mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/providers/antigravity-transport.mjs

@@ -24,6 +24,7 @@ import { TIMEOUT_PHASE, isFirstByteTimeout } from '../../../shared/provider-time
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { _scrubTokens } from './antigravity-oauth-tokens.mjs';
 import { applyGeminiErrorContract } from './gemini-error-contract.mjs';
+import { geminiInvalidStreamReask } from './gemini-retry-policy.mjs';
 import { DETERMINISTIC_KINDS, providerErrorKind } from './provider-error-kind.mjs';
 
 // Rate-limit reason: 503/529 are capacity by status; a
@@ -113,9 +114,10 @@ export function antigravityError(res, text, endpoint) {
  * @param {string} deps.body  serialized request
  * @param {object} deps.opts  send options (stage heartbeat)
  * @param {AbortSignal|null} deps.signal  retry-loop signal (session pass-through)
- * @param {{ beginAttempt: Function, consume: Function }} deps.collector
+ * @param {{ beginAttempt: Function, consume: Function, failureUsage?: { model: string, normalize: Function } }} deps.collector
  * @param {{ timeoutMs: number, maxMs: number, retries: number|null }} [deps.firstByte]
  *   first-byte window per attempt (antigravityFirstBytePolicy)
+ * @param {boolean} [deps.afterToolResult]  the request ends with a tool result (an empty STOP is then a valid answer)
  * @returns {() => Promise<object>} one retried request that resolves the final payload
  */
 export function createAntigravityRequest({
@@ -128,104 +130,14 @@ export function createAntigravityRequest({
   collector,
   sleepFn,
   firstByte = ANTIGRAVITY_UNCLASSED_FIRST_BYTE,
+  afterToolResult = false,
 }) {
-  const log = (attempt, lastErr, delayMs) => {
-    // A first-byte timeout runs on its own, shorter retry budget.
-    const firstByteLimited = isFirstByteTimeout(lastErr) && firstByte.retries != null;
-    emitProviderRetryStage(opts.onStageChange, {
-      attempt: attempt + 1,
-      maxAttempts: firstByteLimited
-        ? Math.min(ANTIGRAVITY_RETRY.maxAttempts, firstByte.retries + 1)
-        : ANTIGRAVITY_RETRY.maxAttempts,
-      lastErr,
-      delayMs,
-    });
-    process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
-  };
-  // Stamps what the attempt tells the user: how many attempts ran and, for a
-  // first-byte timeout, how long the model was given in total. A timeout past
-  // the first-byte retry budget ends the ladder here. A caller's cancellation
-  // reason may be shared by other requests and is never stamped.
-  const noteFailure = (err, { attemptSignal, windowMs, send }) => {
-    if (!err || typeof err !== 'object' || attemptSignal?.aborted) return err;
-    send.attempts += 1;
-    err.attempts = send.attempts;
-    if (!isFirstByteTimeout(err)) return err;
-    send.firstByteTimeouts += 1;
-    send.firstByteWaitedMs += windowMs;
-    err.waitedMs = send.firstByteWaitedMs;
-    err.providerLabel = 'Antigravity';
-    if (firstByte.retries != null && send.firstByteTimeouts > firstByte.retries) {
-      markProviderRecoveryExhausted(err, { owner: 'antigravity-first-byte', attempts: send.attempts, terminal: true });
-    }
-    return err;
-  };
+  const log = (attempt, lastErr, delayMs) =>
+    logAntigravityRetry(opts.onStageChange, firstByte, attempt, lastErr, delayMs);
   const attemptOnce = (send) =>
     withRetry(
-      async ({ signal: attemptSignal }) => {
-        try {
-          opts.onStageChange?.('requesting');
-        } catch {
-          /* heartbeat */
-        }
-        const windowMs = firstByteWindowMs(firstByte, send.firstByteTimeouts);
-        try {
-          const firstByteTimer = createTimeoutSignal(attemptSignal, windowMs, 'Antigravity first byte');
-          let res;
-          try {
-            const response = fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
-              method: 'POST',
-              headers,
-              body,
-              signal: firstByteTimer.signal,
-              dispatcher: getLlmDispatcher(),
-            });
-            // The request is on the wire and its headers are pending: the
-            // gateway sends them only with the first chunk, so this wait is
-            // the model's queueing and thinking time.
-            try {
-              opts.onStageChange?.(MODEL_THINKING_STAGE);
-            } catch {
-              /* heartbeat */
-            }
-            res = await response;
-          } catch (err) {
-            // Fetch surfaces AbortError; rethrow the timer/parent
-            // reason so same-host retry sees EPROVIDERTIMEOUT and
-            // a caller cancel stays a cancel.
-            if (firstByteTimer.signal.aborted && firstByteTimer.signal.reason instanceof Error) {
-              const reason = firstByteTimer.signal.reason;
-              if (!attemptSignal?.aborted) reason.timeoutPhase = TIMEOUT_PHASE.HEADERS;
-              throw reason;
-            }
-            throw err;
-          } finally {
-            firstByteTimer.cleanup();
-          }
-          // Headers arrived: the connection is live even while the model
-          // has not produced its first chunk.
-          try {
-            opts.onStreamDelta?.('transport');
-          } catch {}
-          if (!res.ok) {
-            const text = await res.text().catch(() => '');
-            const failure = antigravityError(res, text, endpoint);
-            // Capacity is paced by the local schedule below; the generic loop
-            // would sleep whatever wait the server names.
-            if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
-            throw failure;
-          }
-          try {
-            opts.onStageChange?.('streaming');
-          } catch {
-            /* heartbeat */
-          }
-          collector.beginAttempt();
-          return await collector.consume(res, attemptSignal, { firstByteTimeoutMs: windowMs });
-        } catch (err) {
-          throw noteFailure(err, { attemptSignal, windowMs, send });
-        }
-      },
+      ({ signal: attemptSignal }) =>
+        streamAttempt({ fetchFn, endpoint, headers, body, opts, collector, firstByte, send, attemptSignal }),
       {
         ...ANTIGRAVITY_RETRY,
         finalOnExhaust: true,
@@ -240,20 +152,146 @@ export function createAntigravityRequest({
   return async () => {
     const state = { capacityRetries: 0, quickRetried: false };
     const send = { attempts: 0, firstByteTimeouts: 0, firstByteWaitedMs: 0 };
+    let streamAttempt = 0;
     for (let tried = 1; ; tried++) {
       try {
-        return await attemptOnce(send);
+        const response = await attemptOnce(send);
+        // A finished but unusable answer (empty STOP, malformed call) gets
+        // the same bounded re-ask as the API-key transport. The dead
+        // attempt's thinking is retracted when the next attempt begins.
+        if (signal?.aborted) return response;
+        const reask = geminiInvalidStreamReask(response, collector.leakGuard, {
+          afterToolResult,
+          streamAttempt,
+          failureUsage: collector.failureUsage,
+        });
+        if (!reask) return response;
+        log(streamAttempt + 1, reask.unusable, reask.waitMs);
+        streamAttempt += 1;
+        await sleepWithAbort(reask.waitMs, signal, sleepFn, 'Antigravity retry wait aborted');
       } catch (err) {
-        const waitMs = antigravity429WaitMs(err, state);
-        if (waitMs == null) {
-          if (isCapacityFailure(err)) {
-            markProviderRecoveryExhausted(err, { owner: 'antigravity-capacity', attempts: tried });
-          }
-          throw err;
-        }
+        const waitMs = scheduledRetryWaitMs(err, state, tried);
         log(tried, err, waitMs);
         await sleepWithAbort(waitMs, signal, sleepFn, 'Antigravity retry wait aborted');
       }
     }
   };
 }
+
+// The retry status and log line of one scheduled retry. A first-byte timeout
+// runs on its own, shorter retry budget.
+function logAntigravityRetry(onStageChange, firstByte, attempt, lastErr, delayMs) {
+  const firstByteLimited = isFirstByteTimeout(lastErr) && firstByte.retries != null;
+  emitProviderRetryStage(onStageChange, {
+    attempt: attempt + 1,
+    maxAttempts: firstByteLimited
+      ? Math.min(ANTIGRAVITY_RETRY.maxAttempts, firstByte.retries + 1)
+      : ANTIGRAVITY_RETRY.maxAttempts,
+    lastErr,
+    delayMs,
+    providerLabel: 'Antigravity',
+  });
+  process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
+}
+
+// The local wait before re-sending a failed request (429 / capacity schedule);
+// a failure the schedule does not retry is rethrown, a capacity one marked
+// exhausted after `tried` sends.
+function scheduledRetryWaitMs(err, state, tried) {
+  const waitMs = antigravity429WaitMs(err, state);
+  if (waitMs == null) {
+    if (isCapacityFailure(err)) {
+      markProviderRecoveryExhausted(err, { owner: 'antigravity-capacity', attempts: tried });
+    }
+    throw err;
+  }
+  return waitMs;
+}
+
+// One POST under the first-byte window: headers pending is the model's
+// thinking time, a non-OK body becomes the typed error, and a live stream is
+// handed to the collector for this attempt.
+async function streamAttempt({ fetchFn, endpoint, headers, body, opts, collector, firstByte, send, attemptSignal }) {
+  try {
+    opts.onStageChange?.('requesting');
+  } catch {
+    /* heartbeat */
+  }
+  const windowMs = firstByteWindowMs(firstByte, send.firstByteTimeouts);
+  try {
+    const firstByteTimer = createTimeoutSignal(attemptSignal, windowMs, 'Antigravity first byte');
+    let res;
+    try {
+      const response = fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
+        method: 'POST',
+        headers,
+        body,
+        signal: firstByteTimer.signal,
+        dispatcher: getLlmDispatcher(),
+      });
+      // The request is on the wire and its headers are pending: the
+      // gateway sends them only with the first chunk, so this wait is
+      // the model's queueing and thinking time.
+      try {
+        opts.onStageChange?.(MODEL_THINKING_STAGE);
+      } catch {
+        /* heartbeat */
+      }
+      res = await response;
+    } catch (err) {
+      // Fetch surfaces AbortError; rethrow the timer/parent
+      // reason so same-host retry sees EPROVIDERTIMEOUT and
+      // a caller cancel stays a cancel.
+      if (firstByteTimer.signal.aborted && firstByteTimer.signal.reason instanceof Error) {
+        const reason = firstByteTimer.signal.reason;
+        if (!attemptSignal?.aborted) reason.timeoutPhase = TIMEOUT_PHASE.HEADERS;
+        throw reason;
+      }
+      throw err;
+    } finally {
+      firstByteTimer.cleanup();
+    }
+    // Headers arrived: the connection is live even while the model
+    // has not produced its first chunk.
+    try {
+      opts.onStreamDelta?.('transport');
+    } catch {
+      // the stream-delta observer is advisory
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      const failure = antigravityError(res, text, endpoint);
+      // Capacity is paced by the local schedule; the generic loop
+      // would sleep whatever wait the server names.
+      if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
+      throw failure;
+    }
+    try {
+      opts.onStageChange?.('streaming');
+    } catch {
+      /* heartbeat */
+    }
+    collector.beginAttempt();
+    return await collector.consume(res, attemptSignal, { firstByteTimeoutMs: windowMs });
+  } catch (err) {
+    throw noteAttemptFailure(err, { attemptSignal, windowMs, send, firstByte });
+  }
+}
+
+// Stamps what the attempt tells the user: how many attempts ran and, for a
+// first-byte timeout, how long the model was given in total. A timeout past
+// the first-byte retry budget ends the ladder here. A caller's cancellation
+// reason may be shared by other requests and is never stamped.
+function noteAttemptFailure(err, { attemptSignal, windowMs, send, firstByte }) {
+  if (!err || typeof err !== 'object' || attemptSignal?.aborted) return err;
+  send.attempts += 1;
+  err.attempts = send.attempts;
+  if (!isFirstByteTimeout(err)) return err;
+  send.firstByteTimeouts += 1;
+  send.firstByteWaitedMs += windowMs;
+  err.waitedMs = send.firstByteWaitedMs;
+  if (firstByte.retries != null && send.firstByteTimeouts > firstByte.retries) {
+    markProviderRecoveryExhausted(err, { owner: 'antigravity-first-byte', attempts: send.attempts, terminal: true });
+  }
+  return err;
+}

package/src/runtime/agent/orchestrator/providers/cache-warm-admission.mjs

@@ -0,0 +1,90 @@
+// cache-warm-admission.mjs — the account gate of a cache warm
+// (anthropic-cache-warm.mjs). A warm never waits, queues, rotates accounts or
+// retries: right before its POST it reads the state a normal send consults
+// for the account it goes to — the Developer option, the account's admission
+// lane (rate-limit cooldown, a lane throttled after a 429), the account
+// roster's blocks and quota windows, and the session's quota-resume pause —
+// and is skipped when any of them holds or when no fresh quota reading says
+// the account has room. A warm's own refusal is recorded like a send's: a 429
+// in the lane cooldown, and the roster's verdict through the account pool.
+import {
+  ACCOUNT_PROVIDERS,
+  providerAccountExhausted,
+  quotaReadingFresh,
+  readProviderAccountPool,
+  staleQuotaWindows,
+} from '../../../shared/provider-accounts.mjs';
+import { quotaResumeEntry } from '../../../shared/quota-resume-store.mjs';
+import { recordAccountRefusal } from './account-pool.mjs';
+import { providerAdmissionKey, providerAdmissionScheduler } from './admission-scheduler.mjs';
+import { readCachedOAuthUsageSnapshot } from './oauth-usage.mjs';
+import { providerAvailable } from './provider-availability.mjs';
+
+function readingBlock(providerName, windows, checkedAt, now, exhausted) {
+  if (!Array.isArray(windows) || !quotaReadingFresh(checkedAt, now)) return 'no fresh quota reading';
+  if (staleQuotaWindows(providerName, windows)) return 'no fresh quota reading';
+  return exhausted ? 'account blocked or quota exhausted' : null;
+}
+
+function rosterBlock(providerName, accountId, model, now) {
+  if (!ACCOUNT_PROVIDERS.includes(providerName)) return null;
+  const pool = readProviderAccountPool(providerName);
+  const useCredits = pool.useCredits === true;
+  if (!pool.accounts.length) {
+    if (useCredits) return null;
+    const stored = readCachedOAuthUsageSnapshot({ provider: providerName, model: '' });
+    const row = stored ? { usage: { windows: stored.quotaWindows, checkedAt: stored.cachedAt } } : null;
+    return readingBlock(
+      providerName,
+      stored?.quotaWindows,
+      stored?.cachedAt,
+      now,
+      row && providerAccountExhausted(row, now, model)
+    );
+  }
+  if (!accountId) return 'account holding the cache unknown';
+  const row = pool.accounts.find((entry) => entry.id === accountId);
+  if (!row) return 'account not connected';
+  const exhausted = providerAccountExhausted(row, now, model, { useCredits });
+  if (useCredits) return exhausted ? 'account blocked' : null;
+  return readingBlock(providerName, row.usage?.windows, row.usage?.checkedAt, now, exhausted);
+}
+
+/**
+ * Why a warm on `instance` (account `accountId` of `providerName`; no id for
+ * a provider without an account roster) may not be sent now, or null. The
+ * instance's admission lane — the one its ordinary sends are admitted on —
+ * cooling down or throttled blocks it. Never waits.
+ */
+export function cacheWarmAccountBlock(
+  providerName,
+  instance,
+  { accountId = '', model = '', sessionId = '', scheduler = providerAdmissionScheduler, now = Date.now() } = {}
+) {
+  if (!providerAvailable(providerName)) return 'provider disabled';
+  const lane = scheduler.immediateBlock(providerAdmissionKey(providerName, instance));
+  if (lane) return lane;
+  if (sessionId && quotaResumeEntry(sessionId)) return 'session paused until its quota resets';
+  return rosterBlock(providerName, accountId, model, now);
+}
+
+/** The error a skipped warm rejects with (nothing was sent or billed). */
+export function cacheWarmBlockedError(reason) {
+  return Object.assign(new Error(`cache warm skipped: ${reason}`), { code: 'ECACHEWARMBLOCKED', usage: null });
+}
+
+/** Feed a warm's refusal into the shared state a send's would reach (the
+ *  lane keeps 429s only; the roster judges every refusal as the pool's send
+ *  does). A warm the caller aborted is no refusal. */
+export async function recordCacheWarmRefusal(
+  providerName,
+  instance,
+  error,
+  { accountId = '', model = '', aborted = false, scheduler = providerAdmissionScheduler } = {}
+) {
+  if (aborted || error?.code === 'ECACHEWARMBLOCKED') return;
+  scheduler.recordRateLimit(providerAdmissionKey(providerName, instance), error);
+  if (accountId && ACCOUNT_PROVIDERS.includes(providerName)) {
+    await recordAccountRefusal(providerName, accountId, model, error, instance);
+  }
+}

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.163.0';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.164.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/cursor-wire-normalization.mjs

@@ -197,19 +197,25 @@ function usagePercent(value) {
   return Math.round(normalized * 10_000) / 10_000;
 }
 
+// The models the Auto pool (`autoPercentUsed`) meters: Auto under both of its
+// ids and the Composer family. Every other model draws on the API pool.
+const AUTO_POOL_MODELS = Object.freeze(['auto', 'default', 'composer']);
+
 // The included-plan windows: per-lane progress percentages when the dashboard
-// reports them, else one dollar window over the included balance.
+// reports them, else one dollar window over the included balance. Each lane
+// gates only the models it meters.
 function includedUsageWindows(included, plan, includedBalance, resetAt) {
   const progressWindows = [
-    ['Basic', included.autoPercentUsed],
-    ['API', included.apiPercentUsed],
+    ['Basic', included.autoPercentUsed, { models: [...AUTO_POOL_MODELS] }],
+    ['API', included.apiPercentUsed, { except: [...AUTO_POOL_MODELS] }],
   ].filter(([, value]) => Number.isFinite(Number(value)));
   if (progressWindows.length) {
-    return progressWindows.map(([label, value]) => ({
+    return progressWindows.map(([label, value, scope]) => ({
       label,
       source: 'cursor-dashboard',
       usedPct: usagePercent(value),
       ...(resetAt ? { resetAt } : {}),
+      ...scope,
     }));
   }
   if (!includedBalance) return [];

package/src/runtime/agent/orchestrator/providers/cursor-wire-protobuf.mjs

@@ -1,9 +1,10 @@
-function fields(entries) {
-  return Object.fromEntries(entries.map(([name, no, type, options = {}]) => [no, { name, no, type, ...options }]));
-}
-
-const map = (key, value) => ({ map: [key, value] });
-const repeated = { repeated: true };
+import {
+  concatBytes,
+  createProtobufCodec,
+  protobufFields as fields,
+  mapOf as map,
+  repeated,
+} from './wire-protobuf-codec.mjs';
 
 // Only the fields read or written by the provider are described here.
 const SCHEMAS = {
@@ -639,149 +640,10 @@ const SCHEMAS = {
   JsonList: fields([['values', 1, 'JsonValue', repeated]]),
 };
 
-const textEncoder = new TextEncoder();
-// A protobuf string is data, not a text document with a disposable BOM.
-const textDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
-
-function concatBytes(parts) {
-  const length = parts.reduce((sum, part) => sum + part.length, 0);
-  const output = new Uint8Array(length);
-  let offset = 0;
-  for (const part of parts) {
-    output.set(part, offset);
-    offset += part.length;
-  }
-  return output;
-}
-
-function encodeVarint(value) {
-  let current = BigInt(value ?? 0);
-  if (current < 0) current = BigInt.asUintN(64, current);
-  const bytes = [];
-  do {
-    let byte = Number(current & 0x7fn);
-    current >>= 7n;
-    if (current) byte |= 0x80;
-    bytes.push(byte);
-  } while (current);
-  return Uint8Array.from(bytes);
-}
-
-function encodeTag(no, wireType) {
-  return encodeVarint((BigInt(no) << 3n) | BigInt(wireType));
-}
-
-function isMessageType(type) {
-  return Object.hasOwn(SCHEMAS, type);
-}
-
-function wireTypeFor(type) {
-  if (type === 'double') return 1;
-  if (['string', 'bytes', 'raw'].includes(type) || isMessageType(type)) return 2;
-  return 0;
-}
-
-function scalarBytes(type, value) {
-  if (type === 'string') return textEncoder.encode(String(value));
-  if (type === 'bytes' || type === 'raw') return value instanceof Uint8Array ? value : new Uint8Array(value);
-  if (type === 'double') {
-    const buffer = new ArrayBuffer(8);
-    new DataView(buffer).setFloat64(0, Number(value), true);
-    return new Uint8Array(buffer);
-  }
-  if (type === 'bool') return encodeVarint(value ? 1 : 0);
-  if (type === 'int' || type === 'uint') return encodeVarint(value);
-  if (isMessageType(type)) return encodeMessage(type, value);
-  throw new Error(`Unknown Cursor protobuf type: ${type}`);
-}
-
-function shouldWrite(type, value) {
-  if (value == null) return false;
-  if (type === 'string') return value !== '';
-  return true;
-}
-
-function encodeField(no, type, value) {
-  const wireType = wireTypeFor(type);
-  const payload = scalarBytes(type, value);
-  if (wireType === 2) return concatBytes([encodeTag(no, wireType), encodeVarint(payload.length), payload]);
-  return concatBytes([encodeTag(no, wireType), payload]);
-}
-
-function encodeMapField(no, [keyType, valueType], value) {
-  const parts = [];
-  for (const [key, entryValue] of Object.entries(value || {})) {
-    const entry = concatBytes([encodeField(1, keyType, key), encodeField(2, valueType, entryValue)]);
-    parts.push(concatBytes([encodeTag(no, 2), encodeVarint(entry.length), entry]));
-  }
-  return parts;
-}
-
-export function encodeMessage(type, value = {}) {
-  const schema = SCHEMAS[type];
-  if (!schema) throw new Error(`Unknown Cursor protobuf message: ${type}`);
-  const parts = [];
-  for (const descriptor of Object.values(schema)) {
-    const fieldValue = value[descriptor.name];
-    if (descriptor.type?.map) {
-      parts.push(...encodeMapField(descriptor.no, descriptor.type.map, fieldValue));
-      continue;
-    }
-    let values = [fieldValue];
-    if (descriptor.repeated) values = Array.isArray(fieldValue) ? fieldValue : [];
-    for (const item of values) {
-      // A oneof's explicit empty string is a value, not an absent field.
-      if ((descriptor.presence && item != null) || shouldWrite(descriptor.type, item)) {
-        parts.push(encodeField(descriptor.no, descriptor.type, item));
-      }
-    }
-  }
-  return concatBytes(parts);
-}
-
-class ProtoReader {
-  constructor(bytes) {
-    this.bytes = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-    this.offset = 0;
-  }
-
-  get done() {
-    return this.offset >= this.bytes.length;
-  }
-
-  varint() {
-    let value = 0n;
-    let shift = 0n;
-    while (!this.done) {
-      const byte = this.bytes[this.offset++];
-      value |= BigInt(byte & 0x7f) << shift;
-      if ((byte & 0x80) === 0) return value;
-      shift += 7n;
-      if (shift > 70n) throw new Error('Invalid Cursor protobuf varint');
-    }
-    throw new Error('Truncated Cursor protobuf varint');
-  }
-
-  take(length) {
-    const end = this.offset + length;
-    if (end > this.bytes.length) throw new Error('Truncated Cursor protobuf field');
-    const value = this.bytes.subarray(this.offset, end);
-    this.offset = end;
-    return value;
-  }
+const codec = createProtobufCodec(SCHEMAS, { label: 'Cursor protobuf' });
+const { encodeField, ProtoReader } = codec;
 
-  bytesValue() {
-    return this.take(Number(this.varint()));
-  }
-
-  skip(wireType) {
-    if (wireType === 0) this.varint();
-    else if (wireType === 1) this.take(8);
-    else if (wireType === 2) this.bytesValue();
-    else if (wireType === 5) this.take(4);
-    else throw new Error(`Unsupported Cursor protobuf wire type: ${wireType}`);
-  }
-}
+export const { encodeMessage, decodeMessage } = codec;
 
 export function rewriteConversationState(checkpoint, rootPromptMessagesJson, turns = []) {
   const preserved = [];
@@ -808,75 +670,6 @@ export function rewriteConversationState(checkpoint, rootPromptMessagesJson, tur
   return concatBytes([...preserved, ...replacement]);
 }
 
-function decodeScalar(reader, type, wireType) {
-  if (type === 'string') return textDecoder.decode(reader.bytesValue());
-  if (type === 'bytes' || type === 'raw') return new Uint8Array(reader.bytesValue());
-  if (type === 'double') {
-    if (wireType !== 1) throw new Error('Invalid Cursor protobuf double');
-    const value = new DataView(reader.bytes.buffer, reader.bytes.byteOffset + reader.offset, 8).getFloat64(0, true);
-    reader.offset += 8;
-    return value;
-  }
-  if (type === 'bool') return reader.varint() !== 0n;
-  if (type === 'int') return Number(BigInt.asIntN(64, reader.varint()));
-  if (type === 'uint') return Number(reader.varint());
-  if (isMessageType(type)) return decodeMessage(type, reader.bytesValue());
-  throw new Error(`Unknown Cursor protobuf type: ${type}`);
-}
-
-function decodeMapEntry(bytes, [keyType, valueType]) {
-  const reader = new ProtoReader(bytes);
-  let key = '';
-  let value = valueType === 'string' ? '' : undefined;
-  while (!reader.done) {
-    const tag = reader.varint();
-    const no = Number(tag >> 3n);
-    const wireType = Number(tag & 7n);
-    if (no === 1) key = decodeScalar(reader, keyType, wireType);
-    else if (no === 2) value = decodeScalar(reader, valueType, wireType);
-    else reader.skip(wireType);
-  }
-  return [String(key), value];
-}
-
-export function decodeMessage(type, bytes) {
-  const schema = SCHEMAS[type];
-  if (!schema) throw new Error(`Unknown Cursor protobuf message: ${type}`);
-  const reader = new ProtoReader(bytes);
-  const output = {};
-  while (!reader.done) {
-    const tag = reader.varint();
-    const no = Number(tag >> 3n);
-    const wireType = Number(tag & 7n);
-    const descriptor = schema[no];
-    if (!descriptor) {
-      const start = reader.offset;
-      reader.skip(wireType);
-      output.$unknown ||= [];
-      output.$unknown.push({
-        no,
-        wireType,
-        data: new Uint8Array(reader.bytes.subarray(start, reader.offset)),
-      });
-      continue;
-    }
-    if (descriptor.type?.map) {
-      const [key, value] = decodeMapEntry(reader.bytesValue(), descriptor.type.map);
-      output[descriptor.name] ||= {};
-      output[descriptor.name][key] = value;
-      continue;
-    }
-    const value = decodeScalar(reader, descriptor.type, wireType);
-    if (descriptor.repeated) {
-      output[descriptor.name] ||= [];
-      output[descriptor.name].push(value);
-    } else {
-      output[descriptor.name] = value;
-    }
-  }
-  return output;
-}
-
 function jsonToProtoValue(value) {
   if (value === null) return { nullValue: 0 };
   if (Array.isArray(value)) return { listValue: { values: value.map(jsonToProtoValue) } };