.length <= segments.length; start += 1) {
+    if (run.every((segment, offset) => segments[start + offset] === segment)) return true;
+  }
+  return false;
+}
+
+/**
+ * Whether `path` is denied under `within`: scopes `{ root: segments, except:
+ * subfolder names, whole }` — Mixdog's home and data folders (`whole: false`,
+ * only their secret subset is denied) and registered private roots (`whole:
+ * true`, everything but `except`). Pass both the lexical and canonical form.
+ * `envTemplates`: a user-initiated remote open may read the dotenv
+ * templates; nothing else gets that allowance.
+ */
+export function matchesSensitivePath(path, within = [], { envTemplates = false } = {}) {
+  const segments = sensitivePathSegments(resolve(path));
+  const name = segments[segments.length - 1] ?? '';
+  if (segments.some((segment) => SECRET_DIRECTORIES.has(segment))) return true;
+  if (secretFileName(name, { envTemplates }) || SECRET_SEQUENCES.some((run) => hasRun(segments, run))) return true;
+  const containing = within.filter(
+    ({ root }) => root.length > 0 && root.every((segment, index) => segments[index] === segment)
+  );
+  // Mixdog's home and data folders follow Mixdog's own rule even inside a
+  // registered private root: a dev or isolated profile keeps them in the app
+  // profile, and the tool output and media there stay reachable.
+  const own = containing.filter(({ whole }) => !whole);
+  if (own.length) return own.some(({ root }) => mixdogSecret(segments.slice(root.length)));
+  return containing.some(({ root, except }) => {
+    const rest = segments.slice(root.length);
+    return rest.length > 0 && !except.includes(rest[0]);
+  });
+}
+
+function realOrSelf(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    const parent = dirname(path);
+    return parent === path ? path : join(realOrSelf(parent), path.slice(parent.length).replace(/^[\\/]+/, ''));
+  }
+}
+
+/** Mixdog's home and data folders (MIXDOG_HOME / MIXDOG_DATA_DIR, plus any
+ *  extra data folder the caller names) as `matchesSensitivePath` scopes. */
+export function mixdogSensitiveScopes(extraData = []) {
+  const home = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
+  const roots = [home, process.env.MIXDOG_DATA_DIR || join(home, 'data'), ...extraData].filter(Boolean);
+  const scopes = [];
+  for (const root of roots) {
+    for (const form of new Set([resolve(root), realOrSelf(resolve(root))])) {
+      scopes.push({ root: sensitivePathSegments(form), except: [], whole: false });
+    }
+  }
+  return scopes;
+}
+
+/** Whether `path` — its own name or what its links lead to — is a
+ *  credential/secret file under the shared deny list and Mixdog's own scopes. */
+export function isSensitiveLocalPath(path, { extraData = [] } = {}) {
+  const within = mixdogSensitiveScopes(extraData);
+  const absolute = resolve(path);
+  return matchesSensitivePath(absolute, within) || matchesSensitivePath(realOrSelf(absolute), within);
+}

package/src/runtime/shared/usage-readout-totals.mjs

@@ -6,13 +6,15 @@
 // - cache hit = cacheRead / (input + cacheRead + cacheWrite) over every call
 //   whose prompt was measured. A call that could not measure its prompt
 //   (promptKnown === false) has unknown zeros, so it adds nothing.
-// - speed = output tokens over generation ms (first visible token → end of the
-//   response) of the calls long enough to time. A reply too short says nothing
-//   about the model's speed, so each call is held to the floors below BEFORE it
-//   is summed.
+// - speed = output tokens over request ms (provider request start → end of the
+//   response, the wait for the first token included: the same wall time as the
+//   usage ledger's `duration_ms`) of every call with positive output and
+//   positive duration: the same eligibility as the usage ledger and the usage
+//   dialog, so the readout and the dialog agree. Records saved before this
+//   definition carry `speedOutputTokens` / `speedMs` (first visible token →
+//   end); they are kept as they are and read only while no request-timed call
+//   has landed.
 // - total tokens = input + cacheRead + cacheWrite + output, from the same sums.
-export const MIN_SPEED_OUTPUT_TOKENS = 20;
-export const MIN_SPEED_MS = 500;
 
 function num(value) {
   const n = Number(value);
@@ -21,16 +23,16 @@ function num(value) {
 
 /** The zeroed totals record. */
 export function emptyUsageReadout() {
-  return { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, speedOutputTokens: 0, speedMs: 0 };
+  return { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, requestOutputTokens: 0, requestMs: 0 };
 }
 
 /**
- * Fold one `onUsageDelta` event (and the call's generation ms, 0 when it was
+ * Fold one `onUsageDelta` event (and the call's request ms, 0 when it was
  * not timed) into the totals; returns a new record, never mutates `totals`.
  * Providers differ on whether input counts cache; the prompt total does not,
  * so fresh input is the prompt less its cache read/write.
  */
-export function foldUsageReadout(totals, delta = {}, generationMs = 0) {
+export function foldUsageReadout(totals, delta = {}, requestMs = 0) {
   const base = totals || emptyUsageReadout();
   const next = { ...base };
   if (delta.promptKnown !== false) {
@@ -47,10 +49,10 @@ export function foldUsageReadout(totals, delta = {}, generationMs = 0) {
   // partial one would pass for the whole: it stays without until the session
   // starts over.
   if (Number.isFinite(base.output)) next.output = base.output + output;
-  const ms = num(generationMs);
-  if (ms >= MIN_SPEED_MS && output >= MIN_SPEED_OUTPUT_TOKENS) {
-    next.speedOutputTokens = num(base.speedOutputTokens) + output;
-    next.speedMs = num(base.speedMs) + ms;
+  const ms = num(requestMs);
+  if (ms > 0 && output > 0) {
+    next.requestOutputTokens = num(base.requestOutputTokens) + output;
+    next.requestMs = num(base.requestMs) + ms;
   }
   return next;
 }

package/src/runtime/shared/user-data-guard.mjs

@@ -452,7 +452,10 @@ function finishBackup(dataDir, backupDir, reason) {
   legacyEvidenceCache.delete(normalizeDataDir(dataDir));
 }
 
-export function backupUserData(dataDir, reason = 'snapshot') {
+/** `dirs`: more data-dir folders this one snapshot also carries (a one-time
+ *  migration's, e.g. agents/ and bots/); routine snapshots keep to
+ *  USER_DATA_DIRS so the ring stays small. */
+export function backupUserData(dataDir, reason = 'snapshot', { dirs = [] } = {}) {
   if (skipBackups()) return { dir: null, copied: [] };
   if (!dataDir || !existsSync(dataDir)) return { dir: null, copied: [] };
   const scopeDir = scopeDirFor(dataDir);
@@ -462,7 +465,7 @@ export function backupUserData(dataDir, reason = 'snapshot') {
     const src = join(dataDir, rel);
     if (existsSync(src)) copyTree(src, join(backupDir, rel), copied);
   }
-  for (const rel of USER_DATA_DIRS) {
+  for (const rel of [...USER_DATA_DIRS, ...dirs]) {
     const src = join(dataDir, rel);
     if (existsSync(src)) copyTree(src, join(backupDir, rel), copied);
   }