mixdog 1.3.0 → 1.3.2

package/src/runtime/channels/lib/voice-runtime-fetcher.mjs

@@ -43,7 +43,8 @@ import { fileURLToPath } from 'node:url';
 import { pipeline } from 'node:stream/promises';
 import { spawnSync } from 'node:child_process';
 import { createGunzip } from 'node:zlib';
-import { renameWithRetrySync, writeFileAtomicSync } from '../../shared/atomic-file.mjs';
+import { renameWithRetrySync, writeFileAtomicSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
+import { fileHasData } from '../../shared/file-has-data.mjs';
 import { streamResponseToFile } from '../../shared/bounded-download.mjs';
 import { platformEntryKey, sha256File, verifySha256File } from '../../shared/native-asset.mjs';
 import { windowsProgramRoots, windowsSystemRoot } from '../../agent/orchestrator/tools/builtin/windows-roots.mjs';
@@ -264,7 +265,7 @@ async function loadManifest(dataDir) {
   if (!res.ok) throw new Error(`[voice-runtime] manifest fetch failed: ${res.status} ${res.statusText}`);
   const manifest = await res.json();
   mkdirSync(join(dataDir, 'voice-runtime'), { recursive: true });
-  writeFileSync(cachedPath, JSON.stringify(manifest, null, 2));
+  writeJsonAtomicSync(cachedPath, manifest);
   return manifest;
 }
 
@@ -439,7 +440,7 @@ function gcPublishedRuntimeSiblings(rootDir, prefix) {
 }
 
 async function extractGz(gzPath, destPath) {
-  await pipeline(createReadStream(gzPath), createGunzip(), createWriteStream(destPath));
+  await pipeline(createReadStream(gzPath), createGunzip(), createWriteStream(destPath, { flush: true }));
 }
 
 // Sweep .staging-* partials left by killed/crashed install attempts.
@@ -541,13 +542,13 @@ export async function ensureWhisperRuntime(dataDir, onProgress = null) {
   const activeDir = join(rootDir, activeName);
   const whisperCmd = join(activeDir, variant.executable);
 
-  if (existsSync(whisperCmd)) {
+  if (fileHasData(whisperCmd)) {
     gcStaleVersions(rootDir, activeName, 'whisper-');
     return { whisperCmd, version: ver, variantId: variant.id };
   }
 
   return _withInstallLock(rootDir, 'install', async () => {
-    if (existsSync(whisperCmd)) {
+    if (fileHasData(whisperCmd)) {
       gcStaleVersions(rootDir, activeName, 'whisper-');
       return { whisperCmd, version: ver, variantId: variant.id };
     }
@@ -641,14 +642,14 @@ function resolveManagedWhisperCmd(dataDir) {
         const variant = variants.find((v) => v.id === variantId);
         if (variant?.executable) {
           const p = join(activeDir, variant.executable);
-          if (existsSync(p)) return p;
+          if (fileHasData(p)) return p;
         }
       }
     } catch {}
   }
   for (const c of ['Release/whisper-cli.exe', 'Release/whisper-cli']) {
     const p = join(activeDir, c);
-    if (existsSync(p)) return p;
+    if (fileHasData(p)) return p;
   }
   return null;
 }
@@ -659,7 +660,7 @@ function resolveManagedWhisperModelById(dataDir, modelId = 'standard') {
   if (!entry?.filename) return null;
   const modelDir = join(dataDir, 'voice', 'models');
   const p = join(modelDir, entry.filename);
-  return existsSync(p) ? p : null;
+  return fileHasData(p) ? p : null;
 }
 
 // Clean-install policy: the models dir holds ONLY filenames declared by the
@@ -712,13 +713,13 @@ export async function ensureFfmpegRuntime(dataDir, onProgress = null) {
   const activeDir = join(rootDir, activeName);
   const ffmpegPath = join(activeDir, platformEntry.executable);
 
-  if (existsSync(ffmpegPath)) {
+  if (fileHasData(ffmpegPath)) {
     gcStaleVersions(rootDir, activeName, 'ffmpeg-');
     return { ffmpegPath, version: ver };
   }
 
   return _withInstallLock(rootDir, 'install', async () => {
-    if (existsSync(ffmpegPath)) {
+    if (fileHasData(ffmpegPath)) {
       gcStaleVersions(rootDir, activeName, 'ffmpeg-');
       return { ffmpegPath, version: ver };
     }
@@ -783,13 +784,13 @@ function resolveManagedFfmpegPath(dataDir) {
       const platformEntry = manifest.ffmpeg?.platforms?.[key];
       if (platformEntry?.executable) {
         const p = join(activeDir, platformEntry.executable);
-        if (existsSync(p)) return p;
+        if (fileHasData(p)) return p;
       }
     } catch {}
   }
   for (const c of ['ffmpeg.exe', 'ffmpeg']) {
     const p = join(activeDir, c);
-    if (existsSync(p)) return p;
+    if (fileHasData(p)) return p;
   }
   return null;
 }
@@ -835,7 +836,7 @@ export function resolveVoiceRuntime(dataDir, { modelId = 'standard', cleanup = t
   const managedFfmpegPath = resolveManagedFfmpegPath(dataDir);
   const ext = process.platform === 'win32' ? '.exe' : '';
   const managedServerCmd = managedWhisperCmd ? join(dirname(managedWhisperCmd), `whisper-server${ext}`) : null;
-  const serverCmd = managedServerCmd && existsSync(managedServerCmd) ? managedServerCmd : null;
+  const serverCmd = managedServerCmd && fileHasData(managedServerCmd) ? managedServerCmd : null;
   return {
     kind: 'managed-whisper.cpp',
     label: 'whisper.cpp',

package/src/runtime/channels/lib/webhook/relay-tunnel.mjs

@@ -8,8 +8,9 @@
 // verification stays local — the relay never inspects payloads. Works out
 // of the box: no binary, no authtoken, no reserved domain.
 import { randomBytes, randomUUID } from 'node:crypto';
-import { readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { readFileSync, chmodSync } from 'node:fs';
 import { join } from 'node:path';
+import { readJsonStateSync, writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { DATA_DIR } from '../config.mjs';
 import { logWebhook } from './log.mjs';
 import { MAX_HOOK_FRAME_BYTES, MAX_HOOK_HEADER_BYTES, MAX_TUNNEL_BODY_BYTES } from './relay-tunnel/limits.mjs';
@@ -55,19 +56,28 @@ function hookIdentityPath() {
   return join(DATA_DIR, 'relay-hook-device.json');
 }
 
+function validHookIdentity(parsed) {
+  if (
+    typeof parsed?.deviceId !== 'string' ||
+    !/^[0-9a-f-]{8,64}$/.test(parsed.deviceId) ||
+    typeof parsed.deviceSecret !== 'string' ||
+    parsed.deviceSecret.length < 16
+  ) {
+    throw new Error('invalid hook tunnel identity');
+  }
+  return { deviceId: parsed.deviceId, deviceSecret: parsed.deviceSecret };
+}
+
 // Stable per-install identity (trust-on-first-use at the relay, mirroring
 // the desktop leg). The secret never leaves this machine except toward the
 // relay; the deviceId doubles as the public URL path segment.
 function loadOrCreateHookIdentity() {
   const path = hookIdentityPath();
   try {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
-    if (
-      typeof parsed.deviceId === 'string' &&
-      /^[0-9a-f-]{8,64}$/.test(parsed.deviceId) &&
-      typeof parsed.deviceSecret === 'string' &&
-      parsed.deviceSecret.length >= 16
-    ) {
+    // A damaged identity (empty, NUL-filled, malformed) is kept aside and the
+    // last good copy restored; only when there is none is a new identity made.
+    const stored = readJsonStateSync(path, { validate: validHookIdentity, secret: true, fallback: null });
+    if (stored) {
       // The secret authenticates the webhook tunnel leg (whoever holds it can
       // take over inbound deliveries), so clamp legacy world-readable files.
       try {
@@ -75,20 +85,14 @@ function loadOrCreateHookIdentity() {
       } catch {
         /* windows/fs quirk */
       }
-      return { deviceId: parsed.deviceId, deviceSecret: parsed.deviceSecret };
+      return stored;
     }
-  } catch {
-    /* first run */
+  } catch (err) {
+    logWebhook(`hook tunnel: identity read failed — ${err?.message || err}`);
   }
   const identity = { deviceId: randomUUID(), deviceSecret: randomBytes(24).toString('hex') };
   try {
-    mkdirSync(DATA_DIR, { recursive: true });
-    writeFileSync(path, JSON.stringify(identity, null, 2), { encoding: 'utf8', mode: 0o600 });
-    try {
-      chmodSync(path, 0o600);
-    } catch {
-      /* windows/fs quirk */
-    }
+    writeJsonAtomicSync(path, identity, { secret: true, backup: true });
   } catch (err) {
     logWebhook(`hook tunnel: identity persist failed — ${err?.message || err}`);
   }

package/src/runtime/channels/lib/webhook/session-dispatch.mjs

@@ -2,8 +2,6 @@ import { logWebhook } from './log.mjs';
 import { recordEndpointEvent, updateDeliveryStatus } from '../webhooks-db.mjs';
 import { UNTRUSTED_MARKER, scrubFenceMarker } from './untrusted-fence.mjs';
 
-const DISPATCH_TIMEOUT_MS = 10 * 60 * 1000;
-
 /** The headers a run's prompt shows (and a stored event keeps). */
 function promptHeaders(headers) {
   return Object.fromEntries(Object.entries(headers || {}).filter(([k]) => k.startsWith('x-') || k === 'content-type'));
@@ -47,33 +45,16 @@ function webhookEventSummary(headers, body) {
   return [type, field(body?.action)].filter(Boolean).join(' · ').slice(0, 120);
 }
 
-function trackDispatch({ name, deliveryId, dispatchP, controller }) {
+function trackDispatch({ name, deliveryId, dispatchP, updateDeliveryStatus }) {
   let settled = false;
-  const timeoutHandle = setTimeout(
-    () => controller.abort(new Error(`bridge dispatch timed out after ${DISPATCH_TIMEOUT_MS}ms`)),
-    DISPATCH_TIMEOUT_MS
-  );
   const finish = (status, fields, message) => {
     if (settled) return;
     settled = true;
-    clearTimeout(timeoutHandle);
     void updateDeliveryStatus(name, deliveryId, status, fields).catch((e) =>
       logWebhook(`${name}: delivery status update failed: ${e?.message || e}`)
     );
     logWebhook(message);
   };
-  controller.signal.addEventListener(
-    'abort',
-    () => {
-      const reason = controller.signal.reason;
-      finish(
-        'failed',
-        { error: String(reason?.message || reason) },
-        `${name}: webhook session run aborted: ${reason?.message || reason}`
-      );
-    },
-    { once: true }
-  );
   dispatchP.then(
     (run) =>
       run?.skipped
@@ -88,23 +69,20 @@ function trackDispatch({ name, deliveryId, dispatchP, controller }) {
   );
 }
 
-function createWebhookSessionDispatcher({ getBridgeDispatch }) {
+// `store` is the delivery record (injectable for tests).
+function createWebhookSessionDispatcher({ getBridgeDispatch, store = { recordEndpointEvent, updateDeliveryStatus } }) {
+  const { recordEndpointEvent: recordEvent, updateDeliveryStatus: setStatus } = store;
   async function dispatchSessionRun(name, fullPrompt, deliveryId, res, extra = {}) {
-    await updateDeliveryStatus(name, deliveryId, 'processing');
-    // Session dispatch must not be allowed to hang forever — without a
-    // ceiling a stuck LLM call leaves the delivery in `processing`
-    // for the lifetime of the process and dedup keeps re-running
-    // forever. 10 minutes covers the slowest handler run we ship.
-    // Racing a bare timer against the dispatch promise reported failure while
-    // the run itself kept going: the delivery row was already `failed` when the
-    // late result arrived and flipped it again. The timeout now aborts the
-    // dispatch through a signal the dispatcher receives, and the first outcome
-    // to land is the only one that writes a terminal status.
-    const controller = new AbortController();
+    await setStatus(name, deliveryId, 'processing');
+    // The HTTP caller is answered 202 at once; the run is a turn in the bot's
+    // chat and has no deadline (a run may wait on the user's approval for as
+    // long as it takes), so nothing here cancels it. The delivery stays
+    // `processing` until the run ends, then `done` / `skipped` / `failed`; a
+    // second delivery meanwhile is skipped by the run's own overlap rule.
     const dispatchP = Promise.resolve(
       getBridgeDispatch()({
         prompt: fullPrompt,
-        signal: controller.signal,
+        signal: null,
         // The endpoint's project folder, named to the bot in the turn.
         cwd: extra.cwd || null,
         attachments: extra.attachments || null,
@@ -123,7 +101,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch }) {
         },
       })
     );
-    trackDispatch({ name, deliveryId, dispatchP, controller });
+    trackDispatch({ name, deliveryId, dispatchP, updateDeliveryStatus: setStatus });
     res.writeHead(202, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ status: 'accepted', handler: 'session', id: deliveryId }));
   }
@@ -135,7 +113,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch }) {
       if (!getBridgeDispatch()) throw new Error(`[webhook] session dispatch requires bridgeDispatch`);
       // Kept for the app's "Run now", which re-runs the latest event. Losing
       // the record never blocks the delivery itself.
-      await recordEndpointEvent(name, { body, headers: promptHeaders(headers) }).catch((e) =>
+      await recordEvent(name, { body, headers: promptHeaders(headers) }).catch((e) =>
         logWebhook(`${name}: event record failed: ${e?.message || e}`)
       );
       await dispatchSessionRun(name, run.prompt, deliveryId, res, {
@@ -148,7 +126,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch }) {
       });
       return true;
     } catch (err) {
-      await updateDeliveryStatus(name, deliveryId, 'failed', { error: String(err?.message || err) });
+      await setStatus(name, deliveryId, 'failed', { error: String(err?.message || err) });
       logWebhook(`${name}: folder handler error: ${err}`);
       return false;
     }

package/src/runtime/channels/lib/worker-main.mjs

@@ -10,6 +10,7 @@ import { Scheduler } from './scheduler.mjs';
 import { hasPending as dispatchHasPending } from '../../agent/orchestrator/dispatch-persist.mjs';
 import { stripSoftWarns } from '../../agent/orchestrator/tool-loop-guard.mjs';
 import { JsonStateFile } from './state-file.mjs';
+import { writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
 import {
   makeInstanceId,
   getStatusPath,
@@ -115,7 +116,7 @@ function writeBridgeState(active) {
   try {
     const stateFile = path.join(ensurePrivateRuntimeRoot(resolveRuntimeRoot()), 'bridge-state.json');
     fs.mkdirSync(path.dirname(stateFile), { recursive: true });
-    fs.writeFileSync(stateFile, JSON.stringify({ active, ts: Date.now() }));
+    writeJsonAtomicSync(stateFile, { active, ts: Date.now() }, { compact: true });
   } catch {}
 }
 function isChannelBridgeActive() {
@@ -225,7 +226,7 @@ function wireWebhookHandlers() {
       cwd: cwd || null,
       attachments: attachments || null,
       event: context?.event || '',
-      // Dispatch-timeout cancellation only works if the signal reaches the run.
+      // The dispatch has no deadline; a caller-supplied signal still reaches the run.
       signal: signal || null,
       prompt,
       skillSelection,

package/src/runtime/effort-judge/compact-tokenizer.mjs

@@ -7,8 +7,9 @@
 // arrays (~30 MB). The compact form is built once from tokenizer.json and
 // cached next to it as tokenizer.bin, keyed by the source file's size and
 // modification time.
-import { readFileSync, statSync, writeFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { writeFileAtomicSync } from '../shared/atomic-file.mjs';
 
 const MAGIC = 0x4d585442; // "MXTB"
 const VERSION = 3;
@@ -93,6 +94,9 @@ function readCached(dir) {
     const h = new Int32Array(buf.buffer, buf.byteOffset, 7);
     const [size, mtime] = sourceStamp(dir);
     if (h[0] !== MAGIC || h[1] !== VERSION || h[2] !== size || h[3] !== mtime % 2 ** 31) return null;
+    // header (28) + byte table (1024) + char pairs + merges + meta; a shorter
+    // file is torn and is rebuilt.
+    if (buf.length < 1052 + h[4] * 8 + h[5] * 12 + h[6]) return null;
     return buf;
   } catch {
     return null;
@@ -104,7 +108,9 @@ export function loadCompactTokenizer(dir) {
   let buf = readCached(dir);
   if (!buf) {
     buf = build(dir);
-    writeFileSync(join(dir, 'tokenizer.bin'), buf);
+    // Atomic: a torn cache (valid header, short body) would pass readCached's
+    // header check and then fail on every load.
+    writeFileAtomicSync(join(dir, 'tokenizer.bin'), buf);
   }
   // Copy into an aligned buffer so typed-array views are valid.
   const ab = new ArrayBuffer(buf.length);

package/src/runtime/effort-judge/judge-client.mjs

@@ -8,11 +8,12 @@
 // effort. Decisions are logged locally (lengths and probabilities only, never
 // the request text).
 import { Worker } from 'node:worker_threads';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
+import { appendFileSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { resolvePluginData } from '../shared/plugin-paths.mjs';
 import { onnxRuntimeSupported } from '../shared/onnx-runtime-support.mjs';
+import { fileHasData } from '../shared/file-has-data.mjs';
 import { effortJudgeInstallCurrent, effortJudgeInstallStamped, installEffortJudgeModel } from './model-install.mjs';
 
 export const EFFORT_JUDGE_UNSUPPORTED = 'Auto effort is unsupported on darwin-x64 (no onnxruntime-node binding)';
@@ -86,7 +87,9 @@ export function effortJudgeModelDir() {
 // it is. Unstamped leftovers (hand-copied packs) never load.
 export function effortJudgeAvailable(dir = effortJudgeModelDir()) {
   if (!onnxRuntimeSupported()) return false;
-  if (!MODEL_FILES.every((file) => existsSync(join(dir, file)))) return false;
+  // A model file a crash left empty or NUL-filled is not installed: the refresh
+  // then re-verifies the folder against the manifest hashes and fetches it again.
+  if (!MODEL_FILES.every((file) => fileHasData(join(dir, file)))) return false;
   return Boolean(process.env.MIXDOG_EFFORT_JUDGE_DIR) || effortJudgeInstallStamped(dir);
 }
 
@@ -267,7 +270,7 @@ export function effortJudgeInfo(dir = effortJudgeModelDir()) {
     /* not installed */
   }
   // The installed model names its backbone in calibration.json; older packs predate the field.
-  let backbone = 'mmBERT-small';
+  let backbone = 'EmbeddingGemma 2 (18 layers)';
   try {
     backbone = JSON.parse(readFileSync(join(dir, 'calibration.json'), 'utf8')).backbone || backbone;
   } catch {

package/src/runtime/effort-judge/model-install.mjs

@@ -4,9 +4,10 @@
 // download never replaces a working file. Files that already match are kept.
 // install.json records the installed release; a newer bundled manifest makes
 // the install stale and the next refresh downloads only what changed.
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { parseJsonText, writeJsonAtomicSync } from '../shared/atomic-file.mjs';
 import { downloadToFileWithRetry } from '../shared/bounded-download.mjs';
 import { sha256File, validSha256 } from '../shared/native-asset.mjs';
 
@@ -30,18 +31,25 @@ export function effortJudgeManifest() {
   return manifest;
 }
 
+// Release named by the stamp; '' when it is missing or damaged (empty,
+// NUL-filled), so a damaged stamp reads as not installed and the next refresh
+// re-verifies every file against its sha256 and stamps again.
+function stampedRelease(dir) {
+  try {
+    return String(parseJsonText(readFileSync(join(dir, STAMP), 'utf8')).release || '');
+  } catch {
+    return '';
+  }
+}
+
 /** True when `dir` holds a complete install of some release (stamped). */
 export function effortJudgeInstallStamped(dir) {
-  return existsSync(join(dir, STAMP));
+  return stampedRelease(dir) !== '';
 }
 
 /** True when `dir` holds the release the manifest names. */
 export function effortJudgeInstallCurrent(dir, manifest = effortJudgeManifest()) {
-  try {
-    return JSON.parse(readFileSync(join(dir, STAMP), 'utf8')).release === manifest.release;
-  } catch {
-    return false;
-  }
+  return stampedRelease(dir) === manifest.release;
 }
 
 /** Download what is missing or different, then stamp the release. */
@@ -76,5 +84,5 @@ export async function installEffortJudgeModel(
     }
   }
   if (replaced) for (const name of DERIVED) rmSync(join(dir, name), { force: true });
-  writeFileSync(join(dir, STAMP), `${JSON.stringify({ release: manifest.release })}\n`);
+  writeJsonAtomicSync(join(dir, STAMP), { release: manifest.release }, { compact: true });
 }

package/src/runtime/effort-judge/model-manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release": "effort-judge-v6",
+  "release": "effort-judge-v7",
   "files": {
     "model.onnx": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v6/model.onnx",
-      "sha256": "5abed811aaa44690f8d6292472aa8d930abae49f73a99265bb7fe874044df395",
+      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v7/model.onnx",
+      "sha256": "d01ceb1685e123335d2b70809e7b53fcc07ffb110b9412b408bc6b09a5394288",
       "size": 153062716
     },
     "tokenizer.json": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v6/tokenizer.json",
+      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v7/tokenizer.json",
       "sha256": "22c064aaa468855d6211fe5c2ec8fdec595c97c55eb2ffd3b9fdf71a93b16292",
       "size": 32170665
     },
     "calibration.json": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v6/calibration.json",
-      "sha256": "cc52c28b19fa891cca8913c69871235d5f863bd224d9336ada7d0f8cfb0765f6",
-      "size": 157
+      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v7/calibration.json",
+      "sha256": "01fe4cc99972bcca15e6ce8384cabf83c5705117e33da9a87541dc0f3d60a035",
+      "size": 223
     }
   }
 }

package/src/runtime/local-provider/asset-installer.mjs

@@ -4,6 +4,7 @@ import { dirname, join } from 'node:path';
 import { Readable, Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 
+import { fileHasData } from '../shared/file-has-data.mjs';
 import { sha256File } from '../shared/native-asset.mjs';
 import { resolvePluginData } from '../shared/plugin-paths.mjs';
 import {
@@ -125,9 +126,14 @@ export async function downloadVerifiedLocalAsset(
       callback(null, chunk);
     },
   });
-  await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(partial, { flags: resumed ? 'a' : 'w' }), {
-    signal: operationSignal,
-  });
+  await pipeline(
+    Readable.fromWeb(response.body),
+    meter,
+    createWriteStream(partial, { flags: resumed ? 'a' : 'w', flush: true }),
+    {
+      signal: operationSignal,
+    }
+  );
   if (total !== asset.size) {
     throw new Error(`[local-provider] incomplete download for ${asset.name || destination}: ${total}/${asset.size}`);
   }
@@ -198,7 +204,7 @@ async function installRuntimeInternal({ dataDir, onProgress, fetchFn, signal })
   }
   const target = localProviderRuntimeDirectory(dataDir);
   const executable = join(target, entry.executable);
-  if (existsSync(executable)) return localProviderCatalogStatus({ dataDir, hardware });
+  if (fileHasData(executable)) return localProviderCatalogStatus({ dataDir, hardware });
   ensureDiskSpace(localProviderRuntimeRoot(dataDir), entry.downloadBytes);
   const staging = join(localProviderRuntimeRoot(dataDir), `.staging-${process.pid}`);
   const downloads = join(localProviderRuntimeRoot(dataDir), '.downloads');

package/src/runtime/local-provider/catalog.mjs

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { fileHasData } from '../shared/file-has-data.mjs';
 import { resolvePluginData } from '../shared/plugin-paths.mjs';
 import { localProviderDiskStatus, partialAssetBytes } from './asset-storage.mjs';
 import { localProviderHardwareStatus, localProviderPlatformKey } from './hardware.mjs';
@@ -54,7 +55,9 @@ export function localProviderModelPath(entry, dataDir = resolvePluginData()) {
 export function exactLocalProviderFile(path, size) {
   try {
     const stat = statSync(path);
-    return stat.isFile() && stat.size === size;
+    // A crash can commit the size of a renamed download without its bytes: a
+    // file whose head is all NUL is not installed (it is fetched again).
+    return stat.isFile() && stat.size === size && fileHasData(path);
   } catch {
     return false;
   }
@@ -108,7 +111,7 @@ export function localProviderCatalogStatus({
     platformSupported: Boolean(platformEntry),
     available: Boolean(platformEntry && hardware?.supported && models.some((entry) => entry.compatible)),
     runtime: {
-      installed: Boolean(executable && existsSync(executable)),
+      installed: Boolean(executable && fileHasData(executable)),
       version: LOCAL_PROVIDER_MANIFEST.runtime.version,
       downloadBytes: platformEntry?.downloadBytes || 0,
       source: LOCAL_PROVIDER_MANIFEST.runtime.source,

package/src/runtime/local-provider/registered-models.mjs

@@ -1,7 +1,7 @@
-import { existsSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { resolvePluginData } from '../shared/plugin-paths.mjs';
-import { writeJsonAtomicSync } from '../shared/atomic-file.mjs';
+import { readJsonStateSync, unsupportedState, updateJsonAtomicSync } from '../shared/atomic-file.mjs';
 
 const MAX_REGISTRY_BYTES = 1024 * 1024;
 const cache = new Map();
@@ -42,44 +42,81 @@ function validateModel(entry) {
   return entry;
 }
 
-export function registeredLocalModels(dataDir = resolvePluginData()) {
-  const path = registryPath(dataDir);
-  if (!existsSync(path)) return [];
-  const stat = statSync(path);
-  if (stat.size > MAX_REGISTRY_BYTES) throw new Error('[local-provider] registered model index is too large');
-  const stamp = `${stat.mtimeMs}:${stat.size}`;
-  if (cache.get(path)?.stamp === stamp) return cache.get(path).models.map((entry) => ({ ...entry }));
-  const value = JSON.parse(readFileSync(path, 'utf8'));
+// Each candidate (the index or its backup) is bounded by its own bytes.
+function registryText(content) {
+  if (content.length > MAX_REGISTRY_BYTES) throw new Error('[local-provider] registered model index is too large');
+  return content.toString('utf8');
+}
+
+function parseRegistry(value) {
+  // A newer build's index is left in place (reads as no models), not discarded.
+  if (Number.isSafeInteger(value?.schema) && value.schema > 1) {
+    throw unsupportedState(`[local-provider] registered model index schema ${value.schema} is newer than this build`);
+  }
   if (value?.schema !== 1 || !Array.isArray(value.models) || value.models.length > 256) {
     throw new Error('[local-provider] invalid registered model index');
   }
   const models = value.models.map(validateModel);
   if (new Set(models.map((entry) => entry.id)).size !== models.length)
     throw new Error('[local-provider] duplicate registered model ids');
+  return models;
+}
+
+export function registeredLocalModels(dataDir = resolvePluginData()) {
+  const path = registryPath(dataDir);
+  if (!existsSync(path)) return [];
+  const stat = statSync(path);
+  const stamp = `${stat.mtimeMs}:${stat.size}`;
+  if (cache.get(path)?.stamp === stamp) return cache.get(path).models.map((entry) => ({ ...entry }));
+  // A damaged index (empty, NUL-filled, truncated, invalid) never blocks the
+  // provider: its bytes are kept as <file>.corrupt-<ts>, the last good copy
+  // (<file>.bak) is restored when there is one, else no model is registered.
+  // The downloaded weights are untouched.
+  const models = readJsonStateSync(path, { validate: parseRegistry, decode: registryText, fallback: [] });
   cache.set(path, { stamp, models });
   return models.map((entry) => ({ ...entry }));
 }
 
-export function registerLocalModel(entry, dataDir = resolvePluginData()) {
-  validateModel(entry);
-  const models = registeredLocalModels(dataDir);
-  const existing = models.find((model) => model.id === entry.id);
-  if (existing) {
-    if (existing.contextWindow !== entry.contextWindow)
-      throw new Error('[local-provider] this model is already registered with another context size');
-    return existing;
-  }
-  if (models.length >= 256) throw new Error('[local-provider] registered model limit reached');
+// Read-modify-write under the index lock. A damaged index was recovered by the
+// read first; a newer build's index makes the write refuse instead of
+// replacing it (and its backup) with this build's format.
+function mutateRegistry(dataDir, change) {
+  registeredLocalModels(dataDir);
   const path = registryPath(dataDir);
-  writeJsonAtomicSync(path, { schema: 1, models: [...models, entry] });
+  let result;
+  updateJsonAtomicSync(
+    path,
+    (raw) => {
+      const next = change(raw == null ? [] : parseRegistry(raw));
+      if (!next) return undefined;
+      result = next.result;
+      return { schema: 1, models: next.models };
+    },
+    { backup: true }
+  );
   cache.delete(path);
-  return entry;
+  return result;
+}
+
+export function registerLocalModel(entry, dataDir = resolvePluginData()) {
+  validateModel(entry);
+  let existing;
+  const registered = mutateRegistry(dataDir, (models) => {
+    existing = models.find((model) => model.id === entry.id);
+    if (existing) return null;
+    if (models.length >= 256) throw new Error('[local-provider] registered model limit reached');
+    return { models: [...models, entry], result: entry };
+  });
+  if (!existing) return registered;
+  if (existing.contextWindow !== entry.contextWindow)
+    throw new Error('[local-provider] this model is already registered with another context size');
+  return existing;
 }
 
 export function forgetRegisteredLocalModel(modelId, dataDir = resolvePluginData()) {
-  const models = registeredLocalModels(dataDir);
-  if (!models.some((entry) => entry.id === modelId)) return;
-  const path = registryPath(dataDir);
-  writeJsonAtomicSync(path, { schema: 1, models: models.filter((entry) => entry.id !== modelId) });
-  cache.delete(path);
+  mutateRegistry(dataDir, (models) =>
+    models.some((entry) => entry.id === modelId)
+      ? { models: models.filter((entry) => entry.id !== modelId), result: undefined }
+      : null
+  );
 }