mixdog 1.3.0 → 1.3.2

package/src/runtime/shared/sensitive-path-rules.mjs

@@ -0,0 +1,256 @@
+// The credential / secret file deny list, shared by every lane that hands a
+// local file to someone else: the desktop's remote (paired-device) file lanes
+// (apps/desktop/src/main/remote-sensitive-paths.ts adds its registered private
+// roots and async canonicalization) and the runtime's attachment hand-offs
+// between bots and agents (session-runtime/handoff-attachments.mjs).
+//
+// Matching is on SEGMENTS of a path, lower-cased on every platform, so a
+// denied name cannot hide behind letter case, trailing dots/spaces or an NTFS
+// stream suffix. Callers pass the canonical (realpath) form as well as the
+// lexical one, so a link cannot reach a denied place under an innocent name.
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+/** A directory with this name anywhere on the path holds credentials. `.git`
+ *  is one of them: its config carries remotes with embedded tokens and
+ *  credential helpers, and its objects hold every secret ever committed. */
+const SECRET_DIRECTORIES = new Set([
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.mozilla',
+  '.password-store',
+  '.git',
+]);
+
+/** Consecutive segments anywhere on the path that name a credential store:
+ *  CLI configs, browser profiles and OS credential stores. */
+const SECRET_SEQUENCES = [
+  // Tool credentials in the user's home.
+  ['.docker', 'config.json'],
+  ['.config', 'gcloud'],
+  ['appdata', 'roaming', 'gcloud'],
+  ['.config', 'gh'],
+  ['appdata', 'roaming', 'github cli'],
+  ['.config', 'git', 'credentials'],
+  ['.cargo', 'credentials'],
+  ['.cargo', 'credentials.toml'],
+  ['.terraform.d', 'credentials.tfrc.json'],
+  ['.claude', '.credentials.json'],
+  ['.codex', 'auth.json'],
+  ['.gemini', 'oauth_creds.json'],
+  // Browser profiles: cookies, saved logins, session tokens.
+  ['google', 'chrome', 'user data'],
+  ['microsoft', 'edge', 'user data'],
+  ['bravesoftware', 'brave-browser'],
+  ['chromium', 'user data'],
+  ['vivaldi', 'user data'],
+  ['opera software'],
+  ['mozilla', 'firefox'],
+  ['application support', 'google', 'chrome'],
+  ['application support', 'microsoft edge'],
+  ['application support', 'firefox'],
+  ['application support', 'chromium'],
+  ['application support', 'bravesoftware'],
+  ['application support', 'vivaldi'],
+  ['library', 'safari'],
+  ['library', 'cookies'],
+  ['.config', 'google-chrome'],
+  ['.config', 'chromium'],
+  ['.config', 'microsoft-edge'],
+  ['.config', 'bravesoftware'],
+  ['.config', 'vivaldi'],
+  ['snap', 'firefox'],
+  ['snap', 'chromium'],
+  ['.var', 'app', 'org.mozilla.firefox'],
+  ['.var', 'app', 'com.google.chrome'],
+  // OS credential stores.
+  ['microsoft', 'credentials'],
+  ['microsoft', 'protect'],
+  ['microsoft', 'vault'],
+  ['windows', 'system32', 'config'],
+  ['library', 'keychains'],
+  ['.local', 'share', 'keyrings'],
+  ['.local', 'share', 'kwalletd'],
+  ['etc', 'shadow'],
+  ['etc', 'gshadow'],
+  ['etc', 'ssh'],
+  ['etc', 'ssl', 'private'],
+];
+
+const KEY_EXTENSIONS = new Set([
+  '.pem',
+  '.key',
+  '.p12',
+  '.pfx',
+  '.p8',
+  '.ppk',
+  '.jks',
+  '.keystore',
+  '.kdbx',
+  '.keychain',
+  '.keychain-db',
+]);
+const CREDENTIAL_FILES = new Set([
+  '.netrc',
+  '_netrc',
+  '.npmrc',
+  '.pypirc',
+  '.git-credentials',
+  '.pgpass',
+  '.vault-token',
+  '.htpasswd',
+  '.dockercfg',
+  '.envrc',
+  '.s3cfg',
+  'kubeconfig',
+]);
+/** Environment files: every `.env*` name (`.env`, `.env.local`, `.envrc`,
+ *  `.environment`, and the `.env.example` templates too — a template is
+ *  checked in often enough with real values that no name is exempt) and
+ *  `<stage>.env`. */
+const ENV_FILE = /^(?:\.env.*|[^.]{1,64}(?:\.[^.]{1,64}){0,3}\.env)$/;
+/** The dotenv templates a person may still open on purpose from a paired
+ *  device (the desktop's remote file lanes, `envTemplates: true`); automatic
+ *  transfers between bots and agents never get this allowance. */
+const ENV_TEMPLATES = new Set(['.env.example', '.env.sample', '.env.template', '.env.dist']);
+/** Credential JSON a cloud or OAuth client writes or downloads:
+ *  `credentials.json`, `*credentials*.json`, `service-account*.json`,
+ *  `client_secret*.json`. */
+const CREDENTIAL_JSON = /^(?:.*credential.*|service[-_ ]?account.*|client[-_]?secret.*)\.json$/;
+/** OpenSSH private keys (`id_ed25519`, `id_rsa_work`, `id_ecdsa_sk`, any
+ *  `id_<type>`): no extension, so the public `.pub` half and documents named
+ *  after a key type (`id_rsa_notes.md`) are not keys. */
+const SSH_PRIVATE_KEY = /^id_[a-z0-9]{2,16}(?:[_-][^._-]{1,32}){0,3}$/;
+/** A copy an editor or tool leaves beside a file (`x.bak`, `x.old`, `x~`,
+ *  `x.1`): it holds what the original holds. */
+const BACKUP_SUFFIX = /(?:\.(?:bak|backup|old|orig|prev|save|sav|swp|swo|tmp|copy|\d{1,3})|~)$/;
+const MAX_BACKUP_SUFFIXES = 3;
+
+/** The name a backup copy was made of (`.npmrc.bak.1` → `.npmrc`). */
+function backupOriginal(name) {
+  let original = name;
+  for (let strip = 0; strip < MAX_BACKUP_SUFFIXES; strip += 1) {
+    const next = original.replace(BACKUP_SUFFIX, '');
+    if (next === original || !next) break;
+    original = next;
+  }
+  return original;
+}
+
+/** A file whose own name says it holds a secret, wherever it lives: a
+ *  credential file, a dotenv file, a key or keystore, or a backup of one. */
+function secretFileName(name, { envTemplates = false } = {}) {
+  const original = backupOriginal(name);
+  if (CREDENTIAL_FILES.has(original) || CREDENTIAL_JSON.test(original)) return true;
+  if (ENV_FILE.test(original)) return !(envTemplates && ENV_TEMPLATES.has(original));
+  const dot = original.lastIndexOf('.');
+  if (dot >= 0 && KEY_EXTENSIONS.has(original.slice(dot))) return true;
+  return SSH_PRIVATE_KEY.test(original);
+}
+
+// Mixdog's own state. Its home and data folders also hold what tools write
+// (tool results, shell output, media), which stay reachable; only the files
+// and folders that carry provider tokens, API keys, pairing and bridge secrets
+// are denied.
+const MIXDOG_SECRET_DIRECTORIES = new Set([
+  'secrets',
+  'mcp-oauth',
+  'provider-accounts',
+  'telegram',
+  'relay-data',
+  'dev-profile',
+]);
+const MIXDOG_SECRET_FILE =
+  /^\.?(mixdog-config|provider-accounts|relay-hook-device|auth\.json|[a-z0-9-]+-oauth(-credentials)?\.json|[a-z0-9-]+-bridge\.json)/;
+const MIXDOG_SECRET_EXTENSIONS = new Set(['.dpapi', '.token']);
+
+function mixdogSecret(rest) {
+  if (rest.some((segment) => MIXDOG_SECRET_DIRECTORIES.has(segment))) return true;
+  const name = rest[rest.length - 1] ?? '';
+  const dot = name.lastIndexOf('.');
+  return MIXDOG_SECRET_FILE.test(name) || MIXDOG_SECRET_EXTENSIONS.has(dot >= 0 ? name.slice(dot) : '');
+}
+
+/** The segments of a path as the rules compare them: no extended-path prefix,
+ *  no NTFS stream suffix, no trailing dots or spaces, lower case. */
+export function sensitivePathSegments(path) {
+  return String(path)
+    .replace(/^[\\/]{2}[?.][\\/]/, '')
+    .split(/[\\/]+/)
+    .map((segment) =>
+      segment
+        .split(':')[0]
+        .replace(/[. ]+$/, '')
+        .toLowerCase()
+    )
+    .filter(Boolean);
+}
+
+function hasRun(segments, run) {
+  for (let start = 0; start + run.length <= segments.length; start += 1) {
+    if (run.every((segment, offset) => segments[start + offset] === segment)) return true;
+  }
+  return false;
+}
+
+/**
+ * Whether `path` is denied under `within`: scopes `{ root: segments, except:
+ * subfolder names, whole }` — Mixdog's home and data folders (`whole: false`,
+ * only their secret subset is denied) and registered private roots (`whole:
+ * true`, everything but `except`). Pass both the lexical and canonical form.
+ * `envTemplates`: a user-initiated remote open may read the dotenv
+ * templates; nothing else gets that allowance.
+ */
+export function matchesSensitivePath(path, within = [], { envTemplates = false } = {}) {
+  const segments = sensitivePathSegments(resolve(path));
+  const name = segments[segments.length - 1] ?? '';
+  if (segments.some((segment) => SECRET_DIRECTORIES.has(segment))) return true;
+  if (secretFileName(name, { envTemplates }) || SECRET_SEQUENCES.some((run) => hasRun(segments, run))) return true;
+  const containing = within.filter(
+    ({ root }) => root.length > 0 && root.every((segment, index) => segments[index] === segment)
+  );
+  // Mixdog's home and data folders follow Mixdog's own rule even inside a
+  // registered private root: a dev or isolated profile keeps them in the app
+  // profile, and the tool output and media there stay reachable.
+  const own = containing.filter(({ whole }) => !whole);
+  if (own.length) return own.some(({ root }) => mixdogSecret(segments.slice(root.length)));
+  return containing.some(({ root, except }) => {
+    const rest = segments.slice(root.length);
+    return rest.length > 0 && !except.includes(rest[0]);
+  });
+}
+
+function realOrSelf(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    const parent = dirname(path);
+    return parent === path ? path : join(realOrSelf(parent), path.slice(parent.length).replace(/^[\\/]+/, ''));
+  }
+}
+
+/** Mixdog's home and data folders (MIXDOG_HOME / MIXDOG_DATA_DIR, plus any
+ *  extra data folder the caller names) as `matchesSensitivePath` scopes. */
+export function mixdogSensitiveScopes(extraData = []) {
+  const home = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
+  const roots = [home, process.env.MIXDOG_DATA_DIR || join(home, 'data'), ...extraData].filter(Boolean);
+  const scopes = [];
+  for (const root of roots) {
+    for (const form of new Set([resolve(root), realOrSelf(resolve(root))])) {
+      scopes.push({ root: sensitivePathSegments(form), except: [], whole: false });
+    }
+  }
+  return scopes;
+}
+
+/** Whether `path` — its own name or what its links lead to — is a
+ *  credential/secret file under the shared deny list and Mixdog's own scopes. */
+export function isSensitiveLocalPath(path, { extraData = [] } = {}) {
+  const within = mixdogSensitiveScopes(extraData);
+  const absolute = resolve(path);
+  return matchesSensitivePath(absolute, within) || matchesSensitivePath(realOrSelf(absolute), within);
+}

package/src/runtime/shared/session-baseline-store.mjs

@@ -809,8 +809,14 @@ export function _unsavedBytesForTest(sessionId) {
 async function readBlob(sessionId, entry) {
   if (!entry?.blob) return undefined;
   try {
-    const bytes = await readFile(join(blobDir(sessionId), entry.blob));
-    return digest(bytes) === entry.blob ? bytes : undefined;
+    const path = join(blobDir(sessionId), entry.blob);
+    const bytes = await readFile(path);
+    if (digest(bytes) === entry.blob) return bytes;
+    // A torn blob (unflushed write cut by a crash). Blobs are published whole
+    // and never replaced, so a mismatch is damage: drop it, or the create-only
+    // write of a later capture of the same content would skip over it.
+    await rm(path, { force: true });
+    return undefined;
   } catch {
     return undefined;
   }

package/src/runtime/shared/singleton-owner.mjs

@@ -1,6 +1,6 @@
-import { mkdirSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { rmdirSync, rmSync, statSync } from 'node:fs';
 import { readFile, rename, rm, rmdir, stat, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { writeJsonAtomicSync } from './atomic-file.mjs';
 import { withFileLock, withFileLockSync } from './file-lock.mjs';
 import { readJsonSafe } from './json-file.mjs';
 import { isPidAlive } from './pid-liveness.mjs';
@@ -19,11 +19,12 @@ const CLAIM_LOCK_STALE_MS = 5000;
 const CLAIM_LOCK_OPTS = Object.freeze({ timeoutMs: CLAIM_LOCK_TIMEOUT_MS, staleMs: CLAIM_LOCK_STALE_MS });
 const BUSY = Symbol('claim lock busy');
 
+// A claim or handoff is flushed before it is published. The heartbeat's async
+// refresh below is not: it rewrites the record every few seconds, and a record
+// a crash leaves NUL reads as "no owner" (readJsonSafe), so the next claim
+// simply takes over.
 function writeJsonAtomic(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
-  renameSync(tmp, path);
+  writeJsonAtomicSync(path, value);
 }
 
 // Held by another live process or this one's async holder ('busy'). Any other

package/src/runtime/shared/skill-tool-dependencies.mjs

@@ -1,8 +1,9 @@
 // Explicit skill dependencies. Imported manifests are read, never rewritten.
-import { createHash, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { parseDocument } from 'yaml';
+import { writeFileAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const MAX_METADATA_BYTES = 64 * 1024;
@@ -119,12 +120,5 @@ export function saveSkillToolDependencies(filePath, dependencies) {
   const tools = normalizeSkillToolDependencies(dependencies, { strict: true });
   const content = `${JSON.stringify({ dependencies: { tools } }, null, 2)}\n`;
   if (Buffer.byteLength(content) > MAX_METADATA_BYTES) throw new Error('Skill dependency metadata is too large.');
-  mkdirSync(dirname(path), { recursive: true });
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
-    renameSync(temporary, path);
-  } finally {
-    rmSync(temporary, { force: true });
-  }
+  writeFileAtomicSync(path, content);
 }

package/src/runtime/shared/staged-update.mjs

@@ -50,7 +50,7 @@ import { resolvePluginData } from './plugin-paths.mjs';
 import { isPidAlive as pidAlive } from './pid-liveness.mjs';
 import { sleepSync } from './sleep.mjs';
 import { detachedSpawnOpts, hiddenSpawnOpts } from './spawn-flags.mjs';
-import { renameWithRetrySync } from './atomic-file.mjs';
+import { renameWithRetrySync, writeJsonAtomicSync } from './atomic-file.mjs';
 import {
   isDevInstall,
   localPackageVersion,
@@ -295,7 +295,9 @@ export async function runStagedInstall(version) {
 
     if (!existsSync(join(pkgDir, 'src', 'cli.mjs'))) return { ok: false, error: 'staged cli.mjs missing' };
     // Marker written LAST — its presence is the completion signal for the swap.
-    writeFileSync(markerPath(verDir), JSON.stringify({ version: v, pkgDir, stagedAt: Date.now() }), 'utf8');
+    // Published whole and flushed: a NUL marker would read as "not staged" and
+    // force a full re-install.
+    writeJsonAtomicSync(markerPath(verDir), { version: v, pkgDir, stagedAt: Date.now() }, { compact: true });
     return { ok: true, version: v, dir: pkgDir };
   } catch (err) {
     return { ok: false, error: err?.message || String(err) };

package/src/runtime/shared/statusline/statusline-segments.mjs

@@ -197,11 +197,11 @@ async function refreshShellJobsStatus(ownerPid) {
       }
       // A killed command whose processes are not confirmed gone has already
       // reported its result, so its tool card is closed: it is listed until
-      // its owner retires the record. Its root pid may be gone while a
-      // descendant lives, so the owner's liveness decides, not the root's.
+      // its owner retires the record. An incomplete observation can leave no
+      // known survivors even after the owner session closes; only the owning
+      // runtime can confirm termination, so its liveness decides, not the root's.
       const unconfirmed = detail?.terminationUnconfirmed === true;
-      if (unconfirmed ? !isHeldShellJobAlive(detail, ownerByJob.get(id)) : !(await isShellJobAlive(detail, p, dir, id)))
-        continue;
+      if (unconfirmed ? !isPidAlive(ownerByJob.get(id) || 0) : !(await isShellJobAlive(detail, p, dir, id))) continue;
       // A foreground command is awaited in its own tool card; listing it here
       // made every short command flash in and out of the shell list. Only
       // backgrounded jobs (including promoted ones) are background work.
@@ -327,17 +327,6 @@ function summarizeShellJobs({ count, oldestMs, jobs, bySession }) {
   return { count, elapsedLabel, jobs, sessions };
 }
 
-// A held record lives while its owner process does. Once its owner session
-// has closed, it also needs a process left to hold: the root or a survivor
-// its termination watch last reported. Without one it is an orphan whose
-// processes are gone, and it resolves instead of staying unconfirmed.
-function isHeldShellJobAlive(detail, ownerPid) {
-  if (!isPidAlive(ownerPid || 0)) return false;
-  if (detail?.ownerSessionClosed !== true) return true;
-  const survivors = Array.isArray(detail?.survivorPids) ? detail.survivorPids : [];
-  return [detail?.pid, ...survivors].some((pid) => isPidAlive(positiveInt(pid)));
-}
-
 async function isShellJobAlive(detail, detailPath, dir, id) {
   const pid = positiveInt(detail?.pid);
   if (!pid) return false;

package/src/runtime/shared/tool-execution-contract.mjs

@@ -236,6 +236,12 @@ export function isTranscriptHiddenToolItem(item) {
 // stopped, and the restored transcript must keep that row
 // (scripts/turn-checkpoint-crash-test.mjs).
 const INTERNAL_TRANSCRIPT_INTERRUPT_RE = /^\[request interrupted by user(?: for tool use)?\]$/i;
+// Every runtime control row written as a user turn when a turn is cut short
+// (including the bare "[Request interrupted]" a kept Stop prompt gets). One
+// pattern for "not real conversation": realTurnCount and the preview/title
+// noise filter both use it.
+export const CONTROL_MARKER_RE =
+  /^\[(?:truncated|request interrupted(?: by user(?: for tool use)?| by process restart)?)\]$/i;
 const TRANSCRIPT_CANCELLED_STATUS_RE = /^\[request interrupted(?: by process restart)?\]$/i;
 
 // Crash/implicit interruption markers remain in model-visible history for

package/src/runtime/shared/transcript-metadata.mjs

@@ -53,6 +53,20 @@ export function normalizeMessageAttachments(value) {
   return out;
 }
 
+/**
+ * Who a user-kind row came from, as the row's own fields: the sender, the
+ * submitting device and the bot that sent it. One definition for the delivered
+ * steering row and the still-queued one, so both render the same.
+ */
+export function transcriptSourceFields(value) {
+  if (!value || typeof value !== 'object') return {};
+  return {
+    ...(typeof value.sender === 'string' && value.sender ? { sender: value.sender } : {}),
+    ...(typeof value.device === 'string' && value.device ? { device: value.device } : {}),
+    ...(typeof value.fromAgent === 'string' && value.fromAgent ? { fromAgent: value.fromAgent } : {}),
+  };
+}
+
 /** A new stable message id (`meta.transcript.messageId`). */
 export function newTranscriptMessageId() {
   return `msg_${globalThis.crypto.randomUUID().replaceAll('-', '')}`;
@@ -71,14 +85,19 @@ export function persistedUserTranscriptMetadata(value) {
     ...(typeof value.attemptId === 'string' && value.attemptId ? { attemptId: value.attemptId } : {}),
     ...(Number.isFinite(Number(value.at)) ? { at: Number(value.at) } : {}),
     ...transcriptRouteMetadataFields(value),
-    ...(typeof value.sender === 'string' && value.sender ? { sender: value.sender } : {}),
-    // The device that submitted the prompt (host-stamped display name).
-    ...(typeof value.device === 'string' && value.device ? { device: value.device } : {}),
+    // Sender, the submitting device (host-stamped display name) and the bot
+    // that sent this message to this session (agent-task-sessions.mjs).
+    ...transcriptSourceFields(value),
+    // Bot-to-bot chain position of a bot's message (session-runtime/bot-hops.mjs).
+    ...(Number.isInteger(value.hop) && value.hop > 0 ? { hop: value.hop } : {}),
     // The turn's change-record key (the outer prompt id), so a restored user
     // row still addresses its turn's Undo/Reapply.
     ...(typeof value.checkpointId === 'string' && value.checkpointId ? { checkpointId: value.checkpointId } : {}),
     // Every submission a merged queued batch delivered as this turn.
     ...submissionIdsField(value.submissionIds),
+    // The executions a woken batch delivered (session-flow/drain.mjs): the
+    // provenance a task session's report follows (agent-task-sessions.mjs).
+    ...consumedExecutionIdsField(value.consumedExecutionIds),
     ...attachmentsField(value.attachments),
     // A routine fire delivered as this turn (routine-trigger.mjs).
     ...routineTriggerField(value),
@@ -90,6 +109,12 @@ function submissionIdsField(value) {
   return ids.length ? { submissionIds: ids } : {};
 }
 
+// Positions are kept: a null stands for a delivered entry that named no execution.
+function consumedExecutionIdsField(value) {
+  if (!Array.isArray(value) || !value.length) return {};
+  return { consumedExecutionIds: value.map((id) => (typeof id === 'string' && id ? id : null)) };
+}
+
 function attachmentsField(value) {
   const attachments = normalizeMessageAttachments(value);
   return attachments.length ? { attachments } : {};

package/src/runtime/shared/transcript-writer/session-record.mjs

@@ -3,8 +3,7 @@
  * record that names this session's transcript for discovery, plus the
  * first-occurrence failure logger every transcript writer shares.
  */
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { writeJsonAtomicSync } from '../atomic-file.mjs';
 
 // Repeated-failure guard: log the first time each distinct message is seen,
 // then stay quiet so a persistently-broken path does not flood stderr.
@@ -27,10 +26,11 @@ export function createSessionRecord({ sessionRecordPath, sessionId, resolvedCwd,
 
   function write() {
     try {
-      mkdirSync(dirname(sessionRecordPath), { recursive: true });
-      writeFileSync(
+      // Published whole and flushed: a discovery reader never meets a torn or
+      // NUL record, and every refresh rewrites it anyway.
+      writeJsonAtomicSync(
         sessionRecordPath,
-        JSON.stringify({
+        {
           sessionId,
           cwd: resolvedCwd,
           transcriptPath,
@@ -38,7 +38,8 @@ export function createSessionRecord({ sessionRecordPath, sessionId, resolvedCwd,
           updatedAt: Date.now(),
           kind: 'interactive',
           entrypoint: 'cli',
-        })
+        },
+        { compact: true }
       );
     } catch (err) {
       logOnce(err);

package/src/runtime/shared/turn-snapshot-store.mjs

@@ -13,8 +13,9 @@
 // list is what lets a SHARED worktree still revert: the baseline describes the
 // whole tree, but only these paths may be restored from it.
 import { createHash } from 'node:crypto';
-import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rm, stat } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { writeFileAtomicAsync } from './atomic-file.mjs';
 import { cleanString as clean } from './clean.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
@@ -173,10 +174,10 @@ async function sweepRecords() {
   await sweepDirectory(recordRoot(), RECORD_TTL_MS, MAX_RECORD_FILES);
 }
 
+// Flushed before it is published: a crash must not leave a record that reads as
+// NUL (every reader below answers a damaged record as "no record").
 async function writeJsonAtomically(path, payload) {
-  const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile(temporary, JSON.stringify(payload), 'utf8');
-  await rename(temporary, path);
+  await writeFileAtomicAsync(path, JSON.stringify(payload));
 }
 
 /**

package/src/runtime/shared/turn-snapshot.mjs

@@ -54,6 +54,7 @@ import {
   reviewSectionTruncated,
 } from './review-diff.mjs';
 import { PATCH_EDIT_MAX_BYTES } from './bounded-file-read.mjs';
+import { runGitOffThread } from './git-runner.mjs';
 import { cleanString as clean } from './clean.mjs';
 import { createLineDiffBudget, lineDiffHunks, unifiedHunksBody } from './bounded-line-diff.mjs';
 
@@ -1718,13 +1719,52 @@ export async function getTurnChanges(sessionId, options = {}) {
   let status = 'missing';
   if (ownerSessionId && turnChangesPending(ownerSessionId, checkpointId)) status = 'pending';
   else if (record) status = record.files?.length || record.outside?.length ? 'ready' : 'none';
-  return turnChangesReply({
+  const reply = turnChangesReply({
     status,
     checkpointId,
     record,
     patch: options?.patch === true,
     file: clean(options?.file) || null,
   });
+  return status === 'ready' ? withIgnoredChangeFiles(ownerSessionId, reply) : reply;
+}
+
+// The gitignored files of each answered record revision (build output a file
+// tool wrote): flagged `ignored` so a viewer can leave them out of its turn
+// previews. Asked of Git once per revision; bounded.
+const IGNORED_CHANGE_CACHE_LIMIT = 200;
+const _ignoredChangeFiles = new Map();
+
+async function ignoredChangePaths(key, root, paths) {
+  const cached = _ignoredChangeFiles.get(key);
+  if (cached) return cached;
+  let ignored = new Set();
+  try {
+    const result = await runGitOffThread(['check-ignore', '-z', '--stdin'], {
+      cwd: root,
+      input: `${paths.join('\0')}\0`,
+      timeoutMs: 10_000,
+      maxBytes: 4 * 1024 * 1024,
+    });
+    // 0: some are ignored, 1: none; anything else (no repository) flags none.
+    if (result.code === 0) ignored = new Set(result.stdout.split('\0').filter(Boolean));
+  } catch {
+    // No Git to ask: nothing is flagged.
+  }
+  _ignoredChangeFiles.set(key, ignored);
+  while (_ignoredChangeFiles.size > IGNORED_CHANGE_CACHE_LIMIT) {
+    _ignoredChangeFiles.delete(_ignoredChangeFiles.keys().next().value);
+  }
+  return ignored;
+}
+
+async function withIgnoredChangeFiles(ownerSessionId, reply) {
+  const paths = reply.files.map((file) => file.path).filter((path) => path && !isAbsolute(path));
+  if (!reply.root || paths.length === 0) return reply;
+  const key = `${ownerSessionId}\0${reply.checkpointId}\0${reply.revision}\0${reply.root}`;
+  const ignored = await ignoredChangePaths(key, reply.root, paths);
+  if (ignored.size === 0) return reply;
+  return { ...reply, files: reply.files.map((file) => (ignored.has(file.path) ? { ...file, ignored: true } : file)) };
 }
 
 function serializeChangeMutation(ownerSessionId, task) {
@@ -1871,11 +1911,13 @@ async function mutateTurnChanges(sessionId, checkpointIdValue, fileValue, revisi
       if (targets.length === 0) throw new Error(`this turn has no changes to be ${verb}`);
     }
     const updated = await mutateRecordFiles(ownerSessionId, record, targets, reverse);
-    return turnChangesReply({
+    const reply = turnChangesReply({
       status: updated ? 'ready' : 'missing',
       checkpointId,
       record: withUnknownChangeStates(ownerSessionId, updated),
     });
+    // The viewer caches this reply as it caches a read: the same `ignored` flags.
+    return updated ? withIgnoredChangeFiles(ownerSessionId, reply) : reply;
   });
 }
 

package/src/runtime/shared/usage-readout-totals.mjs

@@ -6,13 +6,15 @@
 // - cache hit = cacheRead / (input + cacheRead + cacheWrite) over every call
 //   whose prompt was measured. A call that could not measure its prompt
 //   (promptKnown === false) has unknown zeros, so it adds nothing.
-// - speed = output tokens over generation ms (first visible token → end of the
-//   response) of the calls long enough to time. A reply too short says nothing
-//   about the model's speed, so each call is held to the floors below BEFORE it
-//   is summed.
+// - speed = output tokens over request ms (provider request start → end of the
+//   response, the wait for the first token included: the same wall time as the
+//   usage ledger's `duration_ms`) of every call with positive output and
+//   positive duration: the same eligibility as the usage ledger and the usage
+//   dialog, so the readout and the dialog agree. Records saved before this
+//   definition carry `speedOutputTokens` / `speedMs` (first visible token →
+//   end); they are kept as they are and read only while no request-timed call
+//   has landed.
 // - total tokens = input + cacheRead + cacheWrite + output, from the same sums.
-export const MIN_SPEED_OUTPUT_TOKENS = 20;
-export const MIN_SPEED_MS = 500;
 
 function num(value) {
   const n = Number(value);
@@ -21,16 +23,16 @@ function num(value) {
 
 /** The zeroed totals record. */
 export function emptyUsageReadout() {
-  return { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, speedOutputTokens: 0, speedMs: 0 };
+  return { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, requestOutputTokens: 0, requestMs: 0 };
 }
 
 /**
- * Fold one `onUsageDelta` event (and the call's generation ms, 0 when it was
+ * Fold one `onUsageDelta` event (and the call's request ms, 0 when it was
  * not timed) into the totals; returns a new record, never mutates `totals`.
  * Providers differ on whether input counts cache; the prompt total does not,
  * so fresh input is the prompt less its cache read/write.
  */
-export function foldUsageReadout(totals, delta = {}, generationMs = 0) {
+export function foldUsageReadout(totals, delta = {}, requestMs = 0) {
   const base = totals || emptyUsageReadout();
   const next = { ...base };
   if (delta.promptKnown !== false) {
@@ -47,10 +49,10 @@ export function foldUsageReadout(totals, delta = {}, generationMs = 0) {
   // partial one would pass for the whole: it stays without until the session
   // starts over.
   if (Number.isFinite(base.output)) next.output = base.output + output;
-  const ms = num(generationMs);
-  if (ms >= MIN_SPEED_MS && output >= MIN_SPEED_OUTPUT_TOKENS) {
-    next.speedOutputTokens = num(base.speedOutputTokens) + output;
-    next.speedMs = num(base.speedMs) + ms;
+  const ms = num(requestMs);
+  if (ms > 0 && output > 0) {
+    next.requestOutputTokens = num(base.requestOutputTokens) + output;
+    next.requestMs = num(base.requestMs) + ms;
   }
   return next;
 }