mixdog 1.3.2 → 1.3.4

package/src/runtime/shared/llm/usage-rollup.mjs

@@ -1,78 +1,15 @@
 /**
- * Durable per-day usage rollup (provider × model).
- *
- * The gateway usage store keeps one raw event per turn, but it is bounded to a
- * recent window (TTL + row cap) because it exists to answer "what is happening
- * right now". Totals for a month ago cannot be recovered from it once the cap
- * evicts those rows, so every turn is ALSO folded into a per-day bucket here.
- * A bucket is a few numbers, which keeps years of history in one small file.
- *
- * Most turns on this machine are NOT the user typing: background runners
- * (memory cycles, schedules, webhooks) spend tokens on their own and outnumber
- * conversation turns several times over. Every bucket therefore carries a
- * `conversation` sub-total beside the full one, so "what did I spend" can be
- * answered without the background drowning it.
- *
- * Session token totals are kept id-keyed only while a day is recent; older days
- * keep the anonymous per-session totals alone. Only conversation sessions are
- * tracked: a background runner mints a fresh id per cycle, which would turn
- * "how many sessions" into a count of cycles.
- *
- * `firstTs`/`lastTs` bound the turns already folded into a day. A reader that
- * also holds the raw event list adds ONLY the events outside that span, which
- * is what lets both stores be read together without counting a turn twice.
- *
- * Shape:
- *   {
- *     version, updatedAt,
- *     days: {
- *       "2026-08-12": {
- *         turns, input, output, cacheRead, cacheWrite,
- *         costUsd, costBilled, costEstimated, costKnownTurns,
- *         durationMs, durationTurns, firstTs, lastTs,
- *         conversation: { …the same turn totals, user-driven turns only },
- *         conversationPartial,
- *         models: { "<provider>/<model>": {
- *           provider, model, kind, turns, input, output, cacheRead, cacheWrite,
- *           costUsd, conversation: { …route totals }
- *         } },
- *         sessions: { "<sessionId>": <tokens> },
- *         sessionTokens: [<tokens>, …],
- *         sessionsDropped
- *       }
- *     }
- *   }
+ * Day keys, conversation-source classification and numeric helpers shared by the
+ * usage ledger and the stats model. The daily JSON rollup these helpers were
+ * written for is no longer produced; its past day records are still imported
+ * by usage-ledger-import.mjs.
  */
-import { billableInputTokensForProvider } from './cost.mjs';
-
-const USAGE_ROLLUP_VERSION = 2;
-
-// A day costs well under a kilobyte, so a long retention stays cheap while
-// making "all time" mean something closer to the install date.
-const RETENTION_DAYS = 400;
-// Session ids are the only identifying values in the file; drop them once the
-// day is old enough that per-session drill-down no longer matters.
-const SESSION_DETAIL_DAYS = 45;
-const MAX_MODELS_PER_DAY = 80;
-const MAX_SESSION_IDS_PER_DAY = 400;
-const MAX_SESSION_TOKENS_PER_DAY = 400;
-const DAY_MS = 24 * 60 * 60 * 1000;
-const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 
 export function num(value) {
   const n = Number(value);
   return Number.isFinite(n) && n > 0 ? n : 0;
 }
 
-export function cleanId(value) {
-  const text = typeof value === 'string' ? value.trim() : '';
-  return text && !UNSAFE_KEYS.has(text) ? text.slice(0, 200) : '';
-}
-
-export function round6(value) {
-  return Math.round(value * 1e6) / 1e6;
-}
-
 /** Local calendar day, so "today" in the UI means the user's today. */
 export function usageRollupDayKey(ts) {
   const date = new Date(Number.isFinite(Number(ts)) ? Number(ts) : Date.now());
@@ -92,324 +29,8 @@ export function isConversationUsageSource(sourceType) {
   return !BACKGROUND_SOURCES.has(id);
 }
 
-function emptyRouteTotals() {
-  return {
-    turns: 0,
-    input: 0,
-    output: 0,
-    cacheRead: 0,
-    cacheWrite: 0,
-    costUsd: 0,
-    costBilled: 0,
-    costEstimated: 0,
-    costKnownTurns: 0,
-  };
-}
-
-function emptyTurnTotals() {
-  return {
-    ...emptyRouteTotals(),
-    durationMs: 0,
-    durationTurns: 0,
-  };
-}
-
-function addRouteTotals(target, turn, { priced, billed } = {}) {
-  target.turns += turn.turns;
-  target.input += turn.input;
-  target.output += turn.output;
-  target.cacheRead += turn.cacheRead;
-  target.cacheWrite += turn.cacheWrite;
-  target.costUsd = round6(target.costUsd + turn.costUsd);
-  if (priced) {
-    target.costKnownTurns += 1;
-    if (billed) target.costBilled = round6(target.costBilled + turn.costUsd);
-    else target.costEstimated = round6(target.costEstimated + turn.costUsd);
-  }
-}
-
-function addTurnTotals(target, turn, pricing) {
-  addRouteTotals(target, turn, pricing);
-  const { durationMs } = pricing;
-  if (durationMs > 0) {
-    target.durationMs += durationMs;
-    target.durationTurns += 1;
-  }
-}
-
-function emptyModel(provider, model) {
-  return {
-    provider,
-    model,
-    kind: '',
-    ...emptyRouteTotals(),
-    conversation: emptyRouteTotals(),
-  };
-}
-
-function emptyDay() {
-  return {
-    ...emptyTurnTotals(),
-    firstTs: 0,
-    lastTs: 0,
-    conversation: emptyTurnTotals(),
-    conversationPartial: false,
-    // Rebuilt from session transcripts rather than recorded turn by turn. The
-    // flag travels with the bucket so a surface can keep saying so long after
-    // the transcripts it came from are gone.
-    restored: false,
-    // Set once a day's pre-classification session ids have been cleared, which
-    // is what tells a reader the remaining ids can be trusted.
-    sessionsPurged: true,
-    models: {},
-    sessions: {},
-    sessionTokens: [],
-    sessionsDropped: 0,
-  };
-}
-
-function readRouteTotals(raw, target) {
-  target.turns = num(raw?.turns);
-  target.input = num(raw?.input);
-  target.output = num(raw?.output);
-  target.cacheRead = num(raw?.cacheRead);
-  target.cacheWrite = num(raw?.cacheWrite);
-  target.costUsd = round6(num(raw?.costUsd));
-  target.costBilled = round6(num(raw?.costBilled));
-  target.costEstimated = round6(
-    raw?.costEstimated == null ? Math.max(0, target.costUsd - target.costBilled) : num(raw.costEstimated)
-  );
-  if (raw?.costKnownTurns != null) target.costKnownTurns = num(raw.costKnownTurns);
-  else target.costKnownTurns = target.costUsd > 0 ? target.turns : 0;
-  return target;
-}
-
 /** Turns with a known cost: the recorded count, else every turn when the usage carries any cost at all. */
 export function knownCostTurns(usage, amount = num) {
   if (usage.costKnownTurns != null) return amount(usage.costKnownTurns);
   return amount(usage.costUsd) > 0 ? amount(usage.turns) : 0;
 }
-
-function readTurnTotals(raw, target) {
-  readRouteTotals(raw, target);
-  target.costEstimated = round6(num(raw?.costEstimated));
-  target.costKnownTurns = num(raw?.costKnownTurns);
-  target.durationMs = num(raw?.durationMs);
-  target.durationTurns = num(raw?.durationTurns);
-  return target;
-}
-
-function normalizeModel(raw, key) {
-  const slash = typeof key === 'string' ? key.indexOf('/') : -1;
-  const bucket = emptyModel(
-    cleanId(raw?.provider) || (slash > 0 ? key.slice(0, slash) : ''),
-    cleanId(raw?.model) || (slash > 0 ? key.slice(slash + 1) : '')
-  );
-  bucket.kind = cleanId(raw?.kind);
-  readRouteTotals(raw, bucket);
-  // A bucket written before turns carried a source has no split to read.
-  // `null` means unknown, which a reader must not quietly treat as zero.
-  bucket.conversation =
-    raw?.conversation && typeof raw.conversation === 'object'
-      ? readRouteTotals(raw.conversation, emptyRouteTotals())
-      : null;
-  return bucket;
-}
-
-function normalizeDay(raw) {
-  const day = emptyDay();
-  readTurnTotals(raw, day);
-  day.firstTs = num(raw?.firstTs);
-  day.lastTs = num(raw?.lastTs);
-  day.conversation =
-    raw?.conversation && typeof raw.conversation === 'object'
-      ? readTurnTotals(raw.conversation, emptyTurnTotals())
-      : null;
-  day.conversationPartial = raw?.conversationPartial === true;
-  day.restored = raw?.restored === true;
-  // A day that never held unclassified turns needs no purge; one that did is
-  // trusted only once it says the old ids were cleared.
-  day.sessionsPurged = !day.conversationPartial || raw?.sessionsPurged === true;
-  day.sessionsDropped = num(raw?.sessionsDropped);
-  const models = raw?.models && typeof raw.models === 'object' ? raw.models : {};
-  for (const [key, value] of Object.entries(models)) {
-    const id = cleanId(key);
-    if (!id) continue;
-    day.models[id] = normalizeModel(value, id);
-  }
-  const sessions = raw?.sessions && typeof raw.sessions === 'object' ? raw.sessions : {};
-  for (const [key, value] of Object.entries(sessions)) {
-    const id = cleanId(key);
-    if (!id) continue;
-    day.sessions[id] = num(value);
-  }
-  if (Array.isArray(raw?.sessionTokens)) {
-    day.sessionTokens = raw.sessionTokens.map(num).slice(-MAX_SESSION_TOKENS_PER_DAY);
-  }
-  return day;
-}
-
-/** Defensive read: a hand-edited or partially written file must not throw. */
-export function normalizeUsageRollup(raw) {
-  const days = {};
-  const source = raw?.days && typeof raw.days === 'object' ? raw.days : {};
-  for (const [key, value] of Object.entries(source)) {
-    if (!/^\d{4}-\d{2}-\d{2}$/.test(key)) continue;
-    days[key] = normalizeDay(value);
-  }
-  return {
-    version: USAGE_ROLLUP_VERSION,
-    updatedAt: num(raw?.updatedAt),
-    days,
-  };
-}
-
-/** Retention + identifier aging. Both bounds are evaluated against `now`. */
-function pruneUsageRollup(rollup, now = Date.now()) {
-  const dropBefore = usageRollupDayKey(now - RETENTION_DAYS * DAY_MS);
-  const anonymizeBefore = usageRollupDayKey(now - SESSION_DETAIL_DAYS * DAY_MS);
-  for (const [key, day] of Object.entries(rollup.days)) {
-    if (key < dropBefore) {
-      delete rollup.days[key];
-      continue;
-    }
-    if (key >= anonymizeBefore) continue;
-    const ids = Object.keys(day.sessions);
-    if (!ids.length) continue;
-    const archived = day.sessionTokens.concat(ids.map((id) => day.sessions[id]));
-    day.sessionTokens = archived.slice(-MAX_SESSION_TOKENS_PER_DAY);
-    day.sessions = {};
-  }
-  return rollup;
-}
-
-/**
- * Fold one gateway usage summary into the rollup. Pure: the caller owns the
- * document, which is what makes this testable without touching disk.
- */
-export function foldUsageRollup(current, summary, now = Date.now()) {
-  const rollup = normalizeUsageRollup(current);
-  const provider = cleanId(summary?.provider);
-  const model = cleanId(summary?.model);
-  // A turn that cannot be attributed to a route would silently inflate every
-  // total it lands in, so it is dropped rather than bucketed as "unknown".
-  if (!provider || !model) return pruneUsageRollup(rollup, now);
-
-  const at = Number(summary?.ts ?? summary?.at);
-  const ts = Number.isFinite(at) && at > 0 ? at : now;
-  const key = usageRollupDayKey(ts);
-  const day = rollup.days[key] || emptyDay();
-
-  const cacheRead = num(summary?.cacheReadTokens);
-  const cacheWrite = num(summary?.cacheWriteTokens);
-  const turn = {
-    turns: 1,
-    // Providers disagree about what `inputTokens` counts: several report the
-    // whole prompt with the cached part inside it. Stripping it where it is
-    // already included is what keeps one cache hit from being counted twice.
-    input: billableInputTokensForProvider(provider, num(summary?.inputTokens), cacheRead, cacheWrite),
-    output: num(summary?.outputTokens),
-    cacheRead,
-    cacheWrite,
-    costUsd: num(summary?.costUsd),
-  };
-  const tokens = turn.input + turn.output + turn.cacheRead + turn.cacheWrite;
-  const costSource = cleanId(summary?.costSource);
-  // costSource 'none' means neither the provider nor the catalog priced this
-  // turn; counting it keeps the surface honest about partial cost coverage.
-  const pricing = {
-    priced:
-      summary?.costUsd != null &&
-      Number.isFinite(Number(summary.costUsd)) &&
-      !['', 'none', 'unpriced'].includes(costSource),
-    billed: costSource === 'provider',
-    durationMs: num(summary?.durationMs),
-  };
-  const conversation = isConversationUsageSource(summary?.sourceType);
-
-  addTurnTotals(day, turn, pricing);
-  day.firstTs = day.firstTs > 0 ? Math.min(day.firstTs, ts) : ts;
-  day.lastTs = Math.max(day.lastTs, ts);
-  if (conversation) {
-    if (!day.conversation) {
-      // A day carried over from before turns were classified: what is already
-      // in it stays unattributed, and the flag lets a reader say so.
-      day.conversation = emptyTurnTotals();
-      day.conversationPartial = true;
-      // Those ids were collected while background cycles still counted, and
-      // most of them are cycles. Keeping them would report cycles as sessions.
-      day.sessions = {};
-      day.sessionTokens = [];
-      day.sessionsPurged = true;
-    }
-    addTurnTotals(day.conversation, turn, pricing);
-  }
-
-  const modelKey = `${provider}/${model}`;
-  const known = Object.hasOwn(day.models, modelKey);
-  if (known || Object.keys(day.models).length < MAX_MODELS_PER_DAY) {
-    const bucket = known ? day.models[modelKey] : emptyModel(provider, model);
-    bucket.kind = cleanId(summary?.providerKind) || bucket.kind;
-    addRouteTotals(bucket, turn, pricing);
-    if (conversation) {
-      if (!bucket.conversation) bucket.conversation = emptyRouteTotals();
-      addRouteTotals(bucket.conversation, turn, pricing);
-    }
-    day.models[modelKey] = bucket;
-  }
-
-  // Only conversation sessions are kept: a background runner mints a new id per
-  // cycle, so counting those would report cycles as sessions.
-  const sessionId = conversation ? cleanId(summary?.sessionId) : '';
-  if (sessionId) {
-    if (Object.hasOwn(day.sessions, sessionId)) {
-      day.sessions[sessionId] += tokens;
-    } else if (Object.keys(day.sessions).length < MAX_SESSION_IDS_PER_DAY) {
-      day.sessions[sessionId] = tokens;
-    } else {
-      day.sessionsDropped += 1;
-    }
-  }
-
-  rollup.days[key] = day;
-  rollup.updatedAt = now;
-  return pruneUsageRollup(rollup, now);
-}
-
-/**
- * Write transcript-rebuilt days into the rollup, so they outlive the sessions
- * they were derived from.
- *
- * The session store prunes: ephemeral sessions past 14 days or beyond the
- * newest 300 are deleted, which silently takes their tokens out of any figure
- * derived from them. The rollup is a few numbers per day kept for 400 days, so
- * once a rebuilt day lands here it stops depending on the transcripts at all.
- *
- * Recording always wins. A day the rollup already holds is left exactly as it
- * is — including a day already frozen this way, because re-deriving it from a
- * half-pruned store would quietly shrink it.
- *
- * Pure: the caller owns the document.
- */
-export function freezeRestoredDays(current, historyDays, now = Date.now()) {
-  const rollup = normalizeUsageRollup(current);
-  const source = historyDays && typeof historyDays === 'object' ? historyDays : {};
-  const dropBefore = usageRollupDayKey(now - RETENTION_DAYS * DAY_MS);
-  const today = usageRollupDayKey(now);
-  let frozen = 0;
-  for (const [key, day] of Object.entries(source)) {
-    if (!/^\d{4}-\d{2}-\d{2}$/.test(key)) continue;
-    if (Object.hasOwn(rollup.days, key)) continue;
-    if (key < dropBefore) continue;
-    // Today is still being recorded turn by turn; freezing it now would pin a
-    // partial rebuild and lock out the rest of the day's real events.
-    if (key >= today) continue;
-    const bucket = normalizeDay(day);
-    if (bucket.turns <= 0) continue;
-    bucket.restored = true;
-    rollup.days[key] = bucket;
-    frozen += 1;
-  }
-  if (frozen > 0) rollup.updatedAt = now;
-  return { rollup, frozen };
-}

package/src/runtime/shared/redact-directories.mjs

@@ -0,0 +1,18 @@
+import { pathToFileURL } from 'node:url';
+
+/**
+ * `text` with every mention of the given directories taken out (and the
+ * separator after it), whether written as a native path, with forward slashes
+ * or as a file URL, so an error never discloses a private scratch location.
+ */
+export function redactDirectories(text, directories) {
+  let out = String(text ?? '');
+  for (const directory of directories) {
+    if (!directory) continue;
+    const forms = new Set([directory, directory.replaceAll('\\', '/'), pathToFileURL(directory).href]);
+    for (const form of [...forms].sort((a, b) => b.length - a.length)) {
+      out = out.split(`${form}\\`).join('').split(`${form}/`).join('').split(form).join('');
+    }
+  }
+  return out;
+}

package/src/runtime/shared/remove-directory.mjs

@@ -0,0 +1,28 @@
+import { rm } from 'node:fs/promises';
+
+export const REMOVE_RETRY_MS = 100;
+const REMOVE_ATTEMPTS = 6;
+const RETRYABLE_REMOVE_CODES = new Set(['EBUSY', 'EPERM', 'ENOTEMPTY', 'EACCES']);
+
+/**
+ * Removes a private scratch folder. A process that just exited can still hold
+ * its files for a moment on Windows, so a busy folder is retried briefly; a
+ * failure that persists is logged (never swallowed) and does not throw.
+ */
+export async function removeDirectoryWithRetry(
+  dir,
+  { remove = rm, log = (line) => process.stderr.write(line), retryMs = REMOVE_RETRY_MS } = {}
+) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await remove(dir, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      if (attempt >= REMOVE_ATTEMPTS || !RETRYABLE_REMOVE_CODES.has(error?.code)) {
+        log(`scratch folder ${dir} could not be removed: ${error?.message || error}\n`);
+        return;
+      }
+      await new Promise((resolve) => setTimeout(resolve, retryMs * attempt));
+    }
+  }
+}

package/src/runtime/shared/session-sidebar-host.d.mts

@@ -1,4 +1,13 @@
-export type SessionSidebarChange = { favorite: boolean } | { archived: boolean };
+export type SessionSidebarChange =
+  | { favorite: boolean }
+  | { archived: boolean }
+  | { archived: true; cascade: false }
+  | { forgotten: true };
 export type SessionSidebarHost = (sessionId: unknown, change: unknown) => unknown;
-export function registerSessionSidebarHost(host: SessionSidebarHost): () => void;
+export type SessionSidebarState = { archived: Record<string, number> };
+export function registerSessionSidebarHost(
+  host: SessionSidebarHost,
+  options?: { state?: (() => SessionSidebarState | Promise<SessionSidebarState>) | null }
+): () => void;
 export function applySessionSidebarChange(sessionId: string, change: SessionSidebarChange): Promise<void>;
+export function readSessionSidebarState(): Promise<SessionSidebarState | null>;

package/src/runtime/shared/session-sidebar-host.mjs

@@ -15,11 +15,15 @@ function hosts() {
 
 /**
  * Register a desktop host. `host(sessionId, change)` applies one change:
- * `{ favorite: boolean }` or `{ archived: boolean }`.
+ * `{ favorite: boolean }`, `{ archived: boolean }` (an archive takes the
+ * session's sub-agent sessions with it, a restore brings back the ones it took),
+ * `{ archived: true, cascade: false }` (that session alone)
+ * or `{ forgotten: true }` (a session the store deleted: its records go).
+ * `state()` answers the archive flags: `{ archived }`, session id → stamp.
  * @returns {() => void} Unregister.
  */
-export function registerSessionSidebarHost(host) {
-  const entry = { host };
+export function registerSessionSidebarHost(host, { state = null } = {}) {
+  const entry = { host, state: typeof state === 'function' ? state : null };
   hosts().push(entry);
   return () => {
     const list = hosts();
@@ -36,3 +40,12 @@ export async function applySessionSidebarChange(sessionId, change) {
   if (!active) throw new Error('no desktop app is attached to this runtime');
   await active.host(sessionId, change);
 }
+
+/** The active desktop's flags, `{ archived }` (session id → epoch-ms stamp);
+ *  null when no desktop (or one without a state reader) is attached. */
+export async function readSessionSidebarState() {
+  const active = hosts().at(-1);
+  if (!active?.state) return null;
+  const state = await active.state();
+  return { archived: { ...state?.archived } };
+}

package/src/runtime/shared/tool-execution-contract.mjs

@@ -1,4 +1,5 @@
 import { clean } from './clean.mjs';
+import { hopOf } from './bot-hops.mjs';
 import {
   parseTaskNotification,
   renderTaskCompletionEnvelope,
@@ -113,6 +114,8 @@ export function normalizeToolNotifyContext(context = {}) {
     callerSessionId: callerSessionId || null,
     routingSessionId: routingSessionId || null,
     clientHostPid,
+    // The bot-chain hop of the turn that launched the work (bot-hops.mjs).
+    ...(hopOf(context.hop) ? { hop: context.hop } : {}),
   };
 }
 
@@ -133,6 +136,7 @@ function toolCompletionMeta({ surface = 'tool', id, status, resultType, instruct
       ? { routing_session_id: ctx.routingSessionId }
       : {}),
     ...(ctx.clientHostPid ? { client_host_pid: String(ctx.clientHostPid) } : {}),
+    ...(ctx.hop ? { hop: ctx.hop } : {}),
   };
 }
 

package/src/runtime/shared/tool-work-units.mjs

@@ -573,6 +573,15 @@ function gitStageUnit(a) {
   });
 }
 
+function gitWorktreeUnit(a) {
+  return unitDescriptor('Git', {
+    active: 'Managing',
+    done: 'Managed',
+    noun: 'worktree',
+    effect: String(a.worktree_action || '').toLowerCase() !== 'list',
+  });
+}
+
 function cwdUnit(a) {
   const action = String(a.action || a.type || '').toLowerCase();
   // A bare `path` selects that Project even when action is omitted.
@@ -604,14 +613,6 @@ function cwdUnit(a) {
     const [active, done] = words;
     return unitDescriptor('Setup', { active, done, noun: 'session', effect: true });
   }
-  if (action.endsWith('-worktree') || action.endsWith('-worktrees')) {
-    return unitDescriptor('Setup', {
-      active: 'Managing',
-      done: 'Managed',
-      noun: 'worktree',
-      effect: !action.startsWith('list'),
-    });
-  }
   if (action === 'status') {
     return unitDescriptor('Setup', { active: 'Checking', done: 'Checked', noun: 'session' });
   }
@@ -715,7 +716,9 @@ const TOOL_UNITS = new Map([
     (a) =>
       a.action === 'stage'
         ? gitStageUnit(a)
-        : unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' }),
+        : a.action === 'worktree'
+          ? gitWorktreeUnit(a)
+          : unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' }),
   ],
   ['github', githubUnit],
   // Preserve the staging work unit when rendering historical transcripts.