mixdog 1.3.1 → 1.3.3

package/src/runtime/browser-bridge/client.mjs

@@ -14,8 +14,12 @@ import { base64ByteLength, inlineFileKind } from '../shared/inline-file-kind.mjs
 import { MAX_IMAGE_BYTES, SUPPORTED_IMAGE_MIME_TYPES } from '../attachments/limits.mjs';
 
 const DISCOVERY_FILE = 'browser-bridge.json';
-/** Ceiling above the bridge's own per-action timeouts (navigation settle,
- *  surface auto-open), so the bridge's specific error wins over a bare abort. */
+/** How long a request may go without a single byte from the bridge. Above the
+ *  bridge's own per-action timeouts (navigation settle, surface auto-open), so
+ *  the bridge's specific error wins over a bare abort. It is a silence limit,
+ *  not a total: a command that waits on the person (an approval card, which has
+ *  no limit) is kept alive by the bridge with a space every few seconds
+ *  (apps/desktop/src/main/browser/bridge-server.ts), and each byte restarts it. */
 const REQUEST_TIMEOUT_MS = 45_000;
 const MAX_REQUEST_BYTES = 256 * 1024;
 const MAX_RESPONSE_BYTES = 150 * 1024 * 1024;
@@ -33,7 +37,7 @@ export async function finishBrowserTurn(sessionId, turnId, { aborted = false } =
   if (!discovery) return;
   turns.delete(turnId);
   if (!turns.size) browserTurns.delete(sessionId);
-  const result = await requestBridge(
+  const result = await requestBridgeWithin(
     discovery,
     JSON.stringify({
       action: 'finish_turn',
@@ -43,7 +47,7 @@ export async function finishBrowserTurn(sessionId, turnId, { aborted = false } =
       // so its pages stay; only an aborted run reclaims them.
       aborted: aborted === true,
     }),
-    AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    undefined,
     { sessionId, turnId, action: 'finish_turn' }
   );
   if (result.status !== 200 || result.body?.ok === false || result.body?.error) {
@@ -61,12 +65,10 @@ export async function browserSecretInput(sessionId, requestId, { signal } = {})
   const discovery = readBridgeDiscovery(DISCOVERY_FILE);
   if (!discovery || !sessionId || !requestId) return 'skipped';
   try {
-    const result = await requestBridge(
+    const result = await requestBridgeWithin(
       discovery,
       JSON.stringify({ action: 'secret_input', session_id: String(sessionId), request_id: String(requestId) }),
-      signal
-        ? AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal])
-        : AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      signal,
       { sessionId, action: 'secret_input' }
     );
     return result.status === 200 && result.body?.ok !== false && result.body?.value?.text === 'provided'
@@ -155,8 +157,9 @@ function unavailableMessage() {
 class BrowserBridgeResponseError extends Error {}
 
 // Read the body incrementally so a chunked response (no content-length) still
-// honours MAX_RESPONSE_BYTES.
-export async function readCappedJson(response, maximum = MAX_RESPONSE_BYTES) {
+// honours MAX_RESPONSE_BYTES. `onChunk` hears every chunk read (the bridge's
+// keep-alive spaces included).
+export async function readCappedJson(response, maximum = MAX_RESPONSE_BYTES, onChunk = undefined) {
   if (!response.body) throw new Error('empty response');
   const reader = response.body.getReader();
   const chunks = [];
@@ -165,6 +168,7 @@ export async function readCappedJson(response, maximum = MAX_RESPONSE_BYTES) {
     for (;;) {
       const result = await reader.read();
       if (result.done) break;
+      onChunk?.();
       bytes += result.value.byteLength;
       if (bytes > maximum) {
         await reader.cancel().catch(() => {});
@@ -178,7 +182,50 @@ export async function readCappedJson(response, maximum = MAX_RESPONSE_BYTES) {
   return JSON.parse(Buffer.concat(chunks, bytes).toString('utf8'));
 }
 
-async function requestBridge(discovery, encodedPayload, signal, timingContext) {
+/** One bridge request's clock: it times out after `timeoutMs` without a byte
+ *  from the bridge (`touch` restarts it), with the same TimeoutError an
+ *  AbortSignal.timeout gives, and ends with `callerSignal` (the caller's own
+ *  reason). `stop` leaves no timer behind. */
+export function bridgeDeadline(callerSignal, timeoutMs = REQUEST_TIMEOUT_MS) {
+  const controller = new AbortController();
+  let timer = null;
+  const stop = () => {
+    if (timer) clearTimeout(timer);
+    timer = null;
+  };
+  const touch = () => {
+    stop();
+    timer = setTimeout(
+      () => controller.abort(new DOMException('The operation was aborted due to timeout', 'TimeoutError')),
+      timeoutMs
+    );
+    timer.unref?.();
+  };
+  touch();
+  return {
+    signal: callerSignal ? AbortSignal.any([controller.signal, callerSignal]) : controller.signal,
+    touch,
+    stop,
+  };
+}
+
+/** `requestBridge` under the silence limit of `bridgeDeadline`. */
+export async function requestBridgeWithin(
+  discovery,
+  encodedPayload,
+  callerSignal,
+  timingContext,
+  timeoutMs = REQUEST_TIMEOUT_MS
+) {
+  const deadline = bridgeDeadline(callerSignal, timeoutMs);
+  try {
+    return await requestBridge(discovery, encodedPayload, deadline.signal, timingContext, deadline.touch);
+  } finally {
+    deadline.stop();
+  }
+}
+
+async function requestBridge(discovery, encodedPayload, signal, timingContext, onActivity = undefined) {
   const started = performance.now();
   let body;
   let status;
@@ -192,6 +239,7 @@ async function requestBridge(discovery, encodedPayload, signal, timingContext) {
       body: encodedPayload,
       signal,
     });
+    onActivity?.();
     status = response.status;
     const contentLength = Number(response.headers.get('content-length'));
     if (Number.isFinite(contentLength) && contentLength > MAX_RESPONSE_BYTES) {
@@ -199,10 +247,12 @@ async function requestBridge(discovery, encodedPayload, signal, timingContext) {
       throw new BrowserBridgeResponseError(`browser bridge response exceeds ${MAX_RESPONSE_BYTES} bytes`);
     }
     try {
-      body = await readCappedJson(response);
+      body = await readCappedJson(response, MAX_RESPONSE_BYTES, onActivity);
       return { body, status: response.status };
     } catch (error) {
       if (error instanceof BrowserBridgeResponseError) throw error;
+      // Silence past the clock, or the caller stopping, is not a bad response.
+      if (signal?.aborted) throw signal.reason ?? error;
       throw new BrowserBridgeResponseError(`browser bridge returned an invalid response (HTTP ${response.status})`);
     }
   } finally {
@@ -225,6 +275,12 @@ export async function executeBrowserTool(args, options = {}) {
     action: validated.action,
     ...validated.input,
     session_id: sessionId,
+    // Set by the runtime from the session, never from the model's arguments: a
+    // schedule/webhook run (or work it started) whose saved routine is the
+    // user's grant for submits, posts and uploads (human-gate/run-policy.mjs).
+    ...(options.unattendedRun === true
+      ? { unattended_run: true, unattended_agent: String(options.unattendedAgent || '') }
+      : {}),
     ...(Number.isFinite(Number(options.turnId)) && Number(options.turnId) > 0
       ? { turn_id: Math.trunc(Number(options.turnId)) }
       : {}),
@@ -243,14 +299,11 @@ export async function executeBrowserTool(args, options = {}) {
   let bridgeResult;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      bridgeResult = await requestBridge(
-        discovery,
-        encodedPayload,
-        options.signal
-          ? AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), options.signal])
-          : AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        { sessionId, turnId: payload.turn_id, action: validated.action }
-      );
+      bridgeResult = await requestBridgeWithin(discovery, encodedPayload, options.signal, {
+        sessionId,
+        turnId: payload.turn_id,
+        action: validated.action,
+      });
       break;
     } catch (error) {
       if (error?.name === 'TimeoutError') {

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -329,7 +329,7 @@ function cleanupStaleRuntimeFiles(now = Date.now()) {
       // tighter TTLs keep dead-process residue from accumulating.
       let ttl = RUNTIME_STALE_TTL;
       if (/^status-.*\.json$/.test(file)) ttl = STATUS_FILE_TTL;
-      else if (/\.tmp$/.test(file)) ttl = TMP_FILE_TTL;
+      else if (/\.tmp$|\.mixdog-tmp-[0-9a-f]+$/.test(file)) ttl = TMP_FILE_TTL;
       if (age > ttl) removeFileIfExists(fullPath);
     } catch {}
   });

package/src/runtime/channels/lib/scheduler.mjs

@@ -26,6 +26,19 @@ const SCHEDULE_LOG = join(DATA_DIR, 'schedule.log');
 // here. The channels worker owns shutdown sequencing (drain queues, persist
 // baselines, release the scheduler lock, etc.) and a library-level exit(0)
 // preempts that drain. The buffered appender drains pending log lines on exit.
+function skipReasonText(outcome) {
+  switch (outcome.reason) {
+    case 'backoff':
+      return 'backing off after failures';
+    case 'paused':
+      return 'switched off';
+    case 'owner':
+      return `paused: ${outcome.message}`;
+    default:
+      return 'previous run still in progress';
+  }
+}
+
 function logSchedule(msg) {
   msg = msg.replace(/\n$/, '');
   process.stderr.write(`mixdog scheduler: ${msg}\n`);
@@ -686,13 +699,7 @@ ${prompt}`;
         // already persisted the skip.
         if (outcome?.skipped) {
           schedule.lastSkippedAt = new Date().toISOString();
-          const why =
-            outcome.reason === 'backoff'
-              ? 'backing off after failures'
-              : outcome.reason === 'owner'
-                ? `paused: ${outcome.message}`
-                : 'previous run still in progress';
-          logSchedule(`${schedule.name}: skipped — ${why}\n`);
+          logSchedule(`${schedule.name}: skipped — ${skipReasonText(outcome)}\n`);
           return false;
         }
         logSchedule(`${schedule.name} done\n`);

package/src/runtime/channels/lib/state-file.mjs

@@ -1,5 +1,5 @@
 import { mkdirSync, readFileSync, unlinkSync } from 'node:fs';
-import { writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
+import { readJsonStateSync, updateJsonAtomicSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
 function ensureDir(dirPath) {
   mkdirSync(dirPath, { recursive: true });
 }
@@ -19,10 +19,6 @@ function readJsonFile(filePath, fallback) {
     return fallback;
   }
 }
-function readJsonFileStrict(filePath) {
-  const raw = readFileSync(filePath, 'utf8');
-  return JSON.parse(raw);
-}
 function writeJsonFile(filePath, value) {
   writeJsonAtomicSync(filePath, value, { compact: true, lock: true, fsync: false, fsyncDir: false });
 }
@@ -38,19 +34,23 @@ class JsonStateFile {
     writeJsonFile(this.filePath, value);
     return value;
   }
+  // A damaged file (empty, NUL-filled after a crash) is kept aside as
+  // <file>.corrupt-<ts> and the file restarts from the fallback; it is never
+  // overwritten in place and never blocks an update. That recovery is why the
+  // writes below can skip fsync.
   ensure() {
-    writeJsonFile(this.filePath, this.read());
+    writeJsonFile(this.filePath, readJsonStateSync(this.filePath, { fallback: this.fallback }));
   }
   update(mutator) {
-    let draft;
-    try {
-      draft = readJsonFileStrict(this.filePath);
-    } catch (err) {
-      process.stderr.write(`[state-file] REFUSING update: parse error for ${this.filePath}: ${err.message}\n`);
-      throw err;
-    }
-    mutator(draft);
-    return this.write(draft);
+    return updateJsonAtomicSync(
+      this.filePath,
+      (current) => {
+        const draft = current ?? structuredClone(this.fallback);
+        mutator(draft);
+        return draft;
+      },
+      { compact: true, fsync: false, fsyncDir: false }
+    );
   }
 }
 export { JsonStateFile, ensureDir, readJsonFile, removeFileIfExists, writeJsonFile };

package/src/runtime/channels/lib/voice-runtime-fetcher.mjs

@@ -43,7 +43,8 @@ import { fileURLToPath } from 'node:url';
 import { pipeline } from 'node:stream/promises';
 import { spawnSync } from 'node:child_process';
 import { createGunzip } from 'node:zlib';
-import { renameWithRetrySync, writeFileAtomicSync } from '../../shared/atomic-file.mjs';
+import { renameWithRetrySync, writeFileAtomicSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
+import { fileHasData } from '../../shared/file-has-data.mjs';
 import { streamResponseToFile } from '../../shared/bounded-download.mjs';
 import { platformEntryKey, sha256File, verifySha256File } from '../../shared/native-asset.mjs';
 import { windowsProgramRoots, windowsSystemRoot } from '../../agent/orchestrator/tools/builtin/windows-roots.mjs';
@@ -264,7 +265,7 @@ async function loadManifest(dataDir) {
   if (!res.ok) throw new Error(`[voice-runtime] manifest fetch failed: ${res.status} ${res.statusText}`);
   const manifest = await res.json();
   mkdirSync(join(dataDir, 'voice-runtime'), { recursive: true });
-  writeFileSync(cachedPath, JSON.stringify(manifest, null, 2));
+  writeJsonAtomicSync(cachedPath, manifest);
   return manifest;
 }
 
@@ -439,7 +440,7 @@ function gcPublishedRuntimeSiblings(rootDir, prefix) {
 }
 
 async function extractGz(gzPath, destPath) {
-  await pipeline(createReadStream(gzPath), createGunzip(), createWriteStream(destPath));
+  await pipeline(createReadStream(gzPath), createGunzip(), createWriteStream(destPath, { flush: true }));
 }
 
 // Sweep .staging-* partials left by killed/crashed install attempts.
@@ -541,13 +542,13 @@ export async function ensureWhisperRuntime(dataDir, onProgress = null) {
   const activeDir = join(rootDir, activeName);
   const whisperCmd = join(activeDir, variant.executable);
 
-  if (existsSync(whisperCmd)) {
+  if (fileHasData(whisperCmd)) {
     gcStaleVersions(rootDir, activeName, 'whisper-');
     return { whisperCmd, version: ver, variantId: variant.id };
   }
 
   return _withInstallLock(rootDir, 'install', async () => {
-    if (existsSync(whisperCmd)) {
+    if (fileHasData(whisperCmd)) {
       gcStaleVersions(rootDir, activeName, 'whisper-');
       return { whisperCmd, version: ver, variantId: variant.id };
     }
@@ -641,14 +642,14 @@ function resolveManagedWhisperCmd(dataDir) {
         const variant = variants.find((v) => v.id === variantId);
         if (variant?.executable) {
           const p = join(activeDir, variant.executable);
-          if (existsSync(p)) return p;
+          if (fileHasData(p)) return p;
         }
       }
     } catch {}
   }
   for (const c of ['Release/whisper-cli.exe', 'Release/whisper-cli']) {
     const p = join(activeDir, c);
-    if (existsSync(p)) return p;
+    if (fileHasData(p)) return p;
   }
   return null;
 }
@@ -659,7 +660,7 @@ function resolveManagedWhisperModelById(dataDir, modelId = 'standard') {
   if (!entry?.filename) return null;
   const modelDir = join(dataDir, 'voice', 'models');
   const p = join(modelDir, entry.filename);
-  return existsSync(p) ? p : null;
+  return fileHasData(p) ? p : null;
 }
 
 // Clean-install policy: the models dir holds ONLY filenames declared by the
@@ -712,13 +713,13 @@ export async function ensureFfmpegRuntime(dataDir, onProgress = null) {
   const activeDir = join(rootDir, activeName);
   const ffmpegPath = join(activeDir, platformEntry.executable);
 
-  if (existsSync(ffmpegPath)) {
+  if (fileHasData(ffmpegPath)) {
     gcStaleVersions(rootDir, activeName, 'ffmpeg-');
     return { ffmpegPath, version: ver };
   }
 
   return _withInstallLock(rootDir, 'install', async () => {
-    if (existsSync(ffmpegPath)) {
+    if (fileHasData(ffmpegPath)) {
       gcStaleVersions(rootDir, activeName, 'ffmpeg-');
       return { ffmpegPath, version: ver };
     }
@@ -783,13 +784,13 @@ function resolveManagedFfmpegPath(dataDir) {
       const platformEntry = manifest.ffmpeg?.platforms?.[key];
       if (platformEntry?.executable) {
         const p = join(activeDir, platformEntry.executable);
-        if (existsSync(p)) return p;
+        if (fileHasData(p)) return p;
       }
     } catch {}
   }
   for (const c of ['ffmpeg.exe', 'ffmpeg']) {
     const p = join(activeDir, c);
-    if (existsSync(p)) return p;
+    if (fileHasData(p)) return p;
   }
   return null;
 }
@@ -835,7 +836,7 @@ export function resolveVoiceRuntime(dataDir, { modelId = 'standard', cleanup = t
   const managedFfmpegPath = resolveManagedFfmpegPath(dataDir);
   const ext = process.platform === 'win32' ? '.exe' : '';
   const managedServerCmd = managedWhisperCmd ? join(dirname(managedWhisperCmd), `whisper-server${ext}`) : null;
-  const serverCmd = managedServerCmd && existsSync(managedServerCmd) ? managedServerCmd : null;
+  const serverCmd = managedServerCmd && fileHasData(managedServerCmd) ? managedServerCmd : null;
   return {
     kind: 'managed-whisper.cpp',
     label: 'whisper.cpp',

package/src/runtime/channels/lib/webhook/relay-tunnel.mjs

@@ -8,8 +8,9 @@
 // verification stays local — the relay never inspects payloads. Works out
 // of the box: no binary, no authtoken, no reserved domain.
 import { randomBytes, randomUUID } from 'node:crypto';
-import { readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { readFileSync, chmodSync } from 'node:fs';
 import { join } from 'node:path';
+import { readJsonStateSync, writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { DATA_DIR } from '../config.mjs';
 import { logWebhook } from './log.mjs';
 import { MAX_HOOK_FRAME_BYTES, MAX_HOOK_HEADER_BYTES, MAX_TUNNEL_BODY_BYTES } from './relay-tunnel/limits.mjs';
@@ -55,19 +56,28 @@ function hookIdentityPath() {
   return join(DATA_DIR, 'relay-hook-device.json');
 }
 
+function validHookIdentity(parsed) {
+  if (
+    typeof parsed?.deviceId !== 'string' ||
+    !/^[0-9a-f-]{8,64}$/.test(parsed.deviceId) ||
+    typeof parsed.deviceSecret !== 'string' ||
+    parsed.deviceSecret.length < 16
+  ) {
+    throw new Error('invalid hook tunnel identity');
+  }
+  return { deviceId: parsed.deviceId, deviceSecret: parsed.deviceSecret };
+}
+
 // Stable per-install identity (trust-on-first-use at the relay, mirroring
 // the desktop leg). The secret never leaves this machine except toward the
 // relay; the deviceId doubles as the public URL path segment.
 function loadOrCreateHookIdentity() {
   const path = hookIdentityPath();
   try {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
-    if (
-      typeof parsed.deviceId === 'string' &&
-      /^[0-9a-f-]{8,64}$/.test(parsed.deviceId) &&
-      typeof parsed.deviceSecret === 'string' &&
-      parsed.deviceSecret.length >= 16
-    ) {
+    // A damaged identity (empty, NUL-filled, malformed) is kept aside and the
+    // last good copy restored; only when there is none is a new identity made.
+    const stored = readJsonStateSync(path, { validate: validHookIdentity, secret: true, fallback: null });
+    if (stored) {
       // The secret authenticates the webhook tunnel leg (whoever holds it can
       // take over inbound deliveries), so clamp legacy world-readable files.
       try {
@@ -75,20 +85,14 @@ function loadOrCreateHookIdentity() {
       } catch {
         /* windows/fs quirk */
       }
-      return { deviceId: parsed.deviceId, deviceSecret: parsed.deviceSecret };
+      return stored;
     }
-  } catch {
-    /* first run */
+  } catch (err) {
+    logWebhook(`hook tunnel: identity read failed — ${err?.message || err}`);
   }
   const identity = { deviceId: randomUUID(), deviceSecret: randomBytes(24).toString('hex') };
   try {
-    mkdirSync(DATA_DIR, { recursive: true });
-    writeFileSync(path, JSON.stringify(identity, null, 2), { encoding: 'utf8', mode: 0o600 });
-    try {
-      chmodSync(path, 0o600);
-    } catch {
-      /* windows/fs quirk */
-    }
+    writeJsonAtomicSync(path, identity, { secret: true, backup: true });
   } catch (err) {
     logWebhook(`hook tunnel: identity persist failed — ${err?.message || err}`);
   }

package/src/runtime/channels/lib/webhook/session-dispatch.mjs

@@ -2,8 +2,6 @@ import { logWebhook } from './log.mjs';
 import { recordEndpointEvent, updateDeliveryStatus } from '../webhooks-db.mjs';
 import { UNTRUSTED_MARKER, scrubFenceMarker } from './untrusted-fence.mjs';
 
-const DISPATCH_TIMEOUT_MS = 10 * 60 * 1000;
-
 /** The headers a run's prompt shows (and a stored event keeps). */
 function promptHeaders(headers) {
   return Object.fromEntries(Object.entries(headers || {}).filter(([k]) => k.startsWith('x-') || k === 'content-type'));
@@ -47,33 +45,16 @@ function webhookEventSummary(headers, body) {
   return [type, field(body?.action)].filter(Boolean).join(' · ').slice(0, 120);
 }
 
-function trackDispatch({ name, deliveryId, dispatchP, controller }) {
+function trackDispatch({ name, deliveryId, dispatchP, updateDeliveryStatus }) {
   let settled = false;
-  const timeoutHandle = setTimeout(
-    () => controller.abort(new Error(`bridge dispatch timed out after ${DISPATCH_TIMEOUT_MS}ms`)),
-    DISPATCH_TIMEOUT_MS
-  );
   const finish = (status, fields, message) => {
     if (settled) return;
     settled = true;
-    clearTimeout(timeoutHandle);
     void updateDeliveryStatus(name, deliveryId, status, fields).catch((e) =>
       logWebhook(`${name}: delivery status update failed: ${e?.message || e}`)
     );
     logWebhook(message);
   };
-  controller.signal.addEventListener(
-    'abort',
-    () => {
-      const reason = controller.signal.reason;
-      finish(
-        'failed',
-        { error: String(reason?.message || reason) },
-        `${name}: webhook session run aborted: ${reason?.message || reason}`
-      );
-    },
-    { once: true }
-  );
   dispatchP.then(
     (run) =>
       run?.skipped
@@ -88,23 +69,20 @@ function trackDispatch({ name, deliveryId, dispatchP, controller }) {
   );
 }
 
-function createWebhookSessionDispatcher({ getBridgeDispatch }) {
+// `store` is the delivery record (injectable for tests).
+function createWebhookSessionDispatcher({ getBridgeDispatch, store = { recordEndpointEvent, updateDeliveryStatus } }) {
+  const { recordEndpointEvent: recordEvent, updateDeliveryStatus: setStatus } = store;
   async function dispatchSessionRun(name, fullPrompt, deliveryId, res, extra = {}) {
-    await updateDeliveryStatus(name, deliveryId, 'processing');
-    // Session dispatch must not be allowed to hang forever — without a
-    // ceiling a stuck LLM call leaves the delivery in `processing`
-    // for the lifetime of the process and dedup keeps re-running
-    // forever. 10 minutes covers the slowest handler run we ship.
-    // Racing a bare timer against the dispatch promise reported failure while
-    // the run itself kept going: the delivery row was already `failed` when the
-    // late result arrived and flipped it again. The timeout now aborts the
-    // dispatch through a signal the dispatcher receives, and the first outcome
-    // to land is the only one that writes a terminal status.
-    const controller = new AbortController();
+    await setStatus(name, deliveryId, 'processing');
+    // The HTTP caller is answered 202 at once; the run is a turn in the bot's
+    // chat and has no deadline (a run may wait on the user's approval for as
+    // long as it takes), so nothing here cancels it. The delivery stays
+    // `processing` until the run ends, then `done` / `skipped` / `failed`; a
+    // second delivery meanwhile is skipped by the run's own overlap rule.
     const dispatchP = Promise.resolve(
       getBridgeDispatch()({
         prompt: fullPrompt,
-        signal: controller.signal,
+        signal: null,
         // The endpoint's project folder, named to the bot in the turn.
         cwd: extra.cwd || null,
         attachments: extra.attachments || null,
@@ -123,7 +101,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch }) {
         },
       })
     );
-    trackDispatch({ name, deliveryId, dispatchP, controller });
+    trackDispatch({ name, deliveryId, dispatchP, updateDeliveryStatus: setStatus });
     res.writeHead(202, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ status: 'accepted', handler: 'session', id: deliveryId }));
   }
@@ -135,7 +113,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch }) {
       if (!getBridgeDispatch()) throw new Error(`[webhook] session dispatch requires bridgeDispatch`);
       // Kept for the app's "Run now", which re-runs the latest event. Losing
       // the record never blocks the delivery itself.
-      await recordEndpointEvent(name, { body, headers: promptHeaders(headers) }).catch((e) =>
+      await recordEvent(name, { body, headers: promptHeaders(headers) }).catch((e) =>
         logWebhook(`${name}: event record failed: ${e?.message || e}`)
       );
       await dispatchSessionRun(name, run.prompt, deliveryId, res, {
@@ -148,7 +126,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch }) {
       });
       return true;
     } catch (err) {
-      await updateDeliveryStatus(name, deliveryId, 'failed', { error: String(err?.message || err) });
+      await setStatus(name, deliveryId, 'failed', { error: String(err?.message || err) });
       logWebhook(`${name}: folder handler error: ${err}`);
       return false;
     }

package/src/runtime/channels/lib/worker-main.mjs

@@ -10,6 +10,7 @@ import { Scheduler } from './scheduler.mjs';
 import { hasPending as dispatchHasPending } from '../../agent/orchestrator/dispatch-persist.mjs';
 import { stripSoftWarns } from '../../agent/orchestrator/tool-loop-guard.mjs';
 import { JsonStateFile } from './state-file.mjs';
+import { writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
 import {
   makeInstanceId,
   getStatusPath,
@@ -115,7 +116,7 @@ function writeBridgeState(active) {
   try {
     const stateFile = path.join(ensurePrivateRuntimeRoot(resolveRuntimeRoot()), 'bridge-state.json');
     fs.mkdirSync(path.dirname(stateFile), { recursive: true });
-    fs.writeFileSync(stateFile, JSON.stringify({ active, ts: Date.now() }));
+    writeJsonAtomicSync(stateFile, { active, ts: Date.now() }, { compact: true });
   } catch {}
 }
 function isChannelBridgeActive() {
@@ -225,7 +226,7 @@ function wireWebhookHandlers() {
       cwd: cwd || null,
       attachments: attachments || null,
       event: context?.event || '',
-      // Dispatch-timeout cancellation only works if the signal reaches the run.
+      // The dispatch has no deadline; a caller-supplied signal still reaches the run.
       signal: signal || null,
       prompt,
       skillSelection,

package/src/runtime/effort-judge/compact-tokenizer.mjs

@@ -7,8 +7,9 @@
 // arrays (~30 MB). The compact form is built once from tokenizer.json and
 // cached next to it as tokenizer.bin, keyed by the source file's size and
 // modification time.
-import { readFileSync, statSync, writeFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { writeFileAtomicSync } from '../shared/atomic-file.mjs';
 
 const MAGIC = 0x4d585442; // "MXTB"
 const VERSION = 3;
@@ -93,6 +94,9 @@ function readCached(dir) {
     const h = new Int32Array(buf.buffer, buf.byteOffset, 7);
     const [size, mtime] = sourceStamp(dir);
     if (h[0] !== MAGIC || h[1] !== VERSION || h[2] !== size || h[3] !== mtime % 2 ** 31) return null;
+    // header (28) + byte table (1024) + char pairs + merges + meta; a shorter
+    // file is torn and is rebuilt.
+    if (buf.length < 1052 + h[4] * 8 + h[5] * 12 + h[6]) return null;
     return buf;
   } catch {
     return null;
@@ -104,7 +108,9 @@ export function loadCompactTokenizer(dir) {
   let buf = readCached(dir);
   if (!buf) {
     buf = build(dir);
-    writeFileSync(join(dir, 'tokenizer.bin'), buf);
+    // Atomic: a torn cache (valid header, short body) would pass readCached's
+    // header check and then fail on every load.
+    writeFileAtomicSync(join(dir, 'tokenizer.bin'), buf);
   }
   // Copy into an aligned buffer so typed-array views are valid.
   const ab = new ArrayBuffer(buf.length);