mixdog 1.3.3 → 1.3.5

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -609,14 +609,47 @@ function balanceFromAnthropicSpend(spend) {
   return null;
 }
 
+// The server's limit id, in the one spelling headers and the usage payload share.
+const codexLimitId = (value) => (cleanString(value) || '').toLowerCase().replace(/-/g, '_');
+
+// Model-specific limits beside the plan's own: one per server limit id
+// (`metered_feature`), whose `limit_name` names the model it meters. Each
+// window gates that model alone.
+function codexAdditionalLimits(list) {
+  return (Array.isArray(list) ? list : []).flatMap((entry) => {
+    const limit = codexLimitId(entry?.metered_feature || entry?.limit_name);
+    if (!limit) return [];
+    const name = cleanString(entry.limit_name) || limit;
+    const rate = entry.rate_limit && typeof entry.rate_limit === 'object' ? entry.rate_limit : {};
+    const windows = [
+      windowFromPercent('5H', rate.primary_window || rate.primary, 'openai-codex-oauth'),
+      windowFromPercent('7D', rate.secondary_window || rate.secondary, 'openai-codex-oauth'),
+    ]
+      .filter(Boolean)
+      .map((window) => ({ ...window, label: `${window.label} ${name}`, limit, models: [name.toLowerCase()] }));
+    // A limit without a usable window meters nothing we can read: its model
+    // stays under the plan's windows.
+    return windows.length ? [{ model: name.toLowerCase(), windows }] : [];
+  });
+}
+
 export function normalizeOpenAIWhamUsage(data) {
   const rate = data?.rate_limit && typeof data.rate_limit === 'object' ? data.rate_limit : null;
   if (!rate) return null;
+  const additional = codexAdditionalLimits(data.additional_rate_limits);
+  // The plan's windows gate every model that no model-specific limit meters.
+  const plan = {
+    limit: 'codex',
+    ...(additional.length ? { except: additional.map((entry) => entry.model) } : {}),
+  };
   const windows = [
     windowFromPercent('5H', rate.primary_window || rate.primary, 'openai-codex-oauth'),
     windowFromPercent('7D', rate.secondary_window || rate.secondary, 'openai-codex-oauth'),
-  ].filter(Boolean);
+  ]
+    .filter(Boolean)
+    .map((window) => ({ ...window, ...plan }));
   if (!windows.length) return null;
+  windows.push(...additional.flatMap((entry) => entry.windows));
   return {
     provider: 'openai-oauth',
     source: 'openai-codex-wham',
@@ -687,12 +720,14 @@ function anthropicLimitWindows(limits, source) {
     .filter(Boolean);
 }
 
-// The extra-usage (pay-as-you-go) window when it is enabled, else null.
+// The extra-usage (pay-as-you-go) window when it is enabled, else null. It is
+// shown, never a limit: paid overage spent to its cap leaves the plan's own
+// windows serving, so it gates no model (`models: []`).
 function anthropicExtraUsageWindow(extraUsage) {
   if (extraUsage?.is_enabled !== true) return null;
   const limitUsd = num(extraUsage.monthly_limit, 0) / 100;
   const usedUsd = num(extraUsage.used_credits, 0) / 100;
-  return windowFromPercent(
+  const window = windowFromPercent(
     'EXTRA',
     {
       utilization: extraUsage.utilization,
@@ -702,6 +737,7 @@ function anthropicExtraUsageWindow(extraUsage) {
     },
     'anthropic-oauth-extra'
   );
+  return window ? { ...window, models: [] } : null;
 }
 
 export function normalizeAnthropicUsage(data, source = 'anthropic-oauth') {

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream/stream-state.mjs

@@ -23,6 +23,8 @@ export function createCompatStreamState({
   onToolCall,
   onTextDelta,
   onStreamItemStart,
+  // false: text stays text; only native tool_calls deltas become calls.
+  leakedToolCallRecovery = true,
 }) {
   const toolDedupe = createToolCallDedupe();
   return {
@@ -49,7 +51,7 @@ export function createCompatStreamState({
     rawUsage: null,
     toolAcc: createToolCallAccumulator(),
     streamEmitState: { emittedToolCallKeys: new Set(), emittedToolCall: false, _toolDedupe: toolDedupe },
-    leakGuard: createLeakGuard({ knownToolNames, harmony: true }),
+    leakGuard: createLeakGuard({ knownToolNames: leakedToolCallRecovery ? knownToolNames : [], harmony: true }),
     leakedCalls: [],
     pendingLeakedCalls: [],
   };

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream.mjs

@@ -44,6 +44,7 @@ export async function consumeCompatChatCompletionStream(
     knownToolNames,
     semanticIdleTimeoutMs,
     firstByteTimeoutMs,
+    leakedToolCallRecovery = true,
   } = {}
 ) {
   const idleOverrideEnabled = Number.isFinite(Number(semanticIdleTimeoutMs)) && Number(semanticIdleTimeoutMs) > 0;
@@ -57,6 +58,7 @@ export async function consumeCompatChatCompletionStream(
     onToolCall,
     onTextDelta,
     onStreamItemStart,
+    leakedToolCallRecovery,
   });
   reportTransport(state);
   const iterator = stream[Symbol.asyncIterator]();

package/src/runtime/agent/orchestrator/providers/openai-error-contract.mjs

@@ -7,6 +7,7 @@
  *   headers              response headers (HTTP, WS handshake, nested error.headers)
  *   retryAfterMs         server advice, uncapped (Retry-After / Retry-After-Ms)
  *   resetAt              epoch ms from quota reset fields (resets_at, resets_in_seconds)
+ *   quotaLimit           limit id from x-codex-active-limit, `-` normalized to `_`
  *
  * Pure: no I/O. Message text is never parsed for status or code.
  */
@@ -18,7 +19,7 @@ const isObject = (value) => value !== null && typeof value === 'object' && !Arra
  * Parse an HTTP error body ONCE into its contract fields. `message` is the
  * body's own message (untruncated); callers truncate for diagnostics.
  */
-export function parseErrorBody(text) {
+function parseErrorBody(text) {
   let json = null;
   try {
     json = JSON.parse(String(text || ''));
@@ -206,6 +207,10 @@ export function applyErrorContract(err, { status, headers, code, error, event }
     const wireHeaders =
       headers ?? error?.headers ?? event?.error?.headers ?? event?.response?.error?.headers ?? event?.headers;
     if (wireHeaders && typeof wireHeaders === 'object') err.headers = wireHeaders;
+    // The limit a refusal hit, by the server's limit id (`codex` is the plan's
+    // own; others are model-specific), so the account pool blocks only it.
+    const activeLimit = headerValue(err.headers, 'x-codex-active-limit').toLowerCase().replace(/-/g, '_');
+    if (activeLimit) err.quotaLimit = activeLimit;
     const rawCode = code ?? error?.code ?? error?.type ?? null;
     if (typeof rawCode === 'string' && rawCode.trim()) err.code = rawCode.trim().toLowerCase();
     const resetAt = resetAtFrom(error, event?.error, event?.response?.error, event);

package/src/runtime/agent/orchestrator/providers/opencode-go-gemini.mjs

@@ -144,6 +144,7 @@ export class OpenCodeGoGeminiEngine extends GeminiProvider {
           );
         },
         afterToolResult: geminiEndsWithFunctionResponse(contents),
+        failureUsage: geminiFailureUsage(opts, null, useModel),
         run: async ({ signal: attemptSignal, connected }) => {
           try {
             opts.onStageChange?.('requesting');

package/src/runtime/agent/orchestrator/providers/provider-availability.mjs

@@ -0,0 +1,19 @@
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { isOAuthProviderAvailable } from './oauth-credential-probes.mjs';
+
+/**
+ * Whether the named provider may be looked up or sent through right now. Remote
+ * client mode serves the PC's providers, whose availability the PC already
+ * decided; only a locally run provider answers to the local Developer option.
+ */
+export function providerAvailable(name) {
+  return modelProxyClientMode() || isOAuthProviderAvailable(name);
+}
+
+/** The error a send raises when its provider was switched off after lookup. */
+export function providerUnavailableError(name) {
+  return Object.assign(
+    new Error(`Provider "${name}" is disabled: its Developer option was switched off before the request was sent.`),
+    { code: 'EPROVIDERUNAVAILABLE', provider: name }
+  );
+}

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -1,5 +1,6 @@
 import { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
 import { oauthCredentialProbeState } from './oauth-credential-probes.mjs';
+import { providerAvailable } from './provider-availability.mjs';
 import { refreshCatalog as refreshMetadataCatalog } from './model-catalog.mjs';
 import { wrapProviderAdmission } from './admission-scheduler.mjs';
 import { createAccountPoolProvider } from './account-pool.mjs';
@@ -33,6 +34,7 @@ export const OAUTH_PROVIDER_NAMES = new Set([
   'command-code-oauth',
   'mimo-oauth',
   'cursor-oauth',
+  'devin-oauth',
   'antigravity-oauth',
   'opencode-go-oauth',
 ]);
@@ -176,6 +178,7 @@ const PROVIDER_MODULES = {
   'command-code-oauth': ['./command-code-oauth.mjs', 'CommandCodeOAuthProvider'],
   'mimo-oauth': ['./mimo-oauth.mjs', 'MimoOAuthProvider'],
   'cursor-oauth': ['./cursor.mjs', 'CursorOAuthProvider'],
+  'devin-oauth': ['./devin.mjs', 'DevinOAuthProvider'],
   'antigravity-oauth': ['./antigravity-oauth.mjs', 'AntigravityOAuthProvider'],
   'cursor-api': ['./cursor.mjs', 'CursorApiProvider'],
   openai: ['./openai-ws.mjs', 'OpenAIDirectProvider'],
@@ -290,6 +293,9 @@ async function _initProvidersUnsynchronized(config, signal = null, proxyChannel
   const enabledResults = await Promise.all(
     entries.map(async ([name, cfg]) => {
       if (!cfg.enabled) return null;
+      // A dev-gated provider whose Developer option is off is never admitted,
+      // even from a config that still says enabled:true.
+      if (!providerAvailable(name)) return null;
       // A retired provider's saved config is inert: its replacement is its own entry.
       if (Object.hasOwn(RETIRED_PROVIDER_ALIASES, name)) return null;
       // Idempotent reuse: an enabled provider whose config signature is
@@ -450,6 +456,9 @@ export function getProvider(requestedName) {
   const name = Object.hasOwn(RETIRED_PROVIDER_ALIASES, requestedName)
     ? RETIRED_PROVIDER_ALIASES[requestedName]
     : requestedName;
+  // Availability first: switching a dev-gated provider's option off takes
+  // effect on the next lookup, even for an already-initialized instance.
+  if (!providerAvailable(name)) return undefined;
   const cached = providers.get(name);
   if (cached) return cached;
   // OAuth lazy fallback. Covers the boot-time race where the credential probe
@@ -539,7 +548,12 @@ export function providerConsumesReadWindows(name) {
 export function getAllProviders() {
   // Defensive copy — callers must not mutate the live registry or retain
   // stale entries across re-init (initProviders rebuilds the map in place).
-  return new Map(providers);
+  return new Map(availableProviderEntries());
+}
+
+// Live instances minus dev-gated providers whose Developer option is off.
+function availableProviderEntries() {
+  return [...providers].filter(([name]) => providerAvailable(name));
 }
 
 export function disableProvider(name) {
@@ -629,7 +643,7 @@ export function refreshProviderCatalogsOnStartup() {
   if (_startupCatalogRefreshPromise) return _startupCatalogRefreshPromise;
   armNextCatalogRefresh();
   const pending = [];
-  for (const [name, provider] of providers) {
+  for (const [name, provider] of availableProviderEntries()) {
     const refreshFn = providerCatalogRefreshFn(provider);
     if (!refreshFn) continue;
     pending.push(boundedCatalogRefresh(name, provider, refreshFn, 'startup catalog refresh'));
@@ -669,7 +683,7 @@ export function refreshCatalogs(options = {}) {
     const msg = error instanceof Error ? error.message : String(error);
     process.stderr.write(`[model-catalog] metadata refresh failed: ${msg}\n`);
   });
-  for (const [name, provider] of providers) {
+  for (const [name, provider] of availableProviderEntries()) {
     const refreshFn = providerCatalogRefreshFn(provider);
     if (!refreshFn) continue;
     pending.push(metadataReady.then(() => boundedCatalogRefresh(name, provider, refreshFn, 'catalog refresh')));

package/src/runtime/agent/orchestrator/providers/wire-protobuf-codec.mjs

@@ -0,0 +1,368 @@
+// Schema-driven protobuf wire codec shared by the handwritten provider wires.
+//
+// A schema table maps message type names to `protobufFields([...])` rows of
+// `[name, fieldNo, type, options]`. Types are scalars ('string', 'bytes',
+// 'raw', 'bool', 'int', 'uint', 'double', 'float'), another message type name
+// from the same table, or `mapOf(keyType, valueType)`. Options:
+//   repeated  — the field is an array (numeric ones packed only when the
+//               codec is created with `packed: true`).
+//   presence  — explicit presence (proto3 `optional` / oneof member): the value
+//               is written even when it equals the type default.
+// 'int' covers int32/int64/enum (two's-complement varint); 'uint' covers
+// uint32/uint64. Both decode to number.
+// Width-specific varint types follow protobuf's per-width rules instead:
+//   'int32' / 'enum' — integer number, truncated to 32 bits; decodes to number.
+//   'uint32'         — non-negative integer number, truncated to 32 bits; a
+//                      varint longer than 5 bytes is rejected; decodes to number.
+//   'int64'          — bigint, integer number or decimal string, truncated to
+//                      64 bits; decodes to a signed bigint.
+//   'uint64'         — as int64 but negative input is rejected; decodes to an
+//                      unsigned bigint.
+// Decoded objects carry only fields seen on the wire, plus `$unknown` for
+// unrecognised fields.
+
+export function protobufFields(entries) {
+  return Object.fromEntries(entries.map(([name, no, type, options = {}]) => [no, { name, no, type, ...options }]));
+}
+
+export const mapOf = (key, value) => ({ map: [key, value] });
+export const repeated = Object.freeze({ repeated: true });
+export const presence = Object.freeze({ presence: true });
+
+const textEncoder = new TextEncoder();
+const WIDTH_TYPES = new Set(['int32', 'enum', 'uint32', 'int64', 'uint64']);
+const PACKABLE_TYPES = new Set(['bool', 'int', 'uint', 'double', 'float', ...WIDTH_TYPES]);
+
+export function concatBytes(parts) {
+  const length = parts.reduce((sum, part) => sum + part.length, 0);
+  const output = new Uint8Array(length);
+  let offset = 0;
+  for (const part of parts) {
+    output.set(part, offset);
+    offset += part.length;
+  }
+  return output;
+}
+
+export function encodeVarint(value) {
+  let current = BigInt(value ?? 0);
+  if (current < 0) current = BigInt.asUintN(64, current);
+  const bytes = [];
+  do {
+    let byte = Number(current & 0x7fn);
+    current >>= 7n;
+    if (current) byte |= 0x80;
+    bytes.push(byte);
+  } while (current);
+  return Uint8Array.from(bytes);
+}
+
+export function encodeTag(no, wireType) {
+  return encodeVarint((BigInt(no) << 3n) | BigInt(wireType));
+}
+
+function isDefaultScalar(value) {
+  if (value === 0 || value === 0n || value === false || value === '') return true;
+  return value instanceof Uint8Array && value.length === 0;
+}
+
+// `label` prefixes every error ("Cursor protobuf"). `strict` rejects wire-type
+// mismatches, field number 0, malformed UTF-8, varints longer than 10 bytes and
+// truncated fixed-width values instead of decoding them leniently.
+// `omitDefaults` skips proto3 implicit-presence fields that hold their type
+// default, which yields canonical proto3 bytes; repeated elements are always
+// written, defaults included. `packed` encodes repeated numeric fields packed
+// and decodes them from either packed or unpacked wire form.
+export function createProtobufCodec(
+  schemas,
+  { label = 'protobuf', strict = false, omitDefaults = false, packed = false } = {}
+) {
+  // A protobuf string is data, not a text document with a disposable BOM.
+  const textDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: strict });
+
+  const isMessageType = (type) => typeof type === 'string' && Object.hasOwn(schemas, type);
+
+  function wireTypeFor(type) {
+    if (type === 'double') return 1;
+    if (type === 'float') return 5;
+    if (type?.map || ['string', 'bytes', 'raw'].includes(type) || isMessageType(type)) return 2;
+    return 0;
+  }
+
+  function scalarBytes(type, value) {
+    if (type === 'string') return textEncoder.encode(String(value));
+    if (type === 'bytes' || type === 'raw') return value instanceof Uint8Array ? value : new Uint8Array(value);
+    if (type === 'double' || type === 'float') {
+      const size = type === 'double' ? 8 : 4;
+      const buffer = new ArrayBuffer(size);
+      const view = new DataView(buffer);
+      if (size === 8) view.setFloat64(0, Number(value), true);
+      else view.setFloat32(0, Number(value), true);
+      return new Uint8Array(buffer);
+    }
+    if (type === 'bool') return encodeVarint(value ? 1 : 0);
+    if (type === 'int' || type === 'uint') return encodeVarint(value);
+    if (WIDTH_TYPES.has(type)) return encodeVarint(BigInt.asUintN(64, BigInt(widthValue(type, value))));
+    if (isMessageType(type)) return encodeMessage(type, value);
+    throw new Error(`Unknown ${label} type: ${type}`);
+  }
+
+  // Validated, width-truncated value of a width-specific varint field.
+  function widthValue(type, value) {
+    if (type === 'int64' || type === 'uint64') {
+      let big;
+      if (typeof value === 'bigint') big = value;
+      else if (typeof value === 'number' && Number.isInteger(value)) big = BigInt(value);
+      else if (typeof value === 'string') {
+        try {
+          big = BigInt(value);
+        } catch {
+          // Reported below with the field type.
+        }
+      }
+      if (big === undefined) throw new Error(`Invalid ${label} ${type} value: ${typeof value}`);
+      if (type === 'uint64' && big < 0n) throw new Error(`Invalid ${label} uint64 value: negative`);
+      return big;
+    }
+    if (typeof value !== 'number' || !Number.isInteger(value)) {
+      throw new Error(`Invalid ${label} ${type} value: ${typeof value}`);
+    }
+    if (type === 'uint32') {
+      if (value < 0) throw new Error(`Invalid ${label} uint32 value: negative`);
+      return value >>> 0;
+    }
+    return value | 0;
+  }
+
+  function shouldWrite(type, value) {
+    if (value == null) return false;
+    if (WIDTH_TYPES.has(type)) return !(omitDefaults && BigInt(widthValue(type, value)) === 0n);
+    if (type === 'string') return value !== '';
+    if (omitDefaults && !isMessageType(type)) return !isDefaultScalar(value);
+    return true;
+  }
+
+  function encodeField(no, type, value) {
+    const wireType = wireTypeFor(type);
+    const payload = scalarBytes(type, value);
+    if (wireType === 2) return concatBytes([encodeTag(no, wireType), encodeVarint(payload.length), payload]);
+    return concatBytes([encodeTag(no, wireType), payload]);
+  }
+
+  function encodeMapField(no, [keyType, valueType], value) {
+    const parts = [];
+    for (const [key, entryValue] of Object.entries(value || {})) {
+      const entry = concatBytes([encodeField(1, keyType, key), encodeField(2, valueType, entryValue)]);
+      parts.push(concatBytes([encodeTag(no, 2), encodeVarint(entry.length), entry]));
+    }
+    return parts;
+  }
+
+  function encodeMessage(type, value = {}) {
+    const schema = schemas[type];
+    if (!schema) throw new Error(`Unknown ${label} message: ${type}`);
+    const parts = [];
+    for (const descriptor of Object.values(schema)) {
+      const fieldValue = value[descriptor.name];
+      if (descriptor.type?.map) {
+        parts.push(...encodeMapField(descriptor.no, descriptor.type.map, fieldValue));
+        continue;
+      }
+      let values = [fieldValue];
+      if (descriptor.repeated) {
+        values = Array.isArray(fieldValue) ? fieldValue : [];
+        if (packed && PACKABLE_TYPES.has(descriptor.type)) {
+          if (values.length) {
+            const payload = concatBytes(values.map((item) => scalarBytes(descriptor.type, item)));
+            parts.push(concatBytes([encodeTag(descriptor.no, 2), encodeVarint(payload.length), payload]));
+          }
+          continue;
+        }
+      }
+      for (const item of values) {
+        // A oneof's explicit empty string is a value, not an absent field;
+        // canonical proto3 keeps every repeated element.
+        const explicit = descriptor.presence || (omitDefaults && descriptor.repeated);
+        if ((explicit && item != null) || shouldWrite(descriptor.type, item)) {
+          parts.push(encodeField(descriptor.no, descriptor.type, item));
+        }
+      }
+    }
+    return concatBytes(parts);
+  }
+
+  class ProtoReader {
+    constructor(bytes) {
+      this.bytes = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+      this.offset = 0;
+    }
+
+    get done() {
+      return this.offset >= this.bytes.length;
+    }
+
+    varint() {
+      let value = 0n;
+      let shift = 0n;
+      while (!this.done) {
+        const byte = this.bytes[this.offset++];
+        value |= BigInt(byte & 0x7f) << shift;
+        if ((byte & 0x80) === 0) return value;
+        shift += 7n;
+        if (shift > (strict ? 63n : 70n)) throw new Error(`Invalid ${label} varint`);
+      }
+      throw new Error(`Truncated ${label} varint`);
+    }
+
+    // A 32-bit varint: at most 5 bytes, bits past 32 dropped.
+    varint32() {
+      let value = 0n;
+      for (let index = 0; index < 5; index++) {
+        if (this.done) throw new Error(`Truncated ${label} varint`);
+        const byte = this.bytes[this.offset++];
+        value |= BigInt(byte & 0x7f) << BigInt(7 * index);
+        if ((byte & 0x80) === 0) return Number(value & 0xffffffffn);
+      }
+      throw new Error(`Invalid ${label} 32-bit varint`);
+    }
+
+    take(length) {
+      const end = this.offset + length;
+      if (end > this.bytes.length) throw new Error(`Truncated ${label} field`);
+      const value = this.bytes.subarray(this.offset, end);
+      this.offset = end;
+      return value;
+    }
+
+    bytesValue() {
+      return this.take(Number(this.varint()));
+    }
+
+    skip(wireType) {
+      if (wireType === 0) this.varint();
+      else if (wireType === 1) this.take(8);
+      else if (wireType === 2) this.bytesValue();
+      else if (wireType === 5) this.take(4);
+      else throw new Error(`Unsupported ${label} wire type: ${wireType}`);
+    }
+  }
+
+  function decodeString(bytes) {
+    try {
+      return textDecoder.decode(bytes);
+    } catch (error) {
+      throw new Error(`Invalid ${label} UTF-8 string`, { cause: error });
+    }
+  }
+
+  function decodeScalar(reader, type, wireType) {
+    if (type === 'string') return decodeString(reader.bytesValue());
+    if (type === 'bytes' || type === 'raw') return new Uint8Array(reader.bytesValue());
+    if (type === 'double') {
+      if (wireType !== 1) throw new Error(`Invalid ${label} double`);
+      if (strict) {
+        const bytes = reader.take(8);
+        return new DataView(bytes.buffer, bytes.byteOffset, 8).getFloat64(0, true);
+      }
+      // Lenient read: the view is bounded by the backing buffer only.
+      const value = new DataView(reader.bytes.buffer, reader.bytes.byteOffset + reader.offset, 8).getFloat64(0, true);
+      reader.offset += 8;
+      return value;
+    }
+    if (type === 'float') {
+      if (wireType !== 5) throw new Error(`Invalid ${label} float`);
+      const bytes = reader.take(4);
+      return new DataView(bytes.buffer, bytes.byteOffset, 4).getFloat32(0, true);
+    }
+    if (type === 'bool') return reader.varint() !== 0n;
+    if (type === 'int') return Number(BigInt.asIntN(64, reader.varint()));
+    if (type === 'uint') return Number(reader.varint());
+    if (type === 'int32' || type === 'enum') return Number(BigInt.asIntN(32, reader.varint()));
+    if (type === 'uint32') return reader.varint32();
+    if (type === 'int64') return BigInt.asIntN(64, reader.varint());
+    if (type === 'uint64') return BigInt.asUintN(64, reader.varint());
+    if (isMessageType(type)) return decodeMessage(type, reader.bytesValue());
+    throw new Error(`Unknown ${label} type: ${type}`);
+  }
+
+  function checkWireType(descriptorName, type, wireType) {
+    if (strict && wireType !== wireTypeFor(type)) {
+      throw new Error(`Invalid ${label} wire type ${wireType} for ${descriptorName}`);
+    }
+  }
+
+  function decodeMapEntry(bytes, [keyType, valueType]) {
+    const reader = new ProtoReader(bytes);
+    let key = '';
+    let value = valueType === 'string' ? '' : undefined;
+    while (!reader.done) {
+      const tag = reader.varint();
+      const no = Number(tag >> 3n);
+      const wireType = Number(tag & 7n);
+      if (no === 1) {
+        checkWireType('map key', keyType, wireType);
+        key = decodeScalar(reader, keyType, wireType);
+      } else if (no === 2) {
+        checkWireType('map value', valueType, wireType);
+        value = decodeScalar(reader, valueType, wireType);
+      } else reader.skip(wireType);
+    }
+    return [String(key), value];
+  }
+
+  function decodePacked(bytes, type) {
+    const reader = new ProtoReader(bytes);
+    const wireType = wireTypeFor(type);
+    const values = [];
+    while (!reader.done) values.push(decodeScalar(reader, type, wireType));
+    return values;
+  }
+
+  function decodeMessage(type, bytes) {
+    const schema = schemas[type];
+    if (!schema) throw new Error(`Unknown ${label} message: ${type}`);
+    const reader = new ProtoReader(bytes);
+    const output = {};
+    while (!reader.done) {
+      const tag = reader.varint();
+      const no = Number(tag >> 3n);
+      const wireType = Number(tag & 7n);
+      if (strict && no === 0) throw new Error(`Invalid ${label} field number 0`);
+      const descriptor = schema[no];
+      if (!descriptor) {
+        const start = reader.offset;
+        reader.skip(wireType);
+        output.$unknown ||= [];
+        output.$unknown.push({
+          no,
+          wireType,
+          data: new Uint8Array(reader.bytes.subarray(start, reader.offset)),
+        });
+        continue;
+      }
+      if (descriptor.type?.map) {
+        checkWireType(descriptor.name, descriptor.type, wireType);
+        const [key, value] = decodeMapEntry(reader.bytesValue(), descriptor.type.map);
+        output[descriptor.name] ||= {};
+        output[descriptor.name][key] = value;
+        continue;
+      }
+      if (packed && descriptor.repeated && wireType === 2 && PACKABLE_TYPES.has(descriptor.type)) {
+        output[descriptor.name] ||= [];
+        output[descriptor.name].push(...decodePacked(reader.bytesValue(), descriptor.type));
+        continue;
+      }
+      checkWireType(descriptor.name, descriptor.type, wireType);
+      const value = decodeScalar(reader, descriptor.type, wireType);
+      if (descriptor.repeated) {
+        output[descriptor.name] ||= [];
+        output[descriptor.name].push(value);
+      } else {
+        output[descriptor.name] = value;
+      }
+    }
+    return output;
+  }
+
+  return { encodeMessage, decodeMessage, encodeField, ProtoReader };
+}

package/src/runtime/agent/orchestrator/runtime-core/builtin-features.mjs

@@ -158,6 +158,8 @@ export function featureDisallowedToolsFor(
     ...(builtinFeatureActive(configLike, 'media') ? [] : ['media']),
     ...(builtinFeatureActive(configLike, 'tidy') ? [] : ['tidy']),
     ...(builtinFeatureActive(configLike, 'visualize') ? [] : ['visualize']),
+    // Bots' emoji reactions (Settings → General → Reactions); on unless turned off.
+    ...(configLike?.reactions === false ? ['react'] : []),
   ];
   // Headless exec uses the Lead surface and excludes Skill/MCP tools. When
   // only its eager defaults remain, neither schemas nor loader guidance help.

package/src/runtime/agent/orchestrator/runtime-core/orchestration.mjs

@@ -27,7 +27,7 @@ substantial coding to a new agent task session (\`session create\`) with
 a self-contained brief: start it when already requested, otherwise suggest it. Then relay the
 result in your own words. Promise a follow-up only when the session result allows it.`;
 
-/** Mixy only: the user's other bots, its contact catalog's intro. */
+/** An agent-mode Lead's contact catalog intro: the user's other bots. */
 export const MIXY_CONTACTS_INTRO = `The user's other bots. Hand one a request with \`session send\` to its chat and a
 self-contained brief.`;