From a409242b8266eb7569223d68bec20e7898d42689 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:01:35 +0000
Subject: [PATCH 01/94] =?UTF-8?q?=F0=9F=A4=96=20refactor:=20dedupe=20memor?=
 =?UTF-8?q?y=20sweep=20recordUsage=20callbacks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the byte-identical consolidation/harvest sweep `recordUsage`
callbacks in MemoryConsolidationService into a shared
`makeSweepUsageRecorder` helper. Behavior-preserving: same sidecar
recording and analyticsIngest emit; only the workspaceId source and
analyticsSource literal differ per call site.

Auto-cleanup checkpoint: f7f0f02587c09fb86f97f704f3f24f5b3904260d
---
 .../services/memoryConsolidationService.ts    | 86 ++++++++++---------
 1 file changed, 46 insertions(+), 40 deletions(-)

diff --git a/src/node/services/memoryConsolidationService.ts b/src/node/services/memoryConsolidationService.ts
index b536e2b8e5..d7755e53d2 100644
--- a/src/node/services/memoryConsolidationService.ts
+++ b/src/node/services/memoryConsolidationService.ts
@@ -17,6 +17,7 @@ import * as path from "node:path";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
 import type { LanguageModel } from "ai";
+import type { LanguageModelV2Usage } from "@ai-sdk/provider";
 import { modelCostsIncluded } from "@/node/services/providerModelFactory";
 import type { SessionUsageService } from "@/node/services/sessionUsageService";
 import type { CompactionCompletionMetadata } from "@/common/types/compaction";
@@ -496,6 +497,39 @@ export class MemoryConsolidationService extends EventEmitter {
     };
   }
 
+  /**
+   * Build the `recordUsage` callback shared by the consolidation and harvest
+   * sweeps. Both route the sweep's billed usage to the headless-usage sidecar
+   * and, when a row is recorded, request an ingest pass (forwarded by
+   * ServiceContainer) so sweep spend reaches dashboard totals promptly instead
+   * of stranding until an unrelated stream-end or restart.
+   */
+  private makeSweepUsageRecorder(
+    workspaceId: string,
+    modelString: string,
+    created: { model: LanguageModel; metadataModel: string },
+    analyticsSource: "memory_consolidation" | "memory_harvest"
+  ): (usage: LanguageModelV2Usage, providerMetadata?: Record<string, unknown>) => Promise<void> {
+    return async (usage, providerMetadata) => {
+      const recorded = await this.sessionUsageService?.recordHeadlessUsage(
+        workspaceId,
+        modelString,
+        usage,
+        providerMetadata,
+        {
+          costsIncluded: modelCostsIncluded(created.model),
+          analyticsSource,
+          // Creation-time identity: a catalog refresh mid-run must not
+          // re-attribute this spend (see ModelFactoryLike).
+          metadataModel: created.metadataModel,
+        }
+      );
+      if (recorded) {
+        this.emit("analyticsIngest", { workspaceId });
+      }
+    };
+  }
+
   /**
    * Workspace-removal drain (r60): abort every in-flight dream/harvest run
    * for this workspace and await them BOUNDED. The stream abort settles a
@@ -664,27 +698,12 @@ export class MemoryConsolidationService extends EventEmitter {
         AbortSignal.timeout(MEMORY_CONSOLIDATION_TIMEOUT_MS),
         removalSignal,
       ]),
-      recordUsage: async (usage, providerMetadata) => {
-        const recorded = await this.sessionUsageService?.recordHeadlessUsage(
-          workspaceId,
-          modelString,
-          usage,
-          providerMetadata,
-          {
-            costsIncluded: modelCostsIncluded(modelResult.data.model),
-            analyticsSource: "memory_consolidation",
-            // Creation-time identity: a catalog refresh mid-run must not
-            // re-attribute this spend (see ModelFactoryLike).
-            metadataModel: modelResult.data.metadataModel,
-          }
-        );
-        // The sidecar row only reaches dashboard totals via an explicit
-        // ingest pass; request one (forwarded by ServiceContainer) so sweep
-        // spend doesn't strand until an unrelated stream-end or restart.
-        if (recorded) {
-          this.emit("analyticsIngest", { workspaceId });
-        }
-      },
+      recordUsage: this.makeSweepUsageRecorder(
+        workspaceId,
+        modelString,
+        modelResult.data,
+        "memory_consolidation"
+      ),
     });
     // A stream failure (provider error or the run timeout) means the pass did
     // NOT cover the memory state: skip the journal record so the debounce and
@@ -821,25 +840,12 @@ export class MemoryConsolidationService extends EventEmitter {
             AbortSignal.timeout(MEMORY_CONSOLIDATION_TIMEOUT_MS),
             removalSignal,
           ]),
-          recordUsage: async (usage, providerMetadata) => {
-            const recorded = await this.sessionUsageService?.recordHeadlessUsage(
-              metadata.workspaceId,
-              modelString,
-              usage,
-              providerMetadata,
-              {
-                costsIncluded: modelCostsIncluded(modelResult.data.model),
-                analyticsSource: "memory_harvest",
-                // Creation-time identity (see ModelFactoryLike).
-                metadataModel: modelResult.data.metadataModel,
-              }
-            );
-            // Same as consolidation above: request an ingest pass so harvest
-            // spend reaches dashboard totals promptly.
-            if (recorded) {
-              this.emit("analyticsIngest", { workspaceId: metadata.workspaceId });
-            }
-          },
+          recordUsage: this.makeSweepUsageRecorder(
+            metadata.workspaceId,
+            modelString,
+            modelResult.data,
+            "memory_harvest"
+          ),
         });
         if (harvest.streamError !== undefined) {
           throw new Error(`harvest stream failed: ${harvest.streamError}`);

From 14776de69078876ac016bd0f33e8d758d3764a0e Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 00:30:11 +0000
Subject: [PATCH 02/94] =?UTF-8?q?=F0=9F=A4=96=20refactor:=20dedupe=20memor?=
 =?UTF-8?q?y=20scope-full=20cap=20check=20into=20helper?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/node/services/memoryService.ts | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/src/node/services/memoryService.ts b/src/node/services/memoryService.ts
index 5d8b8240d9..6534c466d1 100644
--- a/src/node/services/memoryService.ts
+++ b/src/node/services/memoryService.ts
@@ -716,6 +716,21 @@ export class MemoryService extends EventEmitter {
     return store;
   }
 
+  /**
+   * Enforce the per-scope file cap before creating a new file. Throws a
+   * MemoryCommandError with a uniform "scope is full" message when the store
+   * already holds MEMORY_MAX_FILES_PER_SCOPE files. Deduplicated from the
+   * `create` and `saveFile` (new-file) paths, which enforced this identically.
+   */
+  private async assertScopeHasRoom(store: MemoryStore, scope: MemoryScope): Promise<void> {
+    const files = await store.listFiles();
+    if (files.length >= MEMORY_MAX_FILES_PER_SCOPE) {
+      throw new MemoryCommandError(
+        `The ${scope} memory scope is full (${MEMORY_MAX_FILES_PER_SCOPE} files); delete unused files first`
+      );
+    }
+  }
+
   private requireFilePath(parsed: ParsedMemoryPath, virtualPath: string): MemoryScope {
     if (parsed.scope === null || parsed.relPath === "") {
       throw new MemoryCommandError(
@@ -972,12 +987,7 @@ export class MemoryService extends EventEmitter {
             `A ${existing === "dir" ? "directory" : "file"} already exists at ${virtualPath}. To overwrite a file, delete it first, then create it.`
           );
         }
-        const files = await store.listFiles();
-        if (files.length >= MEMORY_MAX_FILES_PER_SCOPE) {
-          throw new MemoryCommandError(
-            `The ${scope} memory scope is full (${MEMORY_MAX_FILES_PER_SCOPE} files); delete unused files first`
-          );
-        }
+        await this.assertScopeHasRoom(store, scope);
         await assertMutationCommittable(this.config.rootDir, ctx, abortSignal, virtualPath);
         await store.writeFile(parsed.relPath, fileText);
         // Row is written before the create is acknowledged (mutation → row → ack).
@@ -1451,12 +1461,7 @@ export class MemoryService extends EventEmitter {
             if (kind !== null) {
               return conflict(`A file already exists at ${virtualPath}; reload before saving`);
             }
-            const files = await store.listFiles();
-            if (files.length >= MEMORY_MAX_FILES_PER_SCOPE) {
-              throw new MemoryCommandError(
-                `The ${scope} memory scope is full (${MEMORY_MAX_FILES_PER_SCOPE} files); delete unused files first`
-              );
-            }
+            await this.assertScopeHasRoom(store, scope);
           } else {
             if (kind === null) {
               return conflict(`${virtualPath} no longer exists; it may have been deleted`);

From 152560d73c3380696d402dc413f152a8f2c981ef Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 09:09:58 +0000
Subject: [PATCH 03/94] refactor: dedupe blockquote line formatting in bash
 monitor wake prompt

---
 src/node/services/bashMonitorWakeStore.ts | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/node/services/bashMonitorWakeStore.ts b/src/node/services/bashMonitorWakeStore.ts
index 7c8e1c4151..47fbe65327 100644
--- a/src/node/services/bashMonitorWakeStore.ts
+++ b/src/node/services/bashMonitorWakeStore.ts
@@ -492,6 +492,14 @@ export interface BashMonitorWakePromptContext {
   taskAwaitable?: boolean;
 }
 
+/**
+ * Prefix each line with Markdown blockquote syntax (`> `) and join with newlines. Used for both
+ * the matched output and the lost-monitor script rendered in buildBashMonitorWakePrompt.
+ */
+function blockquoteLines(lines: readonly string[]): string {
+  return lines.map((line) => `> ${line}`).join("\n");
+}
+
 export function buildBashMonitorWakePrompt(
   records: readonly BashMonitorWakeRecord[],
   context?: ReadonlyMap<string, BashMonitorWakePromptContext>
@@ -517,20 +525,14 @@ export function buildBashMonitorWakePrompt(
   const sections = records.map((record) => {
     const displayName = record.displayName ?? record.processId;
     const monitorLine = `Monitor: /${record.filter}/${record.filterExclude ? " (inverted)" : ""}`;
-    const lines = record.lines
-      .map(sanitizeBashMonitorWakeLine)
-      .map((line) => `> ${line}`)
-      .join("\n");
+    const lines = blockquoteLines(record.lines.map(sanitizeBashMonitorWakeLine));
     const dropped =
       record.droppedLines > 0 ? `\nDropped matched lines: ${record.droppedLines}` : "";
 
     if (record.kind === "monitor-lost") {
       // The script is agent-authored (it wrote the bash call), so it is not marked
       // untrusted; any matched output lines keep the untrusted marker.
-      const script = (record.script ?? "")
-        .split("\n")
-        .map((line) => `> ${line}`)
-        .join("\n");
+      const script = blockquoteLines((record.script ?? "").split("\n"));
       const matchedOutputLabel =
         record.lostReason === "runtime-failure"
           ? "Matched output before monitor retirement"

From a300ba5906610cfaee1cd1236d37ef4756f6a6a2 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 20:38:01 +0000
Subject: [PATCH 04/94] refactor: dedupe tool_search removal in
 prepareToolSearch

Both fallback branches in prepareToolSearch inlined the identical
{ [TOOL_SEARCH_TOOL_NAME]: _removed, ...rest } destructure to drop the
built-in tool_search entry from the record. Extract a module-level
withoutToolSearch(tools) helper; output is byte-identical.
---
 src/common/utils/tools/toolCatalog.ts | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/common/utils/tools/toolCatalog.ts b/src/common/utils/tools/toolCatalog.ts
index a0af8a8eee..febcfa9207 100644
--- a/src/common/utils/tools/toolCatalog.ts
+++ b/src/common/utils/tools/toolCatalog.ts
@@ -328,6 +328,12 @@ export function buildToolCatalogOverview(catalog: readonly ToolCatalogEntry[]):
   return `${OVERVIEW_HEADER}\n${lines.join("\n")}\n${OVERVIEW_END_MARKER}`;
 }
 
+/** Return the tool record with the built-in `tool_search` entry removed. */
+function withoutToolSearch(tools: Record<string, Tool>): Record<string, Tool> {
+  const { [TOOL_SEARCH_TOOL_NAME]: _removed, ...rest } = tools;
+  return rest;
+}
+
 /**
  * Post-policy gate: decides whether tool-search deferral is active for this
  * stream and returns the (possibly adjusted) tool record plus the seed state.
@@ -372,13 +378,11 @@ export function prepareToolSearch(inputs: ToolCatalogInputs): {
   // Gated on the actual PTC flag, not record presence: a `code_execution`
   // record entry may be a same-named MCP tool (classified as normal deferred).
   if (inputs.ptcEnabled === true) {
-    const { [TOOL_SEARCH_TOOL_NAME]: _removed, ...rest } = inputs.tools;
-    return { tools: rest };
+    return { tools: withoutToolSearch(inputs.tools) };
   }
   const classification = buildToolCatalog(inputs);
   if (classification.deferredToolNames.size === 0) {
-    const { [TOOL_SEARCH_TOOL_NAME]: _removed, ...rest } = inputs.tools;
-    return { tools: rest };
+    return { tools: withoutToolSearch(inputs.tools) };
   }
   // Advertise the deferred surface area up front: append a compact per-server
   // index of deferred tool names to tool_catalog_search's description so the

From 4210aaea29516a0c08b9285120b1445de5cb812a Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 09:07:33 +0000
Subject: [PATCH 05/94] refactor: dedupe anthropic cache-create token
 extraction in usageHelpers

accumulateProviderMetadata inlined the same verbose (metadata.anthropic as { cacheCreationInputTokens?: number }).cacheCreationInputTokens ?? 0 cast twice. Extracted a module-private getAnthropicCacheCreateTokens(metadata) helper. Behavior-preserving; the displayUsage.ts site is intentionally left alone because its chain has an extra usage.inputTokenDetails.cacheWriteTokens fallback.
---
 src/common/utils/tokens/usageHelpers.ts | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/common/utils/tokens/usageHelpers.ts b/src/common/utils/tokens/usageHelpers.ts
index c81840cd1f..a665eb8202 100644
--- a/src/common/utils/tokens/usageHelpers.ts
+++ b/src/common/utils/tokens/usageHelpers.ts
@@ -104,6 +104,17 @@ export function addUsage(
   };
 }
 
+/**
+ * Read Anthropic cache-creation input tokens from a provider-metadata record.
+ * Returns 0 when the field is absent so callers can sum without null checks.
+ */
+function getAnthropicCacheCreateTokens(metadata: Record<string, unknown> | undefined): number {
+  return (
+    (metadata?.anthropic as { cacheCreationInputTokens?: number } | undefined)
+      ?.cacheCreationInputTokens ?? 0
+  );
+}
+
 /**
  * Accumulate provider metadata across steps for additive billing metadata.
  *
@@ -118,12 +129,8 @@ export function accumulateProviderMetadata(
   if (!existing) return step;
 
   // Extract cache creation tokens from both
-  const existingCacheCreate =
-    (existing.anthropic as { cacheCreationInputTokens?: number } | undefined)
-      ?.cacheCreationInputTokens ?? 0;
-  const stepCacheCreate =
-    (step.anthropic as { cacheCreationInputTokens?: number } | undefined)
-      ?.cacheCreationInputTokens ?? 0;
+  const existingCacheCreate = getAnthropicCacheCreateTokens(existing);
+  const stepCacheCreate = getAnthropicCacheCreateTokens(step);
 
   const totalCacheCreate = existingCacheCreate + stepCacheCreate;
   const existingXaiCostTicks =

From c2c890eefe1370b89c48d1e9277e404822c630f7 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 16:46:56 +0000
Subject: [PATCH 06/94] refactor: dedupe capability-model thinking policy
 resolution

Both getThinkingPolicyForModel and hasExplicitThinkingPolicy inlined the
identical getExplicitThinkingPolicy(resolveModelForMetadata(model, providersConfig ?? null))
call after #3708 added alias resolution to each. Extract a private
getExplicitThinkingPolicyForModel helper; behavior-preserving.
---
 src/common/utils/thinking/policy.ts | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/common/utils/thinking/policy.ts b/src/common/utils/thinking/policy.ts
index 511d17da99..808c48b230 100644
--- a/src/common/utils/thinking/policy.ts
+++ b/src/common/utils/thinking/policy.ts
@@ -89,8 +89,7 @@ export function getThinkingPolicyForModel(
   modelString: string,
   providersConfig?: ProvidersConfigMap | null
 ): ThinkingPolicy {
-  const capabilityModel = resolveModelForMetadata(modelString, providersConfig ?? null);
-  return getExplicitThinkingPolicy(capabilityModel) ?? DEFAULT_THINKING_POLICY;
+  return getExplicitThinkingPolicyForModel(modelString, providersConfig) ?? DEFAULT_THINKING_POLICY;
 }
 
 /**
@@ -204,6 +203,20 @@ function getExplicitThinkingPolicy(modelString: string): ThinkingPolicy | null {
   return null;
 }
 
+/**
+ * Resolve a model to its capability model (following `mappedToModel` aliases via
+ * {@link resolveModelForMetadata}) and return its explicit reasoning policy, or
+ * `null` when none matches. Shared by {@link getThinkingPolicyForModel} and
+ * {@link hasExplicitThinkingPolicy}, which must resolve aliases identically
+ * before rule matching so a mapped alias inherits its target's policy.
+ */
+function getExplicitThinkingPolicyForModel(
+  modelString: string,
+  providersConfig?: ProvidersConfigMap | null
+): ThinkingPolicy | null {
+  return getExplicitThinkingPolicy(resolveModelForMetadata(modelString, providersConfig ?? null));
+}
+
 /** Canonical ordering index for a level (off=0 … max=5). */
 function thinkingLevelIndex(level: ThinkingLevel): number {
   return THINKING_LEVELS.indexOf(level);
@@ -245,10 +258,7 @@ export function hasExplicitThinkingPolicy(
   modelString: string,
   providersConfig?: ProvidersConfigMap | null
 ): boolean {
-  return (
-    getExplicitThinkingPolicy(resolveModelForMetadata(modelString, providersConfig ?? null)) !==
-    null
-  );
+  return getExplicitThinkingPolicyForModel(modelString, providersConfig) !== null;
 }
 
 /**

From 2e94627b49351c7f9a355c47c27b108d9f2252ef Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 00:24:53 +0000
Subject: [PATCH 07/94] refactor: dedupe queue entry clear-callback projection
 in MessageQueue

---
 src/node/services/messageQueue.ts | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/src/node/services/messageQueue.ts b/src/node/services/messageQueue.ts
index 2bc02977d6..b0935d111d 100644
--- a/src/node/services/messageQueue.ts
+++ b/src/node/services/messageQueue.ts
@@ -725,6 +725,20 @@ export class MessageQueue {
     return this.getVisibleEntries().some((entry) => isCompactionMetadata(entry.muxMetadata));
   }
 
+  /**
+   * Project a single entry's cancellation callbacks into the clear-callback shape.
+   * Shared by full-queue clears and targeted workspace-turn removal so both notify
+   * the same callback set.
+   */
+  private entryClearCallbacks(entry: QueueEntry): QueueClearCallbacks {
+    return {
+      ...(entry.onCanceled != null ? { onCanceled: entry.onCanceled } : {}),
+      ...(entry.onAcceptedPreStreamFailure != null
+        ? { onAcceptedPreStreamFailure: entry.onAcceptedPreStreamFailure }
+        : {}),
+    };
+  }
+
   /**
    * Cancellation callbacks for every pending entry, in queue order.
    * Callers must notify each one when clearing the queue.
@@ -732,12 +746,7 @@ export class MessageQueue {
   getClearCallbacks(): QueueClearCallbacks[] {
     return this.entries
       .filter((entry) => entry.onCanceled != null || entry.onAcceptedPreStreamFailure != null)
-      .map((entry) => ({
-        ...(entry.onCanceled != null ? { onCanceled: entry.onCanceled } : {}),
-        ...(entry.onAcceptedPreStreamFailure != null
-          ? { onAcceptedPreStreamFailure: entry.onAcceptedPreStreamFailure }
-          : {}),
-      }));
+      .map((entry) => this.entryClearCallbacks(entry));
   }
 
   /**
@@ -757,12 +766,7 @@ export class MessageQueue {
       return null;
     }
     const [entry] = this.entries.splice(index, 1);
-    return {
-      ...(entry.onCanceled != null ? { onCanceled: entry.onCanceled } : {}),
-      ...(entry.onAcceptedPreStreamFailure != null
-        ? { onAcceptedPreStreamFailure: entry.onAcceptedPreStreamFailure }
-        : {}),
-    };
+    return this.entryClearCallbacks(entry);
   }
 
   /** Remove queued entries carrying a dedupe key with the given prefix. */

From 0cdab9479a85ee3cffe357e735ce368d968a2229 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:25:51 +0000
Subject: [PATCH 08/94] refactor: dedupe OpenAI-origin model check in
 cacheStrategy

Both eligibility gates in openaiExplicitPromptCachingAvailable inlined the
identical split(":", 2) + `origin !== "openai" || !modelName` check (once for
the request model, once for the resolved capability target). The destructured
origin/name locals were unused past their guard. Extracted into a module-private
isOpenAIOriginModel(canonical) helper. Behavior-preserving.
---
 src/common/utils/ai/cacheStrategy.ts | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/common/utils/ai/cacheStrategy.ts b/src/common/utils/ai/cacheStrategy.ts
index 6d176d4728..8a24f1f429 100644
--- a/src/common/utils/ai/cacheStrategy.ts
+++ b/src/common/utils/ai/cacheStrategy.ts
@@ -235,6 +235,16 @@ function isOfficialOpenAIBaseUrl(baseUrl: string): boolean {
   );
 }
 
+/**
+ * Whether a canonical `provider:model` string has an `openai` origin with a
+ * non-empty model name. Used to gate both the request model and its resolved
+ * capability target in openaiExplicitPromptCachingAvailable.
+ */
+function isOpenAIOriginModel(canonical: string): boolean {
+  const [origin, modelName] = canonical.split(":", 2);
+  return origin === "openai" && !!modelName;
+}
+
 /**
  * Route-aware eligibility for GPT-5.6 explicit prompt cache breakpoints.
  *
@@ -270,16 +280,14 @@ export function openaiExplicitPromptCachingAvailable(
   }
 
   const normalized = normalizeToCanonical(modelString);
-  const [origin, modelName] = normalized.split(":", 2);
-  if (origin !== "openai" || !modelName) {
+  if (!isOpenAIOriginModel(normalized)) {
     return false;
   }
 
   // Mapped aliases inherit eligibility only when the resolved capability
   // target is also an OpenAI GPT-5.6-family model.
   const capabilityModel = resolveModelForMetadata(normalized, providersConfig);
-  const [capabilityOrigin, capabilityModelName] = capabilityModel.split(":", 2);
-  if (capabilityOrigin !== "openai" || !capabilityModelName) {
+  if (!isOpenAIOriginModel(capabilityModel)) {
     return false;
   }
   if (!isGpt56FamilyModel(capabilityModel)) {

From e82180afdc6b49e3ca5b50b813a1f73a072d2418 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 12:52:46 +0000
Subject: [PATCH 09/94] refactor: dedupe tool-call-execution-start emit in
 StreamManager

---
 src/node/services/streamManager.ts | 41 ++++++++++++++++++++----------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/src/node/services/streamManager.ts b/src/node/services/streamManager.ts
index 864b093ceb..42d0c299c9 100644
--- a/src/node/services/streamManager.ts
+++ b/src/node/services/streamManager.ts
@@ -1018,6 +1018,26 @@ export class StreamManager {
     return false;
   }
 
+  /**
+   * Emit the tool-call-execution-start chat event that tells the UI a tool's execute()
+   * has begun running. Shared by applyToolExecutionStart (part already stored) and the
+   * "tool-call" case that consumes a pending start recorded before the part landed.
+   */
+  private emitToolCallExecutionStart(
+    workspaceId: WorkspaceId,
+    streamInfo: WorkspaceStreamInfo,
+    toolCallId: string,
+    timestamp: number
+  ): void {
+    this.emitTurnEvent({
+      type: "tool-call-execution-start",
+      workspaceId: workspaceId as string,
+      messageId: streamInfo.messageId,
+      toolCallId,
+      timestamp,
+    } satisfies ToolCallExecutionStartEvent);
+  }
+
   /**
    * Record on the dynamic-tool part when its execute() actually began running and notify
    * the UI. Returns false when the part has not landed in streamInfo.parts yet.
@@ -1039,13 +1059,7 @@ export class StreamManager {
     assert(part.type === "dynamic-tool", "applyToolExecutionStart matched a non-tool part");
     streamInfo.parts[partIndex] = { ...part, executionStartedAt: timestamp };
 
-    this.emitTurnEvent({
-      type: "tool-call-execution-start",
-      workspaceId: workspaceId as string,
-      messageId: streamInfo.messageId,
-      toolCallId,
-      timestamp,
-    } satisfies ToolCallExecutionStartEvent);
+    this.emitToolCallExecutionStart(workspaceId, streamInfo, toolCallId, timestamp);
     return true;
   }
 
@@ -1663,13 +1677,12 @@ export class StreamManager {
       }
       streamInfo.parts.push(partToPersist);
       if (pendingExecutionStart !== undefined && part.type === "dynamic-tool") {
-        this.emitTurnEvent({
-          type: "tool-call-execution-start",
-          workspaceId: workspaceId as string,
-          messageId: streamInfo.messageId,
-          toolCallId: part.toolCallId,
-          timestamp: pendingExecutionStart,
-        } satisfies ToolCallExecutionStartEvent);
+        this.emitToolCallExecutionStart(
+          workspaceId,
+          streamInfo,
+          part.toolCallId,
+          pendingExecutionStart
+        );
       }
       if (bufferedNestedCalls !== undefined && part.type === "dynamic-tool") {
         if (pendingAttachment == null) {

From 6625b867fe8852cc42ba262ea7703a9617e05b97 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 00:28:21 +0000
Subject: [PATCH 10/94] refactor: unify legacy tool_search part rename helper
 in toolCatalog

renameLegacyToolSearchCallPart and renameLegacyToolSearchResultPart were byte-identical except for their part type. Collapse them into a single generic renameLegacyToolSearchPart<T extends { toolName: string }> and drop the now-unused ToolCallPart/ToolResultPart imports. Behavior-preserving.
---
 src/common/utils/tools/toolCatalog.ts | 25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/src/common/utils/tools/toolCatalog.ts b/src/common/utils/tools/toolCatalog.ts
index febcfa9207..eddf031cb4 100644
--- a/src/common/utils/tools/toolCatalog.ts
+++ b/src/common/utils/tools/toolCatalog.ts
@@ -12,13 +12,7 @@
  * aiService or streamText.
  */
 
-import type {
-  AssistantModelMessage,
-  Tool,
-  ToolCallPart,
-  ToolModelMessage,
-  ToolResultPart,
-} from "ai";
+import type { AssistantModelMessage, Tool, ToolModelMessage } from "ai";
 import type { ModelMessage, MuxMessage } from "@/common/types/message";
 import { buildRequiredToolPatterns, type ToolPolicy } from "@/common/utils/tools/toolPolicy";
 
@@ -577,13 +571,10 @@ function isMuxToolSearchOutput(output: unknown): boolean {
   );
 }
 
-function renameLegacyToolSearchCallPart(part: ToolCallPart): ToolCallPart {
-  return part.toolName === LEGACY_TOOL_SEARCH_TOOL_NAME
-    ? { ...part, toolName: TOOL_SEARCH_TOOL_NAME }
-    : part;
-}
-
-function renameLegacyToolSearchResultPart(part: ToolResultPart): ToolResultPart {
+// Generic over the part shape so the assistant tool-call and tool-result paths
+// share one implementation: both parts carry a `toolName`, and the rename is
+// identical regardless of which kind of part is being rewritten.
+function renameLegacyToolSearchPart<T extends { toolName: string }>(part: T): T {
   return part.toolName === LEGACY_TOOL_SEARCH_TOOL_NAME
     ? { ...part, toolName: TOOL_SEARCH_TOOL_NAME }
     : part;
@@ -663,10 +654,10 @@ export function normalizeLegacyToolSearchMessages(messages: ModelMessage[]): Mod
             return part;
           }
           if (part.type === "tool-call") {
-            return renameLegacyToolSearchCallPart(part);
+            return renameLegacyToolSearchPart(part);
           }
           if (part.type === "tool-result") {
-            return renameLegacyToolSearchResultPart(part);
+            return renameLegacyToolSearchPart(part);
           }
           return part;
         }
@@ -678,7 +669,7 @@ export function normalizeLegacyToolSearchMessages(messages: ModelMessage[]): Mod
     if (message.role === "tool") {
       const content: ToolModelMessage["content"] = message.content.map((part) => {
         if (part.type === "tool-result" && legacyCallIds.has(part.toolCallId)) {
-          return renameLegacyToolSearchResultPart(part);
+          return renameLegacyToolSearchPart(part);
         }
         return part;
       });

From 03435e9b6e4d7b45e46bbb58e51f99cec6edba13 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 20:30:58 +0000
Subject: [PATCH 11/94] refactor: drop duplicated context-cap rationale comment
 in codexOAuth

The CODEX_OAUTH_CONTEXT_WINDOW_OVERRIDES doc comment already explains that these caps are kept separate from model metadata so API-key requests retain the public window. #3724 rewrote the inline comment to restate the same point, so trim the duplicated sentence and keep only the tier-specific rationale. Comment-only; behavior-preserving.
---
 src/common/constants/codexOAuth.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/common/constants/codexOAuth.ts b/src/common/constants/codexOAuth.ts
index 08ba45958e..b3dbbe4bcd 100644
--- a/src/common/constants/codexOAuth.ts
+++ b/src/common/constants/codexOAuth.ts
@@ -139,7 +139,6 @@ export const CODEX_OAUTH_REQUIRED_MODELS = new Set<string>([
 const CODEX_OAUTH_CONTEXT_WINDOW_OVERRIDES: Record<string, number> = {
   // The public API exposes a 1.05M window for these models, but the ChatGPT/Codex
   // model catalog publishes smaller context windows (372K for the GPT-5.6 family).
-  // Keep auth-route caps separate so API-key requests retain the full public window.
   "gpt-5.5": 272_000,
   "gpt-5.6": 372_000,
   "gpt-5.6-sol": 372_000,

From 3f722c75020f1e4115d6e152bf9ca60bd17eb330 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 08:51:20 +0000
Subject: [PATCH 12/94] refactor: dedupe flat-section pinned block resolution
 in pinnedReorder

---
 src/browser/utils/ui/pinnedReorder.ts | 33 ++++++++++++++++++---------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/src/browser/utils/ui/pinnedReorder.ts b/src/browser/utils/ui/pinnedReorder.ts
index 74e4e47dc3..945c117eb6 100644
--- a/src/browser/utils/ui/pinnedReorder.ts
+++ b/src/browser/utils/ui/pinnedReorder.ts
@@ -47,6 +47,24 @@ function collectFlatSectionRows(
   return orderMultiProjectSectionRows(Array.from(byId.values()));
 }
 
+/**
+ * Resolve the pinned block for a flat-rendered section (multi-project or
+ * scratch). Both render as a single block regardless of source bucket, so the
+ * block's `fullOrder` and `blockIds` are identical: every pinned id of the
+ * section, in rendered order. Returns null when `meta` is not one of them.
+ */
+function locateFlatSectionPinnedBlock(
+  meta: FrontendWorkspaceMetadata,
+  sortedWorkspacesByProject: Map<string, FrontendWorkspaceMetadata[]>,
+  includeRow: (row: FrontendWorkspaceMetadata) => boolean
+): PinnedBlock | null {
+  const pinnedIds = collectFlatSectionRows(sortedWorkspacesByProject, includeRow)
+    .filter(isWorkspacePinned)
+    .map((row) => row.id);
+  if (!pinnedIds.includes(meta.id)) return null;
+  return { fullOrder: pinnedIds, blockIds: pinnedIds };
+}
+
 /**
  * Resolve the pinned block containing `meta`, mirroring the sidebar renderer:
  * multi-project rows form one flat block; regular rows partition by their
@@ -65,22 +83,15 @@ export function locatePinnedBlock(
   // partitioning below would isolate every row into a block of one and
   // swallow reorders. Treat them like the multi-project section instead.
   if (meta.kind === "scratch") {
-    const pinnedIds = collectFlatSectionRows(
+    return locateFlatSectionPinnedBlock(
+      meta,
       sortedWorkspacesByProject,
       (row) => row.kind === "scratch"
-    )
-      .filter(isWorkspacePinned)
-      .map((row) => row.id);
-    if (!pinnedIds.includes(meta.id)) return null;
-    return { fullOrder: pinnedIds, blockIds: pinnedIds };
+    );
   }
 
   if (isMultiProject(meta)) {
-    const pinnedIds = collectFlatSectionRows(sortedWorkspacesByProject, isMultiProject)
-      .filter(isWorkspacePinned)
-      .map((row) => row.id);
-    if (!pinnedIds.includes(meta.id)) return null;
-    return { fullOrder: pinnedIds, blockIds: pinnedIds };
+    return locateFlatSectionPinnedBlock(meta, sortedWorkspacesByProject, isMultiProject);
   }
 
   const rows = sortedWorkspacesByProject.get(meta.projectPath) ?? [];

From ef65608436f108db27a5f892c7a2fe2090338145 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 12:30:53 +0000
Subject: [PATCH 13/94] refactor: dedupe JSON-wrapped tool-output unwrap in
 workflowRunMessages

---
 src/common/utils/workflowRunMessages.ts | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/common/utils/workflowRunMessages.ts b/src/common/utils/workflowRunMessages.ts
index 66a2b3b5fa..2a80f0c3d1 100644
--- a/src/common/utils/workflowRunMessages.ts
+++ b/src/common/utils/workflowRunMessages.ts
@@ -25,6 +25,15 @@ function isRecordValue(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/**
+ * Tool outputs may be wrapped in a { type: "json", value } container (UI parts and SDK
+ * ToolResultPart outputs share this shape). Both the terminal-status probe and the
+ * record-stripping pass unwrap this the same way before inspecting the inner value.
+ */
+function isJsonWrappedOutput(output: Record<string, unknown>): boolean {
+  return output.type === "json" && "value" in output;
+}
+
 /**
  * workflow_run / workflow_resume outputs embed the full run record (script source, event
  * log, step snapshots) solely for the UI run card. The model only needs status/runId/result —
@@ -41,7 +50,7 @@ export function isTerminalWorkflowRunToolOutput(
   if (!isWorkflowRunEmittingToolName(toolName) || !isRecordValue(output)) {
     return false;
   }
-  if (output.type === "json" && "value" in output) {
+  if (isJsonWrappedOutput(output)) {
     return isTerminalWorkflowRunToolOutput(toolName, output.value, runId);
   }
   const status = output.status;
@@ -55,9 +64,7 @@ export function stripWorkflowRunRecordForModel(toolName: string, output: unknown
   if (!isWorkflowRunEmittingToolName(toolName) || !isRecordValue(output)) {
     return output;
   }
-  // Tool outputs may be wrapped in a { type: "json", value } container (UI parts and
-  // SDK ToolResultPart outputs share this shape).
-  if (output.type === "json" && "value" in output) {
+  if (isJsonWrappedOutput(output)) {
     const strippedValue = stripWorkflowRunRecordForModel(toolName, output.value);
     return strippedValue === output.value ? output : { ...output, value: strippedValue };
   }

From f1950e3f7d61b70d9235147e0e1d9e834e5c244f Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 16:34:22 +0000
Subject: [PATCH 14/94] refactor: hoist errorType local in
 finalizeWorkspaceTurnFromStreamError

Dedupe the repeated event.errorType member access and the duplicated
event.errorType != null guard introduced by #3729 into a single local
const. Pure behavior-preserving simplification; ErrorEvent.errorType is
a plain Zod-inferred data property with no side effects.
---
 src/node/services/taskService.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index 282d2867c9..02468ebfa9 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -15787,11 +15787,12 @@ export class TaskService implements AgentTaskIntegration {
     // Explicit in-session recovery cases (aborted, context_exceeded) may
     // continue through queued/preparing turns; auto-retryable errors require a
     // pending auto-retry of the same turn.
+    const errorType = event.errorType;
     const explicitRecovery =
-      event.errorType != null && WORKSPACE_TURN_RECOVERABLE_STREAM_ERRORS.has(event.errorType);
+      errorType != null && WORKSPACE_TURN_RECOVERABLE_STREAM_ERRORS.has(errorType);
     if (
-      event.errorType != null &&
-      isWorkspaceTurnRecoverableStreamError(event.errorType) &&
+      errorType != null &&
+      isWorkspaceTurnRecoverableStreamError(errorType) &&
       (await this.hasRecoverableWorkspaceTurnRetryInFlight(record.workspaceId, event.messageId, {
         requireAutoRetry: !explicitRecovery,
       }))

From 0538fee098f8bf6c8825c6d832275bed25fe4436 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 20:28:04 +0000
Subject: [PATCH 15/94] refactor: extract buildSkillDescriptor helper for skill
 discovery

---
 src/common/orpc/schemas.ts                    |  1 +
 src/common/orpc/schemas/agentSkill.ts         | 23 +++++++++++++++++++
 .../agentSkills/agentSkillsService.ts         | 12 ++--------
 src/node/services/tools/agent_skill_list.ts   | 16 ++++---------
 4 files changed, 30 insertions(+), 22 deletions(-)

diff --git a/src/common/orpc/schemas.ts b/src/common/orpc/schemas.ts
index 17e054d6d6..194b22a3bf 100644
--- a/src/common/orpc/schemas.ts
+++ b/src/common/orpc/schemas.ts
@@ -103,6 +103,7 @@ export {
   AgentSkillPackageSchema,
   AgentSkillScopeSchema,
   SkillNameSchema,
+  buildSkillDescriptor,
   resolveSkillAdvertise,
   resolveSkillUserInvocable,
   resolveSkillWhenToUse,
diff --git a/src/common/orpc/schemas/agentSkill.ts b/src/common/orpc/schemas/agentSkill.ts
index 7403338ec6..cb96ad898b 100644
--- a/src/common/orpc/schemas/agentSkill.ts
+++ b/src/common/orpc/schemas/agentSkill.ts
@@ -113,6 +113,29 @@ export const AgentSkillDescriptorSchema = z.object({
   pluginName: z.string().min(1).optional(),
 });
 
+/**
+ * Map validated SKILL.md frontmatter to the normalized AgentSkillDescriptor shape.
+ *
+ * Centralizes the frontmatter→descriptor field mapping (advertise / user-invocable /
+ * argument-hint / when-to-use normalization) so every discovery path produces byte-identical
+ * descriptors. Callers still validate the result with AgentSkillDescriptorSchema, since they
+ * handle validation failures differently (tool listing vs. diagnostics-collecting discovery).
+ */
+export function buildSkillDescriptor(
+  frontmatter: z.infer<typeof AgentSkillFrontmatterSchema>,
+  scope: z.infer<typeof AgentSkillScopeSchema>
+): z.infer<typeof AgentSkillDescriptorSchema> {
+  return {
+    name: frontmatter.name,
+    description: frontmatter.description,
+    scope,
+    advertise: resolveSkillAdvertise(frontmatter),
+    userInvocable: resolveSkillUserInvocable(frontmatter),
+    argumentHint: frontmatter["argument-hint"],
+    whenToUse: resolveSkillWhenToUse(frontmatter),
+  };
+}
+
 export const AgentSkillPackageSchema = z
   .object({
     scope: AgentSkillScopeSchema,
diff --git a/src/node/services/agentSkills/agentSkillsService.ts b/src/node/services/agentSkills/agentSkillsService.ts
index 2b2a6164c4..3406e370a7 100644
--- a/src/node/services/agentSkills/agentSkillsService.ts
+++ b/src/node/services/agentSkills/agentSkillsService.ts
@@ -22,9 +22,7 @@ import {
   AgentSkillDescriptorSchema,
   AgentSkillPackageSchema,
   SkillNameSchema,
-  resolveSkillAdvertise,
-  resolveSkillUserInvocable,
-  resolveSkillWhenToUse,
+  buildSkillDescriptor,
 } from "@/common/orpc/schemas";
 import type {
   AgentSkillDescriptor,
@@ -536,13 +534,7 @@ async function readSkillDescriptorFromDir(
     });
 
     const descriptor: AgentSkillDescriptor = {
-      name: parsed.frontmatter.name,
-      description: parsed.frontmatter.description,
-      scope,
-      advertise: resolveSkillAdvertise(parsed.frontmatter),
-      userInvocable: resolveSkillUserInvocable(parsed.frontmatter),
-      argumentHint: parsed.frontmatter["argument-hint"],
-      whenToUse: resolveSkillWhenToUse(parsed.frontmatter),
+      ...buildSkillDescriptor(parsed.frontmatter, scope),
       ...(options?.pluginName !== undefined ? { pluginName: options.pluginName } : {}),
     };
 
diff --git a/src/node/services/tools/agent_skill_list.ts b/src/node/services/tools/agent_skill_list.ts
index 9c50507bd5..a626c8e15f 100644
--- a/src/node/services/tools/agent_skill_list.ts
+++ b/src/node/services/tools/agent_skill_list.ts
@@ -7,9 +7,7 @@ import { listProjectMetadataRelativePaths } from "@/common/compat/legacyMux";
 import {
   AgentSkillDescriptorSchema,
   SkillNameSchema,
-  resolveSkillAdvertise,
-  resolveSkillUserInvocable,
-  resolveSkillWhenToUse,
+  buildSkillDescriptor,
 } from "@/common/orpc/schemas";
 import type { AgentSkillDescriptor } from "@/common/types/agentSkill";
 import type { AgentSkillListToolResult } from "@/common/types/tools";
@@ -128,15 +126,9 @@ async function readSkillDescriptor(
       directoryName,
     });
 
-    const descriptorResult = AgentSkillDescriptorSchema.safeParse({
-      name: parsed.frontmatter.name,
-      description: parsed.frontmatter.description,
-      scope,
-      advertise: resolveSkillAdvertise(parsed.frontmatter),
-      userInvocable: resolveSkillUserInvocable(parsed.frontmatter),
-      argumentHint: parsed.frontmatter["argument-hint"],
-      whenToUse: resolveSkillWhenToUse(parsed.frontmatter),
-    });
+    const descriptorResult = AgentSkillDescriptorSchema.safeParse(
+      buildSkillDescriptor(parsed.frontmatter, scope)
+    );
 
     if (!descriptorResult.success) {
       log.warn(

From 3620c76a9910d0cd6627d51ce6dc4ecb6174a9a6 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 16:34:14 +0000
Subject: [PATCH 16/94] refactor: extract awaitPendingLoad helper in
 DevToolsService

---
 src/node/services/devToolsService.ts | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/node/services/devToolsService.ts b/src/node/services/devToolsService.ts
index 5824864ff5..c924d0bb64 100644
--- a/src/node/services/devToolsService.ts
+++ b/src/node/services/devToolsService.ts
@@ -349,10 +349,7 @@ export class DevToolsService extends EventEmitter {
 
     // Wait for any in-flight load to finish before clearing, otherwise the
     // pending loadFromDisk can repopulate stale data after the clear.
-    const pendingLoad = this.loadingPromises.get(workspaceId);
-    if (pendingLoad) {
-      await pendingLoad;
-    }
+    await this.awaitPendingLoad(workspaceId);
 
     const data = this.getOrCreateWorkspaceData(workspaceId);
     data.runs.clear();
@@ -388,10 +385,7 @@ export class DevToolsService extends EventEmitter {
 
     // Wait for any in-flight load to finish so it cannot repopulate state
     // after the removal below.
-    const pendingLoad = this.loadingPromises.get(workspaceId);
-    if (pendingLoad) {
-      await pendingLoad;
-    }
+    await this.awaitPendingLoad(workspaceId);
 
     // Deleting the entry (rather than clearing it in place) makes stale queued
     // appends no-ops via the existence guard in appendToFile.
@@ -406,6 +400,18 @@ export class DevToolsService extends EventEmitter {
     this.emitWorkspaceEvent(workspaceId, { type: "cleared" });
   }
 
+  /**
+   * Wait for any in-flight load for this workspace to finish before mutating
+   * its state, otherwise a pending loadFromDisk can repopulate stale data after
+   * the mutation.
+   */
+  private async awaitPendingLoad(workspaceId: string): Promise<void> {
+    const pendingLoad = this.loadingPromises.get(workspaceId);
+    if (pendingLoad) {
+      await pendingLoad;
+    }
+  }
+
   private emitWorkspaceEvent(workspaceId: string, event: DevToolsEvent): void {
     this.emit(`update:${workspaceId}`, event);
   }

From 873195259eae109558f61c5690250a398296feef Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 16:40:06 +0000
Subject: [PATCH 17/94] refactor: extract getTotalTokens helper for total-token
 sums

---
 .../features/RightSidebar/CostsTab.tsx        |  8 ++------
 src/browser/stores/WorkspaceStore.ts          | 10 ++--------
 src/cli/run.ts                                | 19 +++---------------
 src/common/utils/tokens/tokenMeterUtils.ts    |  9 ++-------
 .../utils/tokens/usageAggregator.test.ts      | 20 ++++++++++++++++++-
 src/common/utils/tokens/usageAggregator.ts    | 15 ++++++++++++++
 src/node/services/sessionUsageService.ts      |  9 ++-------
 7 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/src/browser/features/RightSidebar/CostsTab.tsx b/src/browser/features/RightSidebar/CostsTab.tsx
index 68e6666d8e..cf5896d39c 100644
--- a/src/browser/features/RightSidebar/CostsTab.tsx
+++ b/src/browser/features/RightSidebar/CostsTab.tsx
@@ -4,6 +4,7 @@ import {
   sumUsageHistory,
   formatCostWithDollar,
   getTotalCost,
+  getTotalTokens,
   type ChatUsageDisplay,
 } from "@/common/utils/tokens/usageAggregator";
 import { formatModelStringForDisplay } from "@/common/utils/ai/models";
@@ -66,12 +67,7 @@ const CostsTabComponent: React.FC<CostsTabProps> = ({ workspaceId }) => {
     return Array.from(merged.entries())
       .map(([model, entry]) => ({
         model,
-        tokens:
-          entry.input.tokens +
-          entry.cached.tokens +
-          entry.cacheCreate.tokens +
-          entry.output.tokens +
-          entry.reasoning.tokens,
+        tokens: getTotalTokens(entry),
         cost: getTotalCost(entry),
       }))
       .sort((a, b) => (b.cost ?? 0) - (a.cost ?? 0) || b.tokens - a.tokens);
diff --git a/src/browser/stores/WorkspaceStore.ts b/src/browser/stores/WorkspaceStore.ts
index 4198349201..1549c28159 100644
--- a/src/browser/stores/WorkspaceStore.ts
+++ b/src/browser/stores/WorkspaceStore.ts
@@ -80,7 +80,7 @@ import { computeProvidersConfigFingerprint } from "@/common/utils/providers/conf
 import { isDurableCompactionBoundaryMarker } from "@/common/utils/messages/compactionBoundary";
 import { WorkspaceConsumerManager } from "./WorkspaceConsumerManager";
 import type { ChatUsageDisplay } from "@/common/utils/tokens/usageAggregator";
-import { sumUsageHistory } from "@/common/utils/tokens/usageAggregator";
+import { sumUsageHistory, getTotalTokens } from "@/common/utils/tokens/usageAggregator";
 import type { TokenConsumer } from "@/common/types/chatStats";
 import { normalizeUsageModelKey } from "@/common/utils/providers/modelEntries";
 import type { z } from "zod";
@@ -2816,13 +2816,7 @@ export class WorkspaceStore {
       const lastRequest = sessionData?.lastRequest;
 
       // Calculate total tokens from session total
-      const totalTokens = sessionTotal
-        ? sessionTotal.input.tokens +
-          sessionTotal.cached.tokens +
-          sessionTotal.cacheCreate.tokens +
-          sessionTotal.output.tokens +
-          sessionTotal.reasoning.tokens
-        : 0;
+      const totalTokens = getTotalTokens(sessionTotal);
 
       const messages = aggregator.getAllMessages();
       if (messages.length === 0) {
diff --git a/src/cli/run.ts b/src/cli/run.ts
index 973ddc48fb..7dc584c49d 100644
--- a/src/cli/run.ts
+++ b/src/cli/run.ts
@@ -44,6 +44,7 @@ import type { ServiceTier } from "../common/config/schemas/providersConfig";
 import { createDisplayUsage } from "../common/utils/tokens/displayUsage";
 import {
   getTotalCost,
+  getTotalTokens,
   formatCostWithDollar,
   sumUsageHistory,
   type ChatUsageDisplay,
@@ -1300,14 +1301,7 @@ async function main(): Promise<number> {
         if (budget !== undefined && !budgetExceeded) {
           const totalUsage = sumUsageHistory(usageHistory);
           const cost = getTotalCost(totalUsage);
-          const hasTokens = totalUsage
-            ? totalUsage.input.tokens +
-                totalUsage.output.tokens +
-                totalUsage.cached.tokens +
-                totalUsage.cacheCreate.tokens +
-                totalUsage.reasoning.tokens >
-              0
-            : false;
+          const hasTokens = getTotalTokens(totalUsage) > 0;
 
           if (hasTokens && cost === undefined) {
             const errMsg = `Cannot enforce budget: unknown pricing for model "${payload.metadata.model ?? model}"`;
@@ -1390,14 +1384,7 @@ async function main(): Promise<number> {
         // Reject if model has unknown pricing: displayUsage exists with tokens but cost is undefined
         // (createDisplayUsage doesn't set hasUnknownCosts; that's only set by sumUsageHistory)
         // Include all token types: input, output, cached, cacheCreate, and reasoning
-        const hasTokens =
-          displayUsage &&
-          displayUsage.input.tokens +
-            displayUsage.output.tokens +
-            displayUsage.cached.tokens +
-            displayUsage.cacheCreate.tokens +
-            displayUsage.reasoning.tokens >
-            0;
+        const hasTokens = getTotalTokens(displayUsage) > 0;
         if (hasTokens && cost === undefined) {
           const errMsg = `Cannot enforce budget: unknown pricing for model "${model}"`;
           emitJsonLine({ type: "budget-error", error: errMsg, model });
diff --git a/src/common/utils/tokens/tokenMeterUtils.ts b/src/common/utils/tokens/tokenMeterUtils.ts
index 77b542d9e4..74a3ba0b50 100644
--- a/src/common/utils/tokens/tokenMeterUtils.ts
+++ b/src/common/utils/tokens/tokenMeterUtils.ts
@@ -1,6 +1,6 @@
 import type { ProvidersConfigMap } from "@/common/orpc/types";
 import { getEffectiveContextLimit } from "@/common/utils/compaction/contextLimit";
-import type { ChatUsageDisplay } from "./usageAggregator";
+import { getTotalTokens, type ChatUsageDisplay } from "./usageAggregator";
 
 // NOTE: Provide theme-matching fallbacks so token meters render consistently
 // even if a host environment doesn't define the CSS variables (e.g., an embedded UI).
@@ -69,12 +69,7 @@ export function calculateTokenMeterData(
   // Total tokens used in the request.
   // For Anthropic prompt caching, cacheCreate tokens are reported separately but still
   // count toward total input tokens for the request.
-  const totalUsed =
-    usage.input.tokens +
-    usage.cached.tokens +
-    usage.cacheCreate.tokens +
-    usage.output.tokens +
-    usage.reasoning.tokens;
+  const totalUsed = getTotalTokens(usage);
 
   const toPercentage = (tokens: number) => {
     if (verticalProportions) {
diff --git a/src/common/utils/tokens/usageAggregator.test.ts b/src/common/utils/tokens/usageAggregator.test.ts
index 0f4f72602d..b63b5c3825 100644
--- a/src/common/utils/tokens/usageAggregator.test.ts
+++ b/src/common/utils/tokens/usageAggregator.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
-import { getTotalCost, sumUsageHistory } from "./usageAggregator";
+import { getTotalCost, getTotalTokens, sumUsageHistory } from "./usageAggregator";
 
 describe("sumUsageHistory", () => {
   test("preserves hasUnknownCosts when an entry is approximate but still has numeric costs", () => {
@@ -27,3 +27,21 @@ describe("sumUsageHistory", () => {
     expect(getTotalCost(result)).toBeCloseTo(0.544);
   });
 });
+
+describe("getTotalTokens", () => {
+  test("sums tokens across all five components", () => {
+    expect(
+      getTotalTokens({
+        input: { tokens: 100 },
+        cached: { tokens: 20 },
+        cacheCreate: { tokens: 5 },
+        output: { tokens: 10 },
+        reasoning: { tokens: 3 },
+      })
+    ).toBe(138);
+  });
+
+  test("returns 0 for undefined usage", () => {
+    expect(getTotalTokens(undefined)).toBe(0);
+  });
+});
diff --git a/src/common/utils/tokens/usageAggregator.ts b/src/common/utils/tokens/usageAggregator.ts
index 50ca39a6d9..8908e3aecd 100644
--- a/src/common/utils/tokens/usageAggregator.ts
+++ b/src/common/utils/tokens/usageAggregator.ts
@@ -116,6 +116,21 @@ export function getTotalCost(usage: ChatUsageDisplay | undefined): number | unde
   return hasAnyCost ? total : undefined;
 }
 
+/**
+ * Sum the token counts across every usage component (input, cached,
+ * cacheCreate, output, reasoning) into a single total. Mirrors the component
+ * iteration used by getTotalCost so token totals stay consistent everywhere.
+ */
+export function getTotalTokens(usage: ChatUsageDisplay | undefined): number {
+  if (!usage) return 0;
+  const components = ["input", "cached", "cacheCreate", "output", "reasoning"] as const;
+  let total = 0;
+  for (const key of components) {
+    total += usage[key].tokens;
+  }
+  return total;
+}
+
 /**
  * Format cost for display with dollar sign.
  * Returns "~$0.00" for very small values, "$X.XX" otherwise.
diff --git a/src/node/services/sessionUsageService.ts b/src/node/services/sessionUsageService.ts
index 135c7e1915..67bc8fa724 100644
--- a/src/node/services/sessionUsageService.ts
+++ b/src/node/services/sessionUsageService.ts
@@ -8,7 +8,7 @@ import { isWorkspaceRemovalTombstoned } from "@/node/services/workspaceRemoval";
 import { withTargetMutationLock } from "@/node/services/refinement/targetMutationLocks";
 import { workspaceFileLocks } from "@/node/utils/concurrency/workspaceFileLocks";
 import type { ChatUsageDisplay } from "@/common/utils/tokens/usageAggregator";
-import { sumUsageHistory } from "@/common/utils/tokens/usageAggregator";
+import { sumUsageHistory, getTotalTokens } from "@/common/utils/tokens/usageAggregator";
 import { createDisplayUsage } from "@/common/utils/tokens/displayUsage";
 import {
   normalizeUsage,
@@ -524,12 +524,7 @@ export class SessionUsageService {
         cachedTokens += usage.cached.tokens;
         cacheCreateTokens += usage.cacheCreate.tokens;
 
-        totalTokens +=
-          usage.input.tokens +
-          usage.output.tokens +
-          usage.reasoning.tokens +
-          usage.cached.tokens +
-          usage.cacheCreate.tokens;
+        totalTokens += getTotalTokens(usage);
         contextTokens += usage.input.tokens + usage.cached.tokens + usage.cacheCreate.tokens;
 
         for (const bucket of [

From 7b7d08ffa627a2d5d00a13e0045ad6a04035feb0 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:35:24 +0000
Subject: [PATCH 18/94] refactor: hoist duplicated dedupeKeys snapshot in
 removeByDedupeKeyPrefix

---
 src/node/services/messageQueue.ts | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/node/services/messageQueue.ts b/src/node/services/messageQueue.ts
index b0935d111d..977029e05d 100644
--- a/src/node/services/messageQueue.ts
+++ b/src/node/services/messageQueue.ts
@@ -780,9 +780,11 @@ export class MessageQueue {
     let removedCount = 0;
     const removedCallbacks: QueueClearCallbacks[] = [];
     this.entries = this.entries.flatMap((entry) => {
-      const matchingKeys = [...entry.dedupeKeys].filter((dedupeKey) =>
-        dedupeKey.startsWith(prefix)
-      );
+      // Snapshot the dedupe keys once: the message-index lookup below would otherwise
+      // re-spread the Set on every message iteration. The Set is not mutated until after
+      // keptMessages is computed, so both reads observe the same ordered snapshot.
+      const dedupeKeyList = [...entry.dedupeKeys];
+      const matchingKeys = dedupeKeyList.filter((dedupeKey) => dedupeKey.startsWith(prefix));
       if (matchingKeys.length === 0) {
         return [entry];
       }
@@ -792,7 +794,7 @@ export class MessageQueue {
       // preserve unrelated keys/messages that share the same entry.
       const matchingKeySet = new Set(matchingKeys);
       const keptMessages = entry.messages.filter((_message, index) => {
-        const key = [...entry.dedupeKeys][index];
+        const key = dedupeKeyList[index];
         return key == null || !matchingKeySet.has(key);
       });
       if (keptMessages.length > 0) {

From cfc8606a4a9f1fd65827f6f8e702cd740c8ee66d Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 05:12:28 +0000
Subject: [PATCH 19/94] refactor: dedupe settled workspace-turn reconciliation
 guard

Extract the byte-identical 'reload under lock and bail unless the record
is still the exact one we reconciled (same status AND updatedAt)' guard
shared by persistRepairedSettledWorkspaceTurn and reviveRetryingWorkspaceTurn
(both added in #3738) into a module-level isReconciledWorkspaceTurnUnchanged
type guard. The guard narrows current to non-null for the revive path, and
the generic 'compare updatedAt too' rationale now lives in one doc comment
while each call site keeps its situational note. Behavior-preserving.
---
 src/node/services/taskService.ts | 38 ++++++++++++++++++--------------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index 02468ebfa9..8dfed87832 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -1061,6 +1061,23 @@ function isSelfHealEligibleSettledWorkspaceTurn(
   );
 }
 
+/**
+ * Under the settlement lock, confirm a reloaded handle is still the exact record a read-time
+ * reconciliation resolved against before mutating it. Comparing updatedAt as well as status
+ * matters: a concurrent settlement can produce a NEWER record with the same status, and a
+ * stale read must not clobber it. Callers pass a `null` / non-matching `current` straight
+ * through so the concurrent winner is reported. Typed as a guard so the matched branch narrows
+ * `current` to a non-null record.
+ */
+function isReconciledWorkspaceTurnUnchanged(
+  current: WorkspaceTurnTaskHandleRecord | null,
+  record: WorkspaceTurnTaskHandleRecord
+): current is WorkspaceTurnTaskHandleRecord {
+  return (
+    current != null && current.status === record.status && current.updatedAt === record.updatedAt
+  );
+}
+
 /**
  * A workspace-turn stream error may resolve without parent intervention when
  * the child can still make progress on its own. The caller must still confirm
@@ -11720,13 +11737,7 @@ export class TaskService implements AgentTaskIntegration {
         record.handleId
       );
       // A concurrent settlement/repair wins; only replace the exact record we reconciled.
-      // Comparing updatedAt (not just status) matters: a concurrent settlement can produce
-      // a NEWER record with the same status that must not be clobbered by our stale read.
-      if (
-        current == null ||
-        current.status !== record.status ||
-        current.updatedAt !== record.updatedAt
-      ) {
+      if (!isReconciledWorkspaceTurnUnchanged(current, record)) {
         // If this direct parent's task_await will return that concurrent terminal winner,
         // consume it here so its post-lock delivery cannot append the same outcome too.
         return await this.markDirectParentWorkspaceTurnResultConsumedUnlocked(
@@ -11791,15 +11802,10 @@ export class TaskService implements AgentTaskIntegration {
         record.ownerWorkspaceId,
         record.handleId
       );
-      // A concurrent transition wins; only revive the exact record we reconciled against.
-      // Comparing updatedAt (not just status) matters: the live retry itself can fail and
-      // settle a NEWER record with the same status (e.g. error → error) between our read
-      // and this lock — reviving that fresh terminal failure would strand task_await.
-      if (
-        current == null ||
-        current.status !== record.status ||
-        current.updatedAt !== record.updatedAt
-      ) {
+      // A concurrent transition wins; only revive the exact record we reconciled against — the
+      // live retry can itself fail into a NEWER error record between our read and this lock, and
+      // reviving that fresh terminal failure would strand task_await.
+      if (!isReconciledWorkspaceTurnUnchanged(current, record)) {
         return current;
       }
       // Another turn already owns the child workspace; the activity is not this turn's retry.

From a30226835d4fd8ff341587b48d01927ec2237718 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 00:29:14 +0000
Subject: [PATCH 20/94] refactor: drop duplicated Kimi K3 max-effort rationale
 in providerOptions

The isKimiK3Model docstring already explains that Kimi K3 always reasons
and supports only the max reasoning effort, and that the provider-options
branches key off the predicate. #3737 restated that same sentence verbatim
in both the Moonshot and OpenRouter branches of buildProviderOptions, so
trim the duplicated lead sentence and keep only each branch's site-specific
"send it explicitly" rationale. Comment-only; behavior-preserving.
---
 src/common/utils/ai/providerOptions.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/common/utils/ai/providerOptions.ts b/src/common/utils/ai/providerOptions.ts
index 04b863be7e..8b4a1f48c6 100644
--- a/src/common/utils/ai/providerOptions.ts
+++ b/src/common/utils/ai/providerOptions.ts
@@ -581,8 +581,8 @@ export function buildProviderOptions(
 
   // Build Moonshot-specific options
   if (formatProvider === "moonshotai") {
-    // Kimi K3 always reasons and supports only the max reasoning effort. Send it
-    // explicitly rather than relying on the API default.
+    // Send the max reasoning effort explicitly rather than relying on the API
+    // default (see isKimiK3Model for why K3 only accepts "max").
     if (isKimiK3Model(capabilityModel)) {
       const options = {
         moonshotai: { reasoningEffort: "max" },
@@ -618,9 +618,9 @@ export function buildProviderOptions(
 
   // Build OpenRouter-specific options
   if (formatProvider === "openrouter") {
-    // Kimi K3 always reasons and supports only the max reasoning effort. Send it
-    // explicitly: `enabled: true` alone falls back to OpenRouter's default (medium)
-    // effort, which the model does not support.
+    // Send the max reasoning effort explicitly: `enabled: true` alone falls back
+    // to OpenRouter's default (medium) effort, which K3 does not support (see
+    // isKimiK3Model for why K3 only accepts "max").
     const reasoningEffort = isKimiK3Model(capabilityModel)
       ? "max"
       : OPENROUTER_REASONING_EFFORT[effectiveThinking];

From 8012da79b2ac6c0f1842194e52972076ef5f8d01 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 20:33:31 +0000
Subject: [PATCH 21/94] refactor: drop redundant structuredOutput guard at
 subagent report call sites

formatSubagentReportUserMessage already omits structuredOutput from the
envelope when it is undefined, so the two call sites re-implemented that
exact guard. Forward report.structuredOutput directly instead. Behavior-
preserving: the helper's internal !== undefined check yields byte-identical
envelope output whether the key is absent or explicitly undefined.
---
 src/node/services/taskService.ts | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index 8dfed87832..f5b36a663a 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -377,6 +377,8 @@ function formatSubagentReportUserMessage(params: {
     ...(params.executionId != null ? { executionId: params.executionId } : {}),
     ...(params.model != null ? { model: params.model } : {}),
     ...(params.thinkingLevel != null ? { thinkingLevel: params.thinkingLevel } : {}),
+    // Omit structuredOutput entirely when absent so callers can forward the value directly
+    // without re-implementing the undefined guard at each call site.
     ...(params.structuredOutput !== undefined ? { structuredOutput: params.structuredOutput } : {}),
   });
 }
@@ -10352,9 +10354,7 @@ export class TaskService implements AgentTaskIntegration {
         ...(childEntry.workspace.taskThinkingLevel != null
           ? { thinkingLevel: childEntry.workspace.taskThinkingLevel }
           : {}),
-        ...(report.structuredOutput !== undefined
-          ? { structuredOutput: report.structuredOutput }
-          : {}),
+        structuredOutput: report.structuredOutput,
       });
       // A progress report is itself the wake-up message. Unlike terminal attention, it must be
       // allowed through while this child is still active so review findings and other incremental
@@ -17811,9 +17811,7 @@ export class TaskService implements AgentTaskIntegration {
       status: "completed",
       ...(childModelString != null ? { model: childModelString } : {}),
       ...(childThinkingLevel != null ? { thinkingLevel: childThinkingLevel } : {}),
-      ...(report.structuredOutput !== undefined
-        ? { structuredOutput: report.structuredOutput }
-        : {}),
+      structuredOutput: report.structuredOutput,
     });
 
     const workspaceTurnMuxMetadata =

From 68191d8154baaa27afa1a9ccbaec9bad62d68265 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 12:36:44 +0000
Subject: [PATCH 22/94] refactor: extract isZipMediaType helper for staged
 attachment media-type checks

---
 .../attachments/supportedAttachmentMediaTypes.ts    | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/common/utils/attachments/supportedAttachmentMediaTypes.ts b/src/common/utils/attachments/supportedAttachmentMediaTypes.ts
index f8d3fb0321..e3230b9de8 100644
--- a/src/common/utils/attachments/supportedAttachmentMediaTypes.ts
+++ b/src/common/utils/attachments/supportedAttachmentMediaTypes.ts
@@ -78,6 +78,12 @@ export function getSupportedAttachmentMediaType(args: {
   return isSupportedAttachmentMediaType(normalized) ? normalized : null;
 }
 
+// Membership check against the accepted ZIP media types, isolating the
+// `as const` tuple cast that both staged-attachment paths would otherwise repeat.
+function isZipMediaType(normalized: string): boolean {
+  return ZIP_MEDIA_TYPES.includes(normalized as (typeof ZIP_MEDIA_TYPES)[number]);
+}
+
 function sanitizeStagedAttachmentMediaType(mediaType: string): string | null {
   const normalized = normalizeAttachmentMediaType(mediaType);
   if (
@@ -92,10 +98,7 @@ function sanitizeStagedAttachmentMediaType(mediaType: string): string | null {
 
 export function isSupportedStagedAttachmentMediaType(mediaType: string): boolean {
   const normalized = normalizeAttachmentMediaType(mediaType);
-  return (
-    ZIP_MEDIA_TYPES.includes(normalized as (typeof ZIP_MEDIA_TYPES)[number]) ||
-    sanitizeStagedAttachmentMediaType(normalized) != null
-  );
+  return isZipMediaType(normalized) || sanitizeStagedAttachmentMediaType(normalized) != null;
 }
 
 export function getSupportedStagedAttachmentMediaType(args: {
@@ -105,7 +108,7 @@ export function getSupportedStagedAttachmentMediaType(args: {
   const trimmedMediaType = args.mediaType?.trim();
   if (trimmedMediaType != null && trimmedMediaType.length > 0) {
     const normalized = normalizeAttachmentMediaType(trimmedMediaType);
-    if (ZIP_MEDIA_TYPES.includes(normalized as (typeof ZIP_MEDIA_TYPES)[number])) {
+    if (isZipMediaType(normalized)) {
       return ZIP_MEDIA_TYPE;
     }
     return sanitizeStagedAttachmentMediaType(normalized) ?? DEFAULT_STAGED_MEDIA_TYPE;

From 4c84f77b0879404515d6cc19715f699c1834bd13 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 09:01:55 +0000
Subject: [PATCH 23/94] refactor: hoist duplicated goal-bypass attachment check
 in ChatInput

---
 src/browser/features/ChatInput/index.tsx | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/src/browser/features/ChatInput/index.tsx b/src/browser/features/ChatInput/index.tsx
index ff58313208..41bc682285 100644
--- a/src/browser/features/ChatInput/index.tsx
+++ b/src/browser/features/ChatInput/index.tsx
@@ -1860,13 +1860,16 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
     }
     const combinedMcpPromptRefs = mcpPromptRefsResult.refs;
 
+    // The initial /goal path sets a goal without sending a user message, so
+    // attachments would be silently dropped. With attachments present, skip
+    // command processing and send the raw text as a normal message instead.
+    // Shared by the creation route below and the workspace path (transferred
+    // creation drafts retried in the composer), which resolve `parsed` and
+    // `attachments` identically.
+    const goalCommandBypassedForAttachments = parsed?.type === "goal-set" && attachments.length > 0;
+
     // Route to creation handler for creation variant
     if (variant === "creation") {
-      // The initial /goal path sets a goal without sending a user message, so
-      // attachments would be silently dropped. With attachments present, skip
-      // command processing and send the raw text as a normal message instead.
-      const goalCommandBypassedForAttachments =
-        parsed?.type === "goal-set" && attachments.length > 0;
       const initialSlashCommand =
         parsed?.type === "goal-set" && !goalCommandBypassedForAttachments ? parsed : undefined;
       if (
@@ -1971,12 +1974,6 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
 
     try {
       const modelOneShot = parsed?.type === "model-oneshot" ? parsed : null;
-      // Mirror the creation-composer /goal bypass: with attachments present,
-      // send the raw text as a normal message instead of processing the
-      // command, which would drop the files. Transferred staging-failure
-      // drafts (raw /goal text + staged/pending chips) retry through here.
-      const goalCommandBypassedForAttachments =
-        parsed?.type === "goal-set" && attachments.length > 0;
       const commandHandled =
         modelOneShot || goalCommandBypassedForAttachments
           ? false

From 943b1143273b0113b8c089b437bb926e86a821b4 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 20:34:12 +0000
Subject: [PATCH 24/94] refactor: dedupe anchored Anthropic model-id regex
 construction

The native/beta 1M-context pattern lists repeated the same
`new RegExp(`^<id>${OPTIONAL_VERSION_SUFFIX}$`, "i")` construction ten
times, so each new model entry had to restate the anchoring and flags.
Extract anthropicModelIdPattern() and map base model ids through it;
generated regex sources and flags are unchanged.
---
 src/common/utils/ai/models.ts | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/src/common/utils/ai/models.ts b/src/common/utils/ai/models.ts
index f4b4d614ea..277a5f48e7 100644
--- a/src/common/utils/ai/models.ts
+++ b/src/common/utils/ai/models.ts
@@ -176,21 +176,30 @@ export function getModelProvider(modelString: string): string {
 export type Anthropic1MContextMode = "none" | "beta" | "native";
 
 const OPTIONAL_VERSION_SUFFIX = String.raw`(?:-(?:\d{8}|\d{4}-\d{2}-\d{2}))?`;
+
+/**
+ * Build a case-insensitive, fully anchored matcher for a base Anthropic model id
+ * plus its optional dated snapshot suffix (e.g. `claude-opus-5-20260724`). Base
+ * ids are literal model names, so no regex escaping is needed.
+ */
+function anthropicModelIdPattern(baseModelId: string): RegExp {
+  return new RegExp(`^${baseModelId}${OPTIONAL_VERSION_SUFFIX}$`, "i");
+}
+
 const ANTHROPIC_NATIVE_1M_PATTERNS = [
   // Mythos-class models (Fable 5 / Mythos 5) ship 1M context as standard metadata.
-  new RegExp(`^claude-fable-5${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-mythos-5${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-opus-5${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-opus-4-8${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-opus-4-7${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-opus-4-6${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-sonnet-5${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-sonnet-4-6${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-];
-const ANTHROPIC_BETA_1M_PATTERNS = [
-  new RegExp(`^claude-sonnet-4-5${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-  new RegExp(`^claude-sonnet-4-20250514${OPTIONAL_VERSION_SUFFIX}$`, "i"),
-];
+  "claude-fable-5",
+  "claude-mythos-5",
+  "claude-opus-5",
+  "claude-opus-4-8",
+  "claude-opus-4-7",
+  "claude-opus-4-6",
+  "claude-sonnet-5",
+  "claude-sonnet-4-6",
+].map(anthropicModelIdPattern);
+const ANTHROPIC_BETA_1M_PATTERNS = ["claude-sonnet-4-5", "claude-sonnet-4-20250514"].map(
+  anthropicModelIdPattern
+);
 
 function matchesAnthropicPattern(modelName: string, patterns: readonly RegExp[]): boolean {
   return patterns.some((pattern) => pattern.test(modelName));

From fd77fb6d2861c77bff93fc558eb6565e0b16fd3a Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 08:45:33 +0000
Subject: [PATCH 25/94] refactor: extract _child_dirs helper for job folder
 discovery

---
 .../prepare_leaderboard_submission.py           | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/benchmarks/terminal_bench/prepare_leaderboard_submission.py b/benchmarks/terminal_bench/prepare_leaderboard_submission.py
index 4b94e293b8..e379b25e5a 100755
--- a/benchmarks/terminal_bench/prepare_leaderboard_submission.py
+++ b/benchmarks/terminal_bench/prepare_leaderboard_submission.py
@@ -216,6 +216,11 @@ def get_model_from_config(config_path: Path) -> str | None:
         return None
 
 
+def _child_dirs(path: Path) -> list[Path]:
+    """List the immediate subdirectories of a directory, skipping plain files."""
+    return [child for child in path.iterdir() if child.is_dir()]
+
+
 def _is_job_folder(path: Path) -> bool:
     """Check if a directory looks like a job folder (contains trial dirs with config.json)."""
     if not path.is_dir():
@@ -249,20 +254,14 @@ def find_job_folders(artifacts_dir: Path) -> list[Path]:
     # Check for direct jobs/ folder
     direct_jobs = artifacts_dir / "jobs"
     if direct_jobs.exists():
-        for item in direct_jobs.iterdir():
-            if item.is_dir():
-                job_folders.append(item)
+        job_folders.extend(_child_dirs(direct_jobs))
         return job_folders
 
     # Check for per-artifact structure
-    for artifact_dir in artifacts_dir.iterdir():
-        if not artifact_dir.is_dir():
-            continue
+    for artifact_dir in _child_dirs(artifacts_dir):
         jobs_dir = artifact_dir / "jobs"
         if jobs_dir.exists():
-            for item in jobs_dir.iterdir():
-                if item.is_dir():
-                    job_folders.append(item)
+            job_folders.extend(_child_dirs(jobs_dir))
 
     return job_folders
 

From 60f59345bd66e06374d4b752b66f625d457bc66a Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:36:53 +0000
Subject: [PATCH 26/94] refactor: drop redundant "exec" fallback duplication
 for normalizeAgentId

normalizeAgentId's fallback parameter already defaults to
WORKSPACE_DEFAULTS.agentId ("exec"), so the four call sites that passed
"exec" explicitly were re-hardcoding the centralized default. Dropping the
literal also makes the workspaceModeAi wrapper (whose only job was supplying
that fallback) dead, so it and its aliased import are removed.
---
 .../components/WorkspaceModeAISync/WorkspaceModeAISync.tsx  | 2 +-
 src/browser/features/ChatInput/index.tsx                    | 4 ++--
 src/browser/utils/workspaceModeAi.ts                        | 6 +-----
 3 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/browser/components/WorkspaceModeAISync/WorkspaceModeAISync.tsx b/src/browser/components/WorkspaceModeAISync/WorkspaceModeAISync.tsx
index 8fd18e8992..ca68a4cfb6 100644
--- a/src/browser/components/WorkspaceModeAISync/WorkspaceModeAISync.tsx
+++ b/src/browser/components/WorkspaceModeAISync/WorkspaceModeAISync.tsx
@@ -43,7 +43,7 @@ export function WorkspaceModeAISync(props: { workspaceId: string }): null {
     const modelKey = getModelKey(workspaceId);
     const thinkingKey = getThinkingLevelKey(workspaceId);
 
-    const normalizedAgentId = normalizeAgentId(agentId, "exec");
+    const normalizedAgentId = normalizeAgentId(agentId);
 
     const isExplicitAgentSwitch =
       prevAgentIdRef.current !== null &&
diff --git a/src/browser/features/ChatInput/index.tsx b/src/browser/features/ChatInput/index.tsx
index 41bc682285..9d1001e6df 100644
--- a/src/browser/features/ChatInput/index.tsx
+++ b/src/browser/features/ChatInput/index.tsx
@@ -672,7 +672,7 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
         return;
       }
 
-      const normalizedAgentId = normalizeAgentId(agentId, "exec");
+      const normalizedAgentId = normalizeAgentId(agentId);
 
       updatePersistedState<WorkspaceAISettingsByAgentCache>(
         getWorkspaceAISettingsByAgentKey(workspaceId),
@@ -1001,7 +1001,7 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
 
     const fallbackModel = defaultModel;
 
-    const normalizedAgentId = normalizeAgentId(agentId, "exec");
+    const normalizedAgentId = normalizeAgentId(agentId);
 
     const isExplicitAgentSwitch =
       prevCreationAgentIdRef.current !== null &&
diff --git a/src/browser/utils/workspaceModeAi.ts b/src/browser/utils/workspaceModeAi.ts
index 24f52a9273..b20be9fbcd 100644
--- a/src/browser/utils/workspaceModeAi.ts
+++ b/src/browser/utils/workspaceModeAi.ts
@@ -6,7 +6,7 @@ import {
   type OpenAIReasoningMode,
   type ThinkingLevel,
 } from "@/common/types/thinking";
-import { normalizeAgentId as normalizeWorkspaceAgentId } from "@/common/utils/agentIds";
+import { normalizeAgentId } from "@/common/utils/agentIds";
 import { collectDeclaredAncestorLayers } from "@/common/utils/ai/agentAncestorLayers";
 import { resolveAgentAiSettings } from "@/common/utils/ai/resolveAgentAiSettings";
 
@@ -17,10 +17,6 @@ export type WorkspaceAISettingsCache = Partial<
   >
 >;
 
-function normalizeAgentId(agentId: string): string {
-  return normalizeWorkspaceAgentId(agentId, "exec");
-}
-
 /**
  * Field-wise configured defaults for an agent through its declared base chain,
  * delegating precedence to the shared resolver. Values are "configured" only

From 4fcea3d556170a49eb791c0188ac16e6eff20379 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 00:24:28 +0000
Subject: [PATCH 27/94] refactor: dedupe defensive unknown-field reads in the
 timeline mapper

---
 src/node/services/timelineMapper.ts | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/src/node/services/timelineMapper.ts b/src/node/services/timelineMapper.ts
index 7720f12ba1..287950894b 100644
--- a/src/node/services/timelineMapper.ts
+++ b/src/node/services/timelineMapper.ts
@@ -85,16 +85,20 @@ const MACHINE_AUTHORED_TURN_TYPES = new Set([
   WORKFLOW_RESULT_METADATA_TYPE,
 ]);
 
+// Only a non-null object has fields to read, so every other shape yields undefined rather than
+// throwing. Callers narrow the returned `unknown` to the type they expect.
+function readObjectField(value: unknown, field: string): unknown {
+  return typeof value === "object" && value !== null
+    ? (value as Record<string, unknown>)[field]
+    : undefined;
+}
+
 // muxMetadata crosses the oRPC boundary as `any`, so read its string fields defensively.
 function readMuxMetadataField(
   metadata: Extract<WorkspaceChatMessage, { type: "message" }>["metadata"],
   field: "type" | "source" | "runId"
 ): string | undefined {
-  const muxMetadata: unknown = metadata?.muxMetadata;
-  if (typeof muxMetadata !== "object" || muxMetadata === null) {
-    return undefined;
-  }
-  const value = (muxMetadata as Record<string, unknown>)[field];
+  const value = readObjectField(metadata?.muxMetadata, field);
   return typeof value === "string" ? value : undefined;
 }
 
@@ -136,20 +140,13 @@ function isUnloggedMachineTurn(
 function readMonitorWakeProcesses(
   metadata: Extract<WorkspaceChatMessage, { type: "message" }>["metadata"]
 ): string | undefined {
-  const muxMetadata: unknown = metadata?.muxMetadata;
-  const records: unknown =
-    typeof muxMetadata === "object" && muxMetadata !== null
-      ? (muxMetadata as Record<string, unknown>).records
-      : undefined;
+  const records = readObjectField(metadata?.muxMetadata, "records");
   if (!Array.isArray(records)) {
     return undefined;
   }
   const names = new Set<string>();
   for (const record of records) {
-    const displayName: unknown =
-      typeof record === "object" && record !== null
-        ? (record as Record<string, unknown>).displayName
-        : undefined;
+    const displayName = readObjectField(record, "displayName");
     if (typeof displayName === "string" && displayName !== "") {
       names.add(displayName);
     }

From aa1e49166f8315c69fe96a29745e057e583e8f8d Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 12:55:50 +0000
Subject: [PATCH 28/94] refactor: share the mobile-touch media query constant

The `(max-width: 768px) and (pointer: coarse)` literal that gates Mux's
mobile affordances was copied into seven `window.matchMedia` callsites
across five renderer files, each independently responsible for staying in
sync with the matching `@media` block in globals.css.

Hoist it to `MOBILE_TOUCH_MEDIA_QUERY` in `src/constants/layout.ts`,
alongside `MOBILE_TOUCH_TARGET_PX`, which already documents the same
coarse-pointer environment.

Behavior-preserving: every callsite passed a byte-identical string, so
each `matchMedia` call receives exactly the value it did before.
---
 src/browser/App.tsx                                        | 4 ++--
 .../components/WorkspaceMenuBar/WorkspaceMenuBar.tsx       | 6 +++---
 src/browser/components/WorkspaceShell/WorkspaceShell.tsx   | 3 ++-
 src/browser/features/ChatInput/index.tsx                   | 7 +++----
 src/browser/features/Messages/UserMessage.tsx              | 4 ++--
 src/constants/layout.ts                                    | 6 ++++++
 6 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/src/browser/App.tsx b/src/browser/App.tsx
index f599e83d55..296a8b866b 100644
--- a/src/browser/App.tsx
+++ b/src/browser/App.tsx
@@ -45,6 +45,7 @@ import {
   LEFT_SIDEBAR_DEFAULT_WIDTH_PX,
   LEFT_SIDEBAR_MAX_WIDTH_PX,
   LEFT_SIDEBAR_MIN_WIDTH_PX,
+  MOBILE_TOUCH_MEDIA_QUERY,
 } from "@/constants/layout";
 import { XUM_PRODUCT_SLUG } from "@/common/constants/product";
 import { buildCoreSources, type BuildSourcesParams } from "./utils/commands/sources";
@@ -233,8 +234,7 @@ function AppInner() {
       // because the sidebar width is controlled by CSS and shouldn't rewrite the user's desktop
       // width preference.
       const isMobileTouch =
-        typeof window !== "undefined" &&
-        window.matchMedia("(max-width: 768px) and (pointer: coarse)").matches;
+        typeof window !== "undefined" && window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY).matches;
       if (isMobileTouch) {
         return Number.POSITIVE_INFINITY;
       }
diff --git a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
index c30d98b8b8..5afc086d4f 100644
--- a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
+++ b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
@@ -55,6 +55,7 @@ import { SCRATCH_PROJECT_CONFIG_KEY, SCRATCH_PROJECT_NAME } from "@/common/const
 import { hasWorkspaceRepository } from "@/browser/utils/workspaceCapabilities";
 import { stopKeyboardPropagation } from "@/browser/utils/events";
 import {
+  MOBILE_TOUCH_MEDIA_QUERY,
   NARROW_VIEWPORT_MAX_WIDTH_PX,
   WORKSPACE_MENU_BAR_LEFT_SIDEBAR_COLLAPSED_PADDING_PX,
 } from "@/constants/layout";
@@ -184,7 +185,7 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
 
   const handleOpenTerminal = useCallback(() => {
     // On mobile touch devices, always use popout since the right sidebar is hidden
-    const isMobileTouch = window.matchMedia("(max-width: 768px) and (pointer: coarse)").matches;
+    const isMobileTouch = window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY).matches;
     if (onOpenTerminal && !isMobileTouch) {
       onOpenTerminal();
     } else {
@@ -194,8 +195,7 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
   }, [workspaceId, openTerminalPopout, runtimeConfig, onOpenTerminal]);
 
   const isTouchMobileScreen =
-    typeof window !== "undefined" &&
-    window.matchMedia("(max-width: 768px) and (pointer: coarse)").matches;
+    typeof window !== "undefined" && window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY).matches;
 
   // The right sidebar (home of the Timeline tab) is CSS-hidden by two independent
   // rules: a viewport media query (<=768px, any pointer) and the workspace-shell
diff --git a/src/browser/components/WorkspaceShell/WorkspaceShell.tsx b/src/browser/components/WorkspaceShell/WorkspaceShell.tsx
index 10b2a336be..b340fb1cc2 100644
--- a/src/browser/components/WorkspaceShell/WorkspaceShell.tsx
+++ b/src/browser/components/WorkspaceShell/WorkspaceShell.tsx
@@ -24,6 +24,7 @@ import {
   LEFT_SIDEBAR_DEFAULT_WIDTH_PX,
   LEFT_SIDEBAR_MAX_WIDTH_PX,
   LEFT_SIDEBAR_MIN_WIDTH_PX,
+  MOBILE_TOUCH_MEDIA_QUERY,
 } from "@/constants/layout";
 import { ChatPane } from "../ChatPane/ChatPane";
 
@@ -157,7 +158,7 @@ export const WorkspaceShell: React.FC<WorkspaceShellProps> = (props) => {
   const handleOpenTerminal = useCallback(
     (options?: TerminalSessionCreateOptions) => {
       // On mobile touch devices, always use popout since the right sidebar is hidden
-      const isMobileTouch = window.matchMedia("(max-width: 768px) and (pointer: coarse)").matches;
+      const isMobileTouch = window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY).matches;
       if (isMobileTouch) {
         void openTerminalPopout(props.workspaceId, props.runtimeConfig, options);
       } else {
diff --git a/src/browser/features/ChatInput/index.tsx b/src/browser/features/ChatInput/index.tsx
index 9d1001e6df..330c4f2c0d 100644
--- a/src/browser/features/ChatInput/index.tsx
+++ b/src/browser/features/ChatInput/index.tsx
@@ -202,6 +202,7 @@ import {
   COMPOSER_WORKSPACE_ICON_ONLY_HIDE_CLASS,
   CHAT_DOCK_GUTTER_CLASS,
   CREATION_COLUMN_MAX_WIDTH_CLASS,
+  MOBILE_TOUCH_MEDIA_QUERY,
 } from "@/constants/layout";
 import { useChatDockColumnWidthClass } from "@/browser/components/ChatPane/chatDockColumn";
 import { prepareMessagePayload } from "./prepareMessagePayload";
@@ -294,14 +295,12 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
   const isStreamStarting = variant === "workspace" ? (props.isStreamStarting ?? false) : false;
   const isCompacting = variant === "workspace" ? (props.isCompacting ?? false) : false;
   const [isMobileTouch, setIsMobileTouch] = useState(
-    () =>
-      typeof window !== "undefined" &&
-      window.matchMedia("(max-width: 768px) and (pointer: coarse)").matches
+    () => typeof window !== "undefined" && window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY).matches
   );
   useEffect(() => {
     if (typeof window === "undefined") return;
 
-    const mobileTouchMediaQuery = window.matchMedia("(max-width: 768px) and (pointer: coarse)");
+    const mobileTouchMediaQuery = window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY);
     const handleMobileTouchChange = () => {
       setIsMobileTouch(mobileTouchMediaQuery.matches);
     };
diff --git a/src/browser/features/Messages/UserMessage.tsx b/src/browser/features/Messages/UserMessage.tsx
index 285438beaa..2d5da0380d 100644
--- a/src/browser/features/Messages/UserMessage.tsx
+++ b/src/browser/features/Messages/UserMessage.tsx
@@ -18,6 +18,7 @@ import {
 } from "./SubagentReportMessageContent";
 import { TerminalOutput } from "./TerminalOutput";
 import { formatKeybind, KEYBINDS } from "@/browser/utils/ui/keybinds";
+import { MOBILE_TOUCH_MEDIA_QUERY } from "@/constants/layout";
 import { useCopyToClipboard } from "@/browser/hooks/useCopyToClipboard";
 import { copyToClipboard } from "@/browser/utils/clipboard";
 import { createDownloadRetryCache } from "@/browser/utils/downloadFile";
@@ -99,8 +100,7 @@ export const UserMessage: React.FC<UserMessageProps> = ({
     : visibleContent;
   const [vimEnabled] = usePersistedState<boolean>(VIM_ENABLED_KEY, false, { listener: true });
   const isMobileTouch =
-    typeof window !== "undefined" &&
-    window.matchMedia("(max-width: 768px) and (pointer: coarse)").matches;
+    typeof window !== "undefined" && window.matchMedia(MOBILE_TOUCH_MEDIA_QUERY).matches;
 
   const apiState = React.useContext(APIContext);
   const api = apiState?.api ?? null;
diff --git a/src/constants/layout.ts b/src/constants/layout.ts
index e0a8acf259..213da2e1c5 100644
--- a/src/constants/layout.ts
+++ b/src/constants/layout.ts
@@ -12,6 +12,12 @@ export const CREATION_COLUMN_MAX_WIDTH_CLASS = "max-w-[67rem]";
 // inside it re-apply this gutter to land on the same edges as transcript rows. Tailwind scans source
 // text, so this has to stay a literal class string.
 export const CHAT_DOCK_GUTTER_CLASS = "px-[15px]";
+
+// The viewport/pointer combination that gates Mux's mobile affordances. Must stay in sync with the
+// matching `@media` block in globals.css: the renderer branches on this same environment through
+// `window.matchMedia`, so a per-callsite copy of the literal can silently desync JS from CSS.
+export const MOBILE_TOUCH_MEDIA_QUERY = "(max-width: 768px) and (pointer: coarse)";
+
 // Minimum height globals.css gives touch targets on coarse-pointer viewports. Shared so tests can
 // reproduce that environment, which Storybook and Pixel cannot: neither emulates `pointer: coarse`.
 export const MOBILE_TOUCH_TARGET_PX = 44;

From 877146d76616009b8bbda32bd876bfe840de3b30 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:36:39 +0000
Subject: [PATCH 29/94] refactor: share the docked toast overlay placement
 class

Three toast hosts hard-coded the same absolute overlay box, with a doc comment
asserting they stay identical. Hoist it into src/constants/layout.ts so the
invariant is enforced by the shared constant instead of by copy-paste.
---
 .../ConnectionStatusToast/ConnectionStatusToast.tsx       | 8 +++-----
 src/browser/features/ChatInput/ChatInputToast.tsx         | 6 ++----
 src/browser/features/ChatInput/index.tsx                  | 3 ++-
 src/constants/layout.ts                                   | 7 +++++++
 4 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/browser/components/ConnectionStatusToast/ConnectionStatusToast.tsx b/src/browser/components/ConnectionStatusToast/ConnectionStatusToast.tsx
index c1adfaaa72..ce8e2b3c28 100644
--- a/src/browser/components/ConnectionStatusToast/ConnectionStatusToast.tsx
+++ b/src/browser/components/ConnectionStatusToast/ConnectionStatusToast.tsx
@@ -1,8 +1,6 @@
 import React from "react";
 import { useAPI } from "@/browser/contexts/API";
-
-const wrapperClassName =
-  "pointer-events-none absolute right-[15px] bottom-full left-[15px] z-[1000] mb-2 [&>*]:pointer-events-auto";
+import { CHAT_DOCK_TOAST_OVERLAY_CLASS } from "@/constants/layout";
 
 /**
  * Connection status banner that uses the same *overlay placement* as ChatInputToast.
@@ -55,7 +53,7 @@ export const ConnectionStatusToast: React.FC<ConnectionStatusToastProps> = ({ wr
 
     if (!wrap) return content;
 
-    return <div className={wrapperClassName}>{content}</div>;
+    return <div className={CHAT_DOCK_TOAST_OVERLAY_CLASS}>{content}</div>;
   }
 
   if (apiState.status === "error") {
@@ -75,7 +73,7 @@ export const ConnectionStatusToast: React.FC<ConnectionStatusToastProps> = ({ wr
 
     if (!wrap) return content;
 
-    return <div className={wrapperClassName}>{content}</div>;
+    return <div className={CHAT_DOCK_TOAST_OVERLAY_CLASS}>{content}</div>;
   }
 
   return null;
diff --git a/src/browser/features/ChatInput/ChatInputToast.tsx b/src/browser/features/ChatInput/ChatInputToast.tsx
index cbdbcb3adf..635fea44b6 100644
--- a/src/browser/features/ChatInput/ChatInputToast.tsx
+++ b/src/browser/features/ChatInput/ChatInputToast.tsx
@@ -2,6 +2,7 @@ import type { ReactNode } from "react";
 import { AlertTriangle, Check } from "lucide-react";
 import React, { useEffect, useCallback } from "react";
 import { cn } from "@/common/lib/utils";
+import { CHAT_DOCK_TOAST_OVERLAY_CLASS } from "@/constants/layout";
 
 const toastTypeStyles: Record<"success" | "error", string> = {
   success: "bg-toast-success-bg border border-accent-dark text-toast-success-text",
@@ -31,9 +32,6 @@ export const SolutionLabel: React.FC<{ children: ReactNode }> = ({ children }) =
   <div className="text-muted-light mb-1 text-[10px] uppercase">{children}</div>
 );
 
-const wrapperClassName =
-  "pointer-events-none absolute right-[15px] bottom-full left-[15px] z-[1000] mb-2 [&>*]:pointer-events-auto";
-
 export const ChatInputToast: React.FC<ChatInputToastProps> = ({
   toast,
   onDismiss,
@@ -149,5 +147,5 @@ export const ChatInputToast: React.FC<ChatInputToastProps> = ({
 
   if (!wrap) return content;
 
-  return <div className={wrapperClassName}>{content}</div>;
+  return <div className={CHAT_DOCK_TOAST_OVERLAY_CLASS}>{content}</div>;
 };
diff --git a/src/browser/features/ChatInput/index.tsx b/src/browser/features/ChatInput/index.tsx
index 330c4f2c0d..cd65d1c34f 100644
--- a/src/browser/features/ChatInput/index.tsx
+++ b/src/browser/features/ChatInput/index.tsx
@@ -201,6 +201,7 @@ import {
   COMPOSER_ICON_ONLY_HIDE_CLASS,
   COMPOSER_WORKSPACE_ICON_ONLY_HIDE_CLASS,
   CHAT_DOCK_GUTTER_CLASS,
+  CHAT_DOCK_TOAST_OVERLAY_CLASS,
   CREATION_COLUMN_MAX_WIDTH_CLASS,
   MOBILE_TOUCH_MEDIA_QUERY,
 } from "@/constants/layout";
@@ -2520,7 +2521,7 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
       >
         <div className={cn(variant === "creation" ? "w-full" : chatDockColumnWidthClass)}>
           {/* Toasts (overlay) */}
-          <div className="pointer-events-none absolute right-[15px] bottom-full left-[15px] z-[1000] mb-2 flex flex-col gap-2 [&>*]:pointer-events-auto">
+          <div className={cn(CHAT_DOCK_TOAST_OVERLAY_CLASS, "flex flex-col gap-2")}>
             <ConnectionStatusToast wrap={false} />
             <ChatInputToast
               toast={activeToast}
diff --git a/src/constants/layout.ts b/src/constants/layout.ts
index 213da2e1c5..a55401cc04 100644
--- a/src/constants/layout.ts
+++ b/src/constants/layout.ts
@@ -13,6 +13,13 @@ export const CREATION_COLUMN_MAX_WIDTH_CLASS = "max-w-[67rem]";
 // text, so this has to stay a literal class string.
 export const CHAT_DOCK_GUTTER_CLASS = "px-[15px]";
 
+// Toasts float above the composer instead of displacing it, so every toast host has to agree on the
+// same overlay box or a stacked toast would jump when its host changes. Inset matches
+// CHAT_DOCK_GUTTER_CLASS, but Tailwind scans source text, so the placement cannot be composed from
+// it and has to stay a literal class string.
+export const CHAT_DOCK_TOAST_OVERLAY_CLASS =
+  "pointer-events-none absolute right-[15px] bottom-full left-[15px] z-[1000] mb-2 [&>*]:pointer-events-auto";
+
 // The viewport/pointer combination that gates Mux's mobile affordances. Must stay in sync with the
 // matching `@media` block in globals.css: the renderer branches on this same environment through
 // `window.matchMedia`, so a per-callsite copy of the literal can silently desync JS from CSS.

From 6e180798d7606c02f0b5b431c9eff2860f30e5b4 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 20:28:27 +0000
Subject: [PATCH 30/94] refactor: share the primary mouse button guard

The composer dock focus handler added in #3759 repeated the bare `button !== 0` magic number already used by the diff review drag-select handler. Name the check once in browser/utils/events so both call sites read as intent.
---
 src/browser/features/Shared/DiffRenderer.tsx |  4 ++--
 src/browser/utils/events.ts                  | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/browser/features/Shared/DiffRenderer.tsx b/src/browser/features/Shared/DiffRenderer.tsx
index e61dcdf46d..341366fb6f 100644
--- a/src/browser/features/Shared/DiffRenderer.tsx
+++ b/src/browser/features/Shared/DiffRenderer.tsx
@@ -6,7 +6,7 @@
 
 import React, { useEffect, useMemo, useState } from "react";
 import { createPortal } from "react-dom";
-import { stopKeyboardPropagation } from "@/browser/utils/events";
+import { isPrimaryMouseButton, stopKeyboardPropagation } from "@/browser/utils/events";
 import { cn } from "@/common/lib/utils";
 import { getLanguageFromPath } from "@/common/utils/git/languageDetector";
 import { useOverflowDetection } from "@/browser/hooks/useOverflowDetection";
@@ -1643,7 +1643,7 @@ export const SelectableDiffRenderer = React.memo<SelectableDiffRendererProps>(
                     isInteractive={Boolean(onReviewNote ?? onLineIndexSelect)}
                     onMouseDown={(e) => {
                       if (!onReviewNote) return;
-                      if (e.button !== 0) return;
+                      if (!isPrimaryMouseButton(e)) return;
                       e.preventDefault();
                       e.stopPropagation();
                       startDragSelection(displayIndex, e.shiftKey);
diff --git a/src/browser/utils/events.ts b/src/browser/utils/events.ts
index 3ed143808a..767a332a21 100644
--- a/src/browser/utils/events.ts
+++ b/src/browser/utils/events.ts
@@ -7,6 +7,17 @@ export function isEventFromDialogPortal(target: EventTarget | null): boolean {
   return target instanceof Element && target.closest('[role="dialog"]') != null;
 }
 
+/**
+ * `MouseEvent.button === 0` is the primary button (left button under a default layout);
+ * every other value is a secondary or auxiliary press. Click-style mousedown handlers
+ * have to gate on it so right-click, middle-click, and back/forward presses don't run
+ * primary-click behavior. Shared so call sites state that intent instead of repeating
+ * the bare magic number.
+ */
+export function isPrimaryMouseButton(event: React.MouseEvent | MouseEvent): boolean {
+  return event.button === 0;
+}
+
 /**
  * Stop keyboard event propagation for both React synthetic events and native KeyboardEvents.
  *

From 33e1597d01bdc571da5aeb944bac2c155e82b985 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 00:34:09 +0000
Subject: [PATCH 31/94] refactor: name ModelSelector row selection/highlight
 state

The dropdown option row recomputed `value === model` four times and
`index === highlightedIndex` twice across the option class, ARIA state,
and accent styling. Extract them as `isSelected`/`isHighlighted` locals so
the row's state is named once and can't drift apart, matching the naming
already used by the sibling AgentModePicker.

Behavior-preserving: identical expressions, same evaluation per row.
---
 .../components/ModelSelector/ModelSelector.tsx  | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/browser/components/ModelSelector/ModelSelector.tsx b/src/browser/components/ModelSelector/ModelSelector.tsx
index 3a1ef1cca6..5f4b62bd96 100644
--- a/src/browser/components/ModelSelector/ModelSelector.tsx
+++ b/src/browser/components/ModelSelector/ModelSelector.tsx
@@ -433,33 +433,34 @@ export const ModelSelector = forwardRef<ModelSelectorRef, ModelSelectorProps>(
                   const modelProvider = getModelProvider(model);
                   const showProviderLabel =
                     modelProvider.length > 0 && duplicateModelNames.has(modelName);
+                  // Name the row's selection/highlight state once so the option class, ARIA state,
+                  // and accent styling below can't drift apart (mirrors AgentModePicker).
+                  const isHighlighted = index === highlightedIndex;
+                  const isSelected = value === model;
 
                   return (
                     <div
                       key={model}
-                      data-highlighted={index === highlightedIndex}
+                      data-highlighted={isHighlighted}
                       onMouseEnter={() => setHighlightedIndex(index)}
                       className={composerPickerOptionClass(
-                        {
-                          isHighlighted: index === highlightedIndex,
-                          isSelected: value === model,
-                        },
+                        { isHighlighted, isSelected },
                         "py-1",
                         hiddenSet.has(model) && "opacity-50"
                       )}
                       onClick={() => handleSelectModel(model)}
                       role="option"
-                      aria-selected={value === model}
+                      aria-selected={isSelected}
                     >
                       <ProviderIcon
                         provider={modelProvider}
                         className={cn(
                           "h-3 w-3 shrink-0",
-                          value === model ? "text-accent" : "text-muted"
+                          isSelected ? "text-accent" : "text-muted"
                         )}
                       />
                       <span className="flex min-w-0 flex-1 items-baseline gap-1">
-                        <span className={cn("min-w-0 truncate", value === model && "text-accent")}>
+                        <span className={cn("min-w-0 truncate", isSelected && "text-accent")}>
                           {formatModelDisplayName(modelName)}
                         </span>
                         {showProviderLabel && (

From b401c6c81aa24d9305a3d1921b165c7d85cca117 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:36:34 +0000
Subject: [PATCH 32/94] refactor: share the workspace footer pill class

The repository link added in #3762 duplicated the 'Last prompt' pill styling verbatim; extract it so the two footer affordances cannot drift apart.
---
 src/browser/components/ChatPane/WorkspaceFooterBar.tsx | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/browser/components/ChatPane/WorkspaceFooterBar.tsx b/src/browser/components/ChatPane/WorkspaceFooterBar.tsx
index 1847a2a4d9..50411456eb 100644
--- a/src/browser/components/ChatPane/WorkspaceFooterBar.tsx
+++ b/src/browser/components/ChatPane/WorkspaceFooterBar.tsx
@@ -151,6 +151,11 @@ function WorkspaceBranchControls(props: {
   );
 }
 
+// Shared by the footer's interactive pills (repository link, "Last prompt") so they keep reading as
+// one affordance family: restyling one silently drifting from the other is the failure mode here.
+const FOOTER_PILL_CLASS =
+  "text-muted hover:bg-hover hover:text-foreground focus-visible:ring-accent flex h-5 shrink-0 items-center gap-1 rounded-md px-1.5 transition-colors focus-visible:ring-1";
+
 function FooterRepositoryLabel(props: { workspaceId: string; projectLabel: string }) {
   const workspacePR = useWorkspacePR(props.workspaceId);
 
@@ -169,7 +174,7 @@ function FooterRepositoryLabel(props: { workspaceId: string; projectLabel: strin
           target="_blank"
           rel="noopener noreferrer"
           data-testid="workspace-footer-repository"
-          className="text-muted hover:bg-hover hover:text-foreground focus-visible:ring-accent flex h-5 shrink-0 items-center gap-1 rounded-md px-1.5 transition-colors focus-visible:ring-1"
+          className={FOOTER_PILL_CLASS}
         >
           <Github className="h-3 w-3 shrink-0" aria-hidden="true" />
           <span className="font-mono">{slug}</span>
@@ -320,7 +325,8 @@ function FooterLastPrompt(props: { workspaceId: string }) {
           <PopoverTrigger asChild>
             <button
               type="button"
-              className="text-muted hover:bg-hover hover:text-foreground focus-visible:ring-accent flex h-5 shrink-0 cursor-pointer items-center gap-1 rounded-md border-0 bg-transparent px-1.5 transition-colors focus-visible:ring-1"
+              // The extra classes are <button> resets; the pill styling itself is shared.
+              className={cn(FOOTER_PILL_CLASS, "cursor-pointer border-0 bg-transparent")}
               data-testid="workspace-footer-last-prompt"
               onKeyDown={stopKeyboardPropagation}
             >

From 542a6d97cb3f70f2bcc3355545f58e0cabd05d91 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 00:26:37 +0000
Subject: [PATCH 33/94] refactor: share the safe inactive-animation pause
 install

---
 src/browser/main.tsx                    |  8 ++------
 src/browser/terminal-window.tsx         |  8 ++------
 src/browser/utils/inactiveAnimations.ts | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/src/browser/main.tsx b/src/browser/main.tsx
index 239d08f536..31db3ad043 100644
--- a/src/browser/main.tsx
+++ b/src/browser/main.tsx
@@ -2,7 +2,7 @@ import React from "react";
 import ReactDOM from "react-dom/client";
 import { installBrowserLogCapture } from "@/browser/utils/browserLog";
 import { installWindowOpenLocalhostProxyNormalization } from "@/browser/utils/windowOpenLocalhostProxy";
-import { installInactiveAnimationPause } from "@/browser/utils/inactiveAnimations";
+import { installInactiveAnimationPauseSafely } from "@/browser/utils/inactiveAnimations";
 import { AppLoader } from "@/browser/components/AppLoader/AppLoader";
 import { initTelemetry, trackAppStarted } from "@/common/telemetry";
 import { initTitlebarInsets } from "@/browser/hooks/useDesktopTitlebar";
@@ -15,11 +15,7 @@ try {
   // Silent failure — never crash the app for logging capture
 }
 
-try {
-  installInactiveAnimationPause();
-} catch {
-  // Animation throttling is an optimization and must never block renderer startup.
-}
+installInactiveAnimationPauseSafely();
 
 installWindowOpenLocalhostProxyNormalization();
 
diff --git a/src/browser/terminal-window.tsx b/src/browser/terminal-window.tsx
index 714cdbb85a..88d9bab595 100644
--- a/src/browser/terminal-window.tsx
+++ b/src/browser/terminal-window.tsx
@@ -5,7 +5,7 @@
  * Each window connects to a terminal session via WebSocket.
  */
 
-import { installInactiveAnimationPause } from "@/browser/utils/inactiveAnimations";
+import { installInactiveAnimationPauseSafely } from "@/browser/utils/inactiveAnimations";
 import ReactDOM from "react-dom/client";
 import { TerminalView } from "@/browser/components/TerminalView/TerminalView";
 import { APIProvider, useAPI } from "@/browser/contexts/API";
@@ -35,11 +35,7 @@ function TerminalWindowContent(props: {
   );
 }
 
-try {
-  installInactiveAnimationPause();
-} catch {
-  // Animation throttling is an optimization and must never block renderer startup.
-}
+installInactiveAnimationPauseSafely();
 
 installWindowOpenLocalhostProxyNormalization();
 
diff --git a/src/browser/utils/inactiveAnimations.ts b/src/browser/utils/inactiveAnimations.ts
index c3117777f8..97249230ed 100644
--- a/src/browser/utils/inactiveAnimations.ts
+++ b/src/browser/utils/inactiveAnimations.ts
@@ -23,3 +23,19 @@ export function installInactiveAnimationPause(): () => void {
     window.removeEventListener("blur", syncInactiveAnimationState);
   };
 }
+
+/**
+ * Renderer entrypoint helper: install the pause without ever failing startup.
+ *
+ * Animation throttling is only an optimization, so a broken install must not
+ * take the renderer down with it. Every entrypoint needs the same swallow, so
+ * it lives here instead of being repeated at each call site. The disposer is
+ * intentionally dropped: entrypoints keep the listeners for the window's life.
+ */
+export function installInactiveAnimationPauseSafely(): void {
+  try {
+    installInactiveAnimationPause();
+  } catch {
+    // Optimization only — never block renderer startup.
+  }
+}

From d7ca328e4319d37b7d2f4fff7e76e2ca56a272a2 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 05:11:11 +0000
Subject: [PATCH 34/94] refactor: share the bash monitor wake message predicate

them from prev/next prompt navigation, but each site re-derived the check as an
inline bashMonitorWake null test in a different file. Extract
isBashMonitorWakeMessage into messageUtils so both consumers agree by
construction.
---
 src/browser/components/ChatPane/ChatPane.tsx  |  3 +-
 .../features/Messages/MessageRenderer.tsx     | 62 ++++++++++---------
 src/browser/utils/messages/messageUtils.ts    | 16 ++++-
 3 files changed, 49 insertions(+), 32 deletions(-)

diff --git a/src/browser/components/ChatPane/ChatPane.tsx b/src/browser/components/ChatPane/ChatPane.tsx
index f1c333bd24..508c714b89 100644
--- a/src/browser/components/ChatPane/ChatPane.tsx
+++ b/src/browser/components/ChatPane/ChatPane.tsx
@@ -41,6 +41,7 @@ import {
   mergeConsecutiveStreamErrors,
   computeBashOutputGroupInfos,
   shouldBypassDeferredMessages,
+  isBashMonitorWakeMessage,
 } from "@/browser/utils/messages/messageUtils";
 import { computeTaskReportLinking } from "@/browser/utils/messages/taskReportLinking";
 import { BashCollapsedSummaryModeProvider } from "@/browser/features/Tools/BashCollapsedSummaryModeContext";
@@ -767,7 +768,7 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
       // interrupt navigation between human prompts (payloads themselves are assistant rows).
       if (
         message.type === "user" &&
-        message.bashMonitorWake == null &&
+        !isBashMonitorWakeMessage(message) &&
         message.agentPeerMessageTrigger == null
       ) {
         userHistoryIds.push(message.historyId);
diff --git a/src/browser/features/Messages/MessageRenderer.tsx b/src/browser/features/Messages/MessageRenderer.tsx
index 8f5210760d..9084ed2598 100644
--- a/src/browser/features/Messages/MessageRenderer.tsx
+++ b/src/browser/features/Messages/MessageRenderer.tsx
@@ -1,6 +1,9 @@
 import React from "react";
 import type { DisplayedMessage } from "@/common/types/message";
-import type { BashOutputGroupInfo } from "@/browser/utils/messages/messageUtils";
+import {
+  isBashMonitorWakeMessage,
+  type BashOutputGroupInfo,
+} from "@/browser/utils/messages/messageUtils";
 import type { TaskReportLinking } from "@/browser/utils/messages/taskReportLinking";
 import type { ReviewNoteData } from "@/common/types/review";
 import type { EditingMessageState } from "@/browser/utils/chatEditing";
@@ -98,35 +101,34 @@ export const MessageRenderer = React.memo<MessageRendererProps>(
       case "user": {
         const backgroundWorkWakeSummary =
           message.isSynthetic === true ? getBackgroundWorkWakeSummary(message.content) : null;
-        renderedMessage =
-          message.bashMonitorWake != null ? (
-            <BashMonitorWakeMessage message={message} className={className} />
-          ) : message.agentPeerMessageTrigger != null ? (
-            // The wake trigger is backend-generated control text: a full user bubble would
-            // falsely present it as human input (the payload renders separately as the
-            // assistant-side agent-message card).
-            <CollapsibleMachineMessage
-              content={message.content}
-              summary="Agent message notification"
-              icon={<MessageSquare aria-hidden="true" className="size-3.5 shrink-0" />}
-              marker="agent-peer-message-trigger"
-              className={className}
-            />
-          ) : backgroundWorkWakeSummary != null ? (
-            <BackgroundWorkWakeMessage
-              message={message}
-              summary={backgroundWorkWakeSummary}
-              className={className}
-            />
-          ) : (
-            <UserMessage
-              message={message}
-              className={className}
-              onEdit={onEditUserMessage}
-              isCompacting={isCompacting}
-              navigation={userMessageNavigation}
-            />
-          );
+        renderedMessage = isBashMonitorWakeMessage(message) ? (
+          <BashMonitorWakeMessage message={message} className={className} />
+        ) : message.agentPeerMessageTrigger != null ? (
+          // The wake trigger is backend-generated control text: a full user bubble would
+          // falsely present it as human input (the payload renders separately as the
+          // assistant-side agent-message card).
+          <CollapsibleMachineMessage
+            content={message.content}
+            summary="Agent message notification"
+            icon={<MessageSquare aria-hidden="true" className="size-3.5 shrink-0" />}
+            marker="agent-peer-message-trigger"
+            className={className}
+          />
+        ) : backgroundWorkWakeSummary != null ? (
+          <BackgroundWorkWakeMessage
+            message={message}
+            summary={backgroundWorkWakeSummary}
+            className={className}
+          />
+        ) : (
+          <UserMessage
+            message={message}
+            className={className}
+            onEdit={onEditUserMessage}
+            isCompacting={isCompacting}
+            navigation={userMessageNavigation}
+          />
+        );
         break;
       }
       case "assistant":
diff --git a/src/browser/utils/messages/messageUtils.ts b/src/browser/utils/messages/messageUtils.ts
index c4a09e2b25..61235b59d8 100644
--- a/src/browser/utils/messages/messageUtils.ts
+++ b/src/browser/utils/messages/messageUtils.ts
@@ -3,7 +3,11 @@ import {
   parseStagedAttachmentNotice,
 } from "@/browser/features/ChatInput/stagedAttachments";
 import type { StagedChatAttachment } from "@/browser/features/ChatInput/ChatAttachments";
-import type { DisplayedMessage, ReviewNoteDataForDisplay } from "@/common/types/message";
+import type {
+  DisplayedMessage,
+  DisplayedUserMessage,
+  ReviewNoteDataForDisplay,
+} from "@/common/types/message";
 import { formatReviewForModel } from "@/common/types/review";
 import type { BashOutputToolArgs } from "@/common/types/tools";
 
@@ -94,6 +98,16 @@ export interface BashOutputGroupInfo {
   firstIndex: number;
 }
 
+/**
+ * Background monitor wakes are machine-authored events that happen to be persisted as
+ * user turns. Consumers that must tell them apart from human prompts (transcript
+ * routing, prev/next prompt navigation) have to agree on this test, so keep it here
+ * rather than re-deriving `bashMonitorWake` inline at each site.
+ */
+export function isBashMonitorWakeMessage(message: DisplayedUserMessage): boolean {
+  return message.bashMonitorWake != null;
+}
+
 interface InterruptedBarrierVisibilityOptions {
   isHydratingTranscript?: boolean;
   isAutoRetryActive?: boolean;

From 93456ffe0cd2675cd353031040879a43f02ec361 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 20:24:16 +0000
Subject: [PATCH 35/94] refactor: extract parseSubagentReportFromMessage helper

Four call sites inlined the identical 'join every text part, then parse the
subagent report envelope' projection. #3783 added two more copies in
findProgressRespondedTaskIds and hasAcceptedSubagentProgressReport, joining the
pre-existing copies in TaskService sibling-report discovery and AgentSession's
isVisibleCompletedSubagentReportMessage.

Extract the projection into parseSubagentReportFromMessage, co-located with the
string parser it wraps, and route all four sites through it.
---
 src/common/utils/subagentReportEnvelope.ts | 15 +++++++++++++++
 src/node/services/agentSession.ts          |  8 ++------
 src/node/services/taskService.ts           |  7 ++-----
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/src/common/utils/subagentReportEnvelope.ts b/src/common/utils/subagentReportEnvelope.ts
index 7d5497a2c6..49a891e2ed 100644
--- a/src/common/utils/subagentReportEnvelope.ts
+++ b/src/common/utils/subagentReportEnvelope.ts
@@ -1,3 +1,4 @@
+import type { MuxMessage } from "@/common/types/message";
 import { THINKING_LEVELS, type ThinkingLevel } from "@/common/types/thinking";
 
 export type SubagentReportStatus = "in_progress" | "completed";
@@ -169,3 +170,17 @@ export function parseSubagentReportEnvelope(content: string): SubagentReportEnve
 export function isCompletedSubagentReportEnvelope(content: string): boolean {
   return parseSubagentReportEnvelope(content)?.status === "completed";
 }
+
+/**
+ * Report envelopes reach history as synthetic user messages whose framing lives in the text parts.
+ * Every history scanner (terminal-attention suppression, sibling report discovery, retry gating)
+ * needs the same "concatenate every text part, then parse" projection, so keep that reconstruction
+ * beside the parser it feeds instead of re-inlining it per call site.
+ */
+export function parseSubagentReportFromMessage(message: MuxMessage): SubagentReportEnvelope | null {
+  const text = message.parts
+    .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
+    .map((part) => part.text)
+    .join("\n");
+  return parseSubagentReportEnvelope(text);
+}
diff --git a/src/node/services/agentSession.ts b/src/node/services/agentSession.ts
index 3df43c6c9e..b4e3e2d608 100644
--- a/src/node/services/agentSession.ts
+++ b/src/node/services/agentSession.ts
@@ -192,7 +192,7 @@ import { execBuffered } from "@/node/utils/runtime/helpers";
 import { renderAgentSkillSnapshotText } from "@/common/utils/agentSkills/skillSnapshot";
 import type { MemorySessionContext } from "@/node/services/memoryService";
 import { materializeFileAtMentions } from "@/node/services/fileAtMentions";
-import { parseSubagentReportEnvelope } from "@/common/utils/subagentReportEnvelope";
+import { parseSubagentReportFromMessage } from "@/common/utils/subagentReportEnvelope";
 import { getErrorMessage } from "@/common/utils/errors";
 import { CompactionMonitor, type CompactionStatusEvent } from "./compactionMonitor";
 
@@ -1873,11 +1873,7 @@ export class AgentSession {
     ) {
       return false;
     }
-    const text = message.parts
-      .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
-      .map((part) => part.text)
-      .join("\n");
-    return parseSubagentReportEnvelope(text)?.status === "completed";
+    return parseSubagentReportFromMessage(message)?.status === "completed";
   }
 
   private shouldUseUserMessageForRetry(message: MuxMessage): boolean {
diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index f5b36a663a..85054d49df 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -37,6 +37,7 @@ import {
   SUBAGENT_FAILURE_ENVELOPE_TAG,
   formatSubagentReportEnvelope,
   parseSubagentReportEnvelope,
+  parseSubagentReportFromMessage,
   subagentReportFallbackTitle,
   subagentUpdateFallbackTitle,
 } from "@/common/utils/subagentReportEnvelope";
@@ -16725,11 +16726,7 @@ export class TaskService implements AgentTaskIntegration {
           if (message.role !== "user" || message.metadata?.synthetic !== true) {
             continue;
           }
-          const text = message.parts
-            .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
-            .map((part) => part.text)
-            .join("\n");
-          const reportEnvelope = parseSubagentReportEnvelope(text);
+          const reportEnvelope = parseSubagentReportFromMessage(message);
           if (reportEnvelope == null || reportEnvelope.status === "in_progress") {
             continue;
           }

From 28dddd8f467e68ca3d6a246e4ee870e2c95a5506 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 16:54:01 +0000
Subject: [PATCH 36/94] refactor: drop stale userOverridable references from
 experiments UI

with the `exp.userOverridable === true` clause in the Settings filter, but
left the comments that described that clause. The ExperimentsSection comment
now misdescribed the code: the filter keys on `showInSettings`, and every
experiment is a local opt-in toggle, so the "non-overridable ones are hidden"
rationale no longer applies.

Comment-only; no behavior change.
---
 src/browser/features/Settings/Sections/ExperimentsSection.tsx | 4 ++--
 src/browser/hooks/useExperiments.ts                           | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/browser/features/Settings/Sections/ExperimentsSection.tsx b/src/browser/features/Settings/Sections/ExperimentsSection.tsx
index 2f2b5aec65..dec1c5a0bf 100644
--- a/src/browser/features/Settings/Sections/ExperimentsSection.tsx
+++ b/src/browser/features/Settings/Sections/ExperimentsSection.tsx
@@ -731,8 +731,8 @@ export function ExperimentsSection() {
     return request;
   }, [api]);
 
-  // Only show user-overridable experiments (non-overridable ones are hidden since users can't
-  // change them). Sub-experiments render nested under their parent row instead.
+  // Hide experiments that opt out of Settings via showInSettings: false. Memory
+  // and PTC sub-experiments render nested under their parent rows instead.
   const experiments = useMemo(
     () =>
       allExperiments.filter(
diff --git a/src/browser/hooks/useExperiments.ts b/src/browser/hooks/useExperiments.ts
index 89854062d5..b092387221 100644
--- a/src/browser/hooks/useExperiments.ts
+++ b/src/browser/hooks/useExperiments.ts
@@ -23,8 +23,8 @@ export {
  * For reactive updates in React components, use useExperimentValue (UI gating) or
  * useExperimentOverrideValue (backend send options).
  *
- * For user-overridable experiments, returns `undefined` when no explicit localStorage
- * override exists, so send options can distinguish "user chose off" from "user never chose".
+ * Returns `undefined` when no explicit localStorage override exists, so send options
+ * can distinguish "user chose off" from "user never chose".
  */
 export function isExperimentEnabled(experimentId: ExperimentId): boolean | undefined {
   if (!isExperimentSupportedOnPlatform(experimentId, window.api?.platform)) {

From ddb333535e89c99f782d6da06aa75a030c66630c Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 20:34:29 +0000
Subject: [PATCH 37/94] refactor: reuse isTaskAwaitMessage predicate in
 transcript projection

---
 .../utils/messages/transcriptRenderProjection.ts   | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/browser/utils/messages/transcriptRenderProjection.ts b/src/browser/utils/messages/transcriptRenderProjection.ts
index 71a9c23455..ab56b293b4 100644
--- a/src/browser/utils/messages/transcriptRenderProjection.ts
+++ b/src/browser/utils/messages/transcriptRenderProjection.ts
@@ -531,12 +531,16 @@ export function summarizeOperationalBundle(
   };
 }
 
-function isTaskAwaitMessage(message: OperationalBundleMemberMessage): boolean {
+// Type predicate so the task_await helpers below can read tool-only fields (status, result)
+// after a single shared shape check instead of repeating the type/toolName test.
+function isTaskAwaitMessage(
+  message: OperationalBundleMemberMessage
+): message is Extract<DisplayedMessage, { type: "tool" }> {
   return message.type === "tool" && message.toolName === "task_await";
 }
 
 function getTaskAwaitResultEntries(message: OperationalBundleMemberMessage): object[] {
-  if (message.type !== "tool" || message.toolName !== "task_await") return [];
+  if (!isTaskAwaitMessage(message)) return [];
 
   const result = unwrapJsonResult(message.result);
   if (!isPlainObject(result) || !Array.isArray(result.results)) return [];
@@ -571,7 +575,7 @@ function hasTaskAwaitResultFailure(message: OperationalBundleMemberMessage): boo
 }
 
 function hasTaskAwaitCallFailure(message: OperationalBundleMemberMessage): boolean {
-  if (message.type !== "tool" || message.toolName !== "task_await") return false;
+  if (!isTaskAwaitMessage(message)) return false;
   if (message.status === "failed") return true;
 
   const result = unwrapJsonResult(message.result);
@@ -579,9 +583,7 @@ function hasTaskAwaitCallFailure(message: OperationalBundleMemberMessage): boole
 }
 
 function hasTaskAwaitCallInterruption(message: OperationalBundleMemberMessage): boolean {
-  return (
-    message.type === "tool" && message.toolName === "task_await" && message.status === "interrupted"
-  );
+  return isTaskAwaitMessage(message) && message.status === "interrupted";
 }
 
 function hasTaskAwaitTerminalIssue(messages: readonly OperationalBundleMemberMessage[]): boolean {

From 6ba8b63051cdcd19321545b80c8c7197b3e08907 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 20:35:37 +0000
Subject: [PATCH 38/94] refactor: dedupe non-blank string coercion in
 taskReportLinking

The module reads every field out of persisted tool args/results typed as
`unknown`, and #3789/#3793 grew that from four to seven copies of the same
"is a string, is not blank, use the trimmed form" check. Collapse those seven
into a single coerceNonBlankString helper.

The two task_await result reads are deliberately left alone: they validate a
field is non-blank but then store the raw, untrimmed value, so routing them
through the helper would change what gets persisted.
---
 .../utils/messages/taskReportLinking.ts       | 50 ++++++++++++-------
 1 file changed, 31 insertions(+), 19 deletions(-)

diff --git a/src/browser/utils/messages/taskReportLinking.ts b/src/browser/utils/messages/taskReportLinking.ts
index fb31bf3f84..3e0157674d 100644
--- a/src/browser/utils/messages/taskReportLinking.ts
+++ b/src/browser/utils/messages/taskReportLinking.ts
@@ -52,21 +52,37 @@ export interface TaskReportLinking {
   bashSpawnByTaskId: Map<string, BashTaskSpawnInfo>;
 }
 
+/**
+ * Every field this module reads comes from persisted tool args/results typed as `unknown`, so each
+ * read repeated the same "is a string, is not blank, use the trimmed form" coercion. Centralizing it
+ * keeps the call sites from drifting on whether they trim before or after the blank check.
+ *
+ * Deliberately NOT used by the `task_await` result reader below: those sites validate that a field is
+ * non-blank but go on to store the raw, untrimmed value, so routing them through here would change
+ * what gets persisted.
+ */
+function coerceNonBlankString(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
 function getTaskIdsFromToolResult(result: unknown): string[] {
   if (typeof result !== "object" || result === null) return [];
 
   const taskIds = new Set<string>();
 
-  const taskId = (result as { taskId?: unknown }).taskId;
-  if (typeof taskId === "string" && taskId.trim().length > 0) {
-    taskIds.add(taskId.trim());
+  const taskId = coerceNonBlankString((result as { taskId?: unknown }).taskId);
+  if (taskId !== undefined) {
+    taskIds.add(taskId);
   }
 
   const pluralTaskIds = (result as { taskIds?: unknown }).taskIds;
   if (Array.isArray(pluralTaskIds)) {
-    for (const candidate of pluralTaskIds) {
-      if (typeof candidate === "string" && candidate.trim().length > 0) {
-        taskIds.add(candidate.trim());
+    for (const rawCandidate of pluralTaskIds) {
+      const candidate = coerceNonBlankString(rawCandidate);
+      if (candidate !== undefined) {
+        taskIds.add(candidate);
       }
     }
   }
@@ -75,9 +91,9 @@ function getTaskIdsFromToolResult(result: unknown): string[] {
   if (Array.isArray(tasks)) {
     for (const task of tasks) {
       if (typeof task !== "object" || task === null) continue;
-      const candidate = (task as { taskId?: unknown }).taskId;
-      if (typeof candidate === "string" && candidate.trim().length > 0) {
-        taskIds.add(candidate.trim());
+      const candidate = coerceNonBlankString((task as { taskId?: unknown }).taskId);
+      if (candidate !== undefined) {
+        taskIds.add(candidate);
       }
     }
   }
@@ -89,8 +105,7 @@ function getTitleFromTaskToolArgs(args: unknown): string | null {
   if (typeof args !== "object" || args === null) return null;
   if (!("title" in args)) return null;
 
-  const title = (args as { title?: unknown }).title;
-  return typeof title === "string" && title.trim().length > 0 ? title.trim() : null;
+  return coerceNonBlankString((args as { title?: unknown }).title) ?? null;
 }
 
 function getAgentTypeFromTaskToolArgs(args: unknown): string | null {
@@ -101,8 +116,9 @@ function getAgentTypeFromTaskToolArgs(args: unknown): string | null {
     (args as { subagent_type?: unknown }).subagent_type,
   ];
   for (const candidate of candidates) {
-    if (typeof candidate === "string" && candidate.trim().length > 0) {
-      return candidate.trim();
+    const agentType = coerceNonBlankString(candidate);
+    if (agentType !== undefined) {
+      return agentType;
     }
   }
   return null;
@@ -112,8 +128,7 @@ function getAgentTypeFromTaskToolArgs(args: unknown): string | null {
 function getBashSpawnTaskId(result: unknown): string | null {
   if (typeof result !== "object" || result === null) return null;
 
-  const taskId = (result as { taskId?: unknown }).taskId;
-  return typeof taskId === "string" && taskId.trim().length > 0 ? taskId.trim() : null;
+  return coerceNonBlankString((result as { taskId?: unknown }).taskId) ?? null;
 }
 
 function getBashSpawnInfoFromArgs(args: unknown): BashTaskSpawnInfo | null {
@@ -123,10 +138,7 @@ function getBashSpawnInfoFromArgs(args: unknown): BashTaskSpawnInfo | null {
     script?: unknown;
     model_intent?: unknown;
   };
-  const modelIntent =
-    typeof model_intent === "string" && model_intent.trim().length > 0
-      ? model_intent.trim()
-      : undefined;
+  const modelIntent = coerceNonBlankString(model_intent);
   if (modelIntent === undefined) return null;
 
   return {

From 927f4be99172ed2ab119d6a92006cde3d7d21ea6 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:40:10 +0000
Subject: [PATCH 39/94] refactor: drop redundant agentType re-check in
 task_await rows

resolvePersistedAgentId's empty fallback is already normalized to undefined one line
above, so the second 'agentType && agentType.length > 0' guard could never change the
value. Pass the normalized local directly and record why the fallback exists.
---
 src/browser/features/Tools/TaskToolCall.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/browser/features/Tools/TaskToolCall.tsx b/src/browser/features/Tools/TaskToolCall.tsx
index 90bc362ab7..cf6ceac61a 100644
--- a/src/browser/features/Tools/TaskToolCall.tsx
+++ b/src/browser/features/Tools/TaskToolCall.tsx
@@ -1282,13 +1282,15 @@ export const TaskAwaitToolCall: React.FC<TaskAwaitToolCallProps> = ({
       const resolvedAgentType = isWorkspaceTurn
         ? "workspace"
         : resolvePersistedAgentId(metadata, "");
+      // The empty fallback above means "no persisted agent id", so normalize it to undefined once
+      // here and let the row omit the agent badge entirely.
       const agentType = resolvedAgentType.length > 0 ? resolvedAgentType : undefined;
       const title = metadata.title?.trim().length ? metadata.title : metadata.name;
 
       awaitedRows.push({
         taskId,
         status: metadata.taskStatus ?? "waiting",
-        agentType: agentType && agentType.length > 0 ? agentType : undefined,
+        agentType,
         title,
         depth:
           workspaceId && workspaceMetadata

From 22b930fbdb1c9cd89a586a18e7b30f53ce88b2eb Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 05:07:34 +0000
Subject: [PATCH 40/94] refactor: hoist duplicated isGrok45Model check in xAI
 model creation

resolveModelForMetadata's capability model was passed to isGrok45Model twice
in the same block (once to pick responses vs chat, once to gate the store=false
injection). The predicate is a pure regex test over a const, so hoisting it into
a local is behavior-preserving and matches buildProviderOptions, which already
keeps an isGrok45 local.
---
 src/node/services/providerModelFactory.ts | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/node/services/providerModelFactory.ts b/src/node/services/providerModelFactory.ts
index c7161b17cb..832c261a83 100644
--- a/src/node/services/providerModelFactory.ts
+++ b/src/node/services/providerModelFactory.ts
@@ -1802,14 +1802,13 @@ export class ProviderModelFactory {
         // that capability; older custom model strings stay on Chat Completions for
         // legacy search_parameters compatibility.
         const capabilityModel = resolveModelForMetadata(`xai:${modelId}`, providersConfig);
-        const model = isGrokFrontierModel(capabilityModel)
-          ? provider.responses(modelId)
-          : provider.chat(modelId);
+        const isGrokFrontier = isGrokFrontierModel(capabilityModel);
+        const model = isGrokFrontier ? provider.responses(modelId) : provider.chat(modelId);
 
         // Frontier Grok Responses: force store=false by default so ZDR and non-ZDR share
         // one path. buildProviderOptions already defaults this; inject here too so
         // callers that omit providerOptions still get ZDR-safe requests.
-        if (isGrokFrontierModel(capabilityModel)) {
+        if (isGrokFrontier) {
           injectGrokStoreDefault(model, muxProviderOptions?.xai?.store);
         }
 

From 9bd10d3adf95faba4a45d8695fbcad6a7dabde32 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 09:02:30 +0000
Subject: [PATCH 41/94] refactor: share the bash-monitor-wake metadata type
 guard

Both call sites added in #3797 re-implemented the same unknown -> wake
check with different unsound casts. Extract isBashMonitorWakeMetadata
alongside the sibling guards in messageQueue.ts and reuse it, so the
queue-head and mid-dispatch checks cannot drift.
---
 src/node/services/agentSession.ts |  5 ++---
 src/node/services/messageQueue.ts | 18 +++++++++++++++---
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/node/services/agentSession.ts b/src/node/services/agentSession.ts
index b4e3e2d608..cb3202d755 100644
--- a/src/node/services/agentSession.ts
+++ b/src/node/services/agentSession.ts
@@ -113,7 +113,7 @@ import {
   createRuntimeContextForWorkspace,
   createRuntimeForWorkspace,
 } from "@/node/runtime/runtimeHelpers";
-import { MessageQueue } from "./messageQueue";
+import { isBashMonitorWakeMetadata, MessageQueue } from "./messageQueue";
 import type { QueueCutCutter } from "./messageQueue";
 import {
   copyStreamLifecycleSnapshot,
@@ -6675,8 +6675,7 @@ export class AgentSession {
     if (this.messageQueue.isNextEntryBashMonitorWake()) {
       return true;
     }
-    const dispatching = this.dispatchingQueuedEntryMuxMetadata as MuxMessageMetadata | undefined;
-    return dispatching?.type === "bash-monitor-wake";
+    return isBashMonitorWakeMetadata(this.dispatchingQueuedEntryMuxMetadata);
   }
 
   /**
diff --git a/src/node/services/messageQueue.ts b/src/node/services/messageQueue.ts
index 977029e05d..789af76d07 100644
--- a/src/node/services/messageQueue.ts
+++ b/src/node/services/messageQueue.ts
@@ -77,6 +77,20 @@ function isAgentPeerMessageMetadata(meta: unknown): boolean {
   return obj.type === "agent-peer-message" && typeof obj.fromWorkspaceId === "string";
 }
 
+// Bash-monitor wake metadata. Only `type` is declared/validated because callers
+// just need to recognize a wake, not read its records. Shared with AgentSession
+// so the queue-head check and the mid-dispatch check cannot drift on how a wake
+// is identified (see AgentSession.hasPendingBashMonitorWakeContinuation).
+export interface BashMonitorWakeMetadata {
+  type: "bash-monitor-wake";
+}
+
+export function isBashMonitorWakeMetadata(meta: unknown): meta is BashMonitorWakeMetadata {
+  if (typeof meta !== "object" || meta === null) return false;
+  const obj = meta as Record<string, unknown>;
+  return obj.type === "bash-monitor-wake";
+}
+
 // Type guard for metadata with reviews
 interface MetadataWithReviews {
   reviews?: ReviewNoteData[];
@@ -332,9 +346,7 @@ export class MessageQueue {
    * supersedes the turn when it dispatches.
    */
   isNextEntryBashMonitorWake(): boolean {
-    const muxMetadata = this.entries[0]?.muxMetadata;
-    if (typeof muxMetadata !== "object" || muxMetadata === null) return false;
-    return (muxMetadata as Record<string, unknown>).type === "bash-monitor-wake";
+    return isBashMonitorWakeMetadata(this.entries[0]?.muxMetadata);
   }
 
   /**

From b372b943d8b5cbe2629603f9548c7425e23be068 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 01:40:17 +0000
Subject: [PATCH 42/94] refactor: share the persisted tool-error message
 extraction

TimelineEventToolCall's extractErrorMessage and AgentSkillListToolCall's inline
check both handled the same two persisted error shapes. Extract into
extractToolErrorMessage in Shared/toolUtils.
---
 .../features/Tools/AgentSkillListToolCall.tsx | 12 +++-------
 .../features/Tools/Shared/toolUtils.tsx       | 17 ++++++++++++++
 .../features/Tools/TimelineEventToolCall.tsx  | 22 ++-----------------
 3 files changed, 22 insertions(+), 29 deletions(-)

diff --git a/src/browser/features/Tools/AgentSkillListToolCall.tsx b/src/browser/features/Tools/AgentSkillListToolCall.tsx
index 8baf7c1ff8..05a1f4c1fc 100644
--- a/src/browser/features/Tools/AgentSkillListToolCall.tsx
+++ b/src/browser/features/Tools/AgentSkillListToolCall.tsx
@@ -16,8 +16,8 @@ import {
   ToolIcon,
 } from "./Shared/ToolPrimitives";
 import {
+  extractToolErrorMessage,
   getStatusDisplay,
-  isToolErrorResult,
   unwrapResult,
   useToolExpansion,
   type ToolStatus,
@@ -104,14 +104,8 @@ export function toSkillListView(result: unknown): SkillListView {
   const unwrapped = unwrapResult(result);
   if (unwrapped == null || typeof unwrapped !== "object") return { kind: "none" };
 
-  if (isToolErrorResult(unwrapped)) return { kind: "error", error: unwrapped.error };
-  if (
-    !("success" in unwrapped) &&
-    "error" in unwrapped &&
-    typeof (unwrapped as { error: unknown }).error === "string"
-  ) {
-    return { kind: "error", error: (unwrapped as { error: string }).error };
-  }
+  const errorMessage = extractToolErrorMessage(unwrapped);
+  if (errorMessage != null) return { kind: "error", error: errorMessage };
 
   const parsed = SkillListSuccessSchema.safeParse(unwrapped);
   if (!parsed.success) return { kind: "none" };
diff --git a/src/browser/features/Tools/Shared/toolUtils.tsx b/src/browser/features/Tools/Shared/toolUtils.tsx
index 885ba00637..49a7801c1c 100644
--- a/src/browser/features/Tools/Shared/toolUtils.tsx
+++ b/src/browser/features/Tools/Shared/toolUtils.tsx
@@ -175,6 +175,23 @@ export function isToolErrorResult(val: unknown): val is ToolErrorResult {
   return record.success === false && typeof record.error === "string";
 }
 
+/**
+ * Error message from a persisted tool result, covering both shapes a card can see:
+ * top-level tools store `{ success: false, error }`, while a failure inside a nested
+ * code_execution/PTC call is reconstructed by displayedMessageBuilder as a bare `{ error }`
+ * with no `success` flag. Returns null when the result is not an error (including a
+ * successful payload that happens to carry an `error` field, which the `success` flag
+ * excludes).
+ *
+ * Callers should `unwrapResult` first; this does not unwrap the SDK JSON container.
+ */
+export function extractToolErrorMessage(result: unknown): string | null {
+  if (isToolErrorResult(result)) return result.error;
+  if (result == null || typeof result !== "object" || "success" in result) return null;
+  const error = (result as Record<string, unknown>).error;
+  return typeof error === "string" ? error : null;
+}
+
 /**
  * Determine if a tool output indicates failure.
  * Handles both `{ success: false }` and `{ error: "..." }` shapes.
diff --git a/src/browser/features/Tools/TimelineEventToolCall.tsx b/src/browser/features/Tools/TimelineEventToolCall.tsx
index 57005fbb8b..18acfdb1c3 100644
--- a/src/browser/features/Tools/TimelineEventToolCall.tsx
+++ b/src/browser/features/Tools/TimelineEventToolCall.tsx
@@ -17,8 +17,8 @@ import {
   ToolIcon,
 } from "./Shared/ToolPrimitives";
 import {
+  extractToolErrorMessage,
   getStatusDisplay,
-  isToolErrorResult,
   unwrapResult,
   useToolExpansion,
   type ToolStatus,
@@ -117,24 +117,6 @@ const TimelineRowPreview: React.FC<{
   );
 };
 
-/**
- * Both persisted error shapes: top-level tools store `{ success: false, error }`, while a
- * failure inside a nested code_execution call is reconstructed as a bare `{ error }` with
- * no success flag.
- */
-function extractErrorMessage(result: unknown): string | null {
-  if (isToolErrorResult(result)) {
-    return result.error;
-  }
-  if (result != null && typeof result === "object" && !("success" in result)) {
-    const error = (result as Record<string, unknown>).error;
-    if (typeof error === "string") {
-      return error;
-    }
-  }
-  return null;
-}
-
 // Results flow verbatim from persisted transcripts, so validate against the schema rather
 // than trusting the shape (self-healing: a malformed result degrades to a status note).
 function extractTimelineEventSuccess(result: unknown): TimelineEventSuccess | null {
@@ -178,7 +160,7 @@ export const TimelineEventToolCall: React.FC<TimelineEventToolCallProps> = (prop
   const category = props.args.category;
   // Results can arrive wrapped in the SDK JSON container { type: "json", value: ... }.
   const result = unwrapResult(props.result);
-  const errorMessage = extractErrorMessage(result);
+  const errorMessage = extractToolErrorMessage(result);
   const success = extractTimelineEventSuccess(result);
   const blurb = category != null ? CATEGORY_PRESENTATION[category].blurb : FALLBACK_BLURB;
 

From 2ee985c0fa11ac9b93178ef950173c5319edf79c Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 04:44:16 +0000
Subject: [PATCH 43/94] refactor: share the terminal-attention message text
 join

Both terminal-attention history scans in TaskService flattened MuxMessage
text parts with the same filter/map/join before handing the result to
parseTerminalSubagentTaskId. Extract joinMessageText so the two scans
cannot drift on the part filter or separator.

Behavior-preserving: identical expression, same call order.
---
 src/node/services/taskService.ts | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index 85054d49df..b8a9422e14 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -398,6 +398,17 @@ function parseTerminalSubagentExecutionVersion(content: string): string | null {
   return /<execution_version>([^\n<]+)<\/execution_version>/.exec(content)?.[1] ?? null;
 }
 
+// Flattens a history message to the text payload that the sub-agent report/failure envelope
+// parsers expect. Both terminal-attention history scans below classify rows this way, so keeping
+// the part filter and separator in one place stops them from drifting apart and silently
+// disagreeing about which messages already carry a terminal report.
+function joinMessageText(message: MuxMessage): string {
+  return message.parts
+    .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
+    .map((part) => part.text)
+    .join("\n");
+}
+
 // Failure twin of formatSubagentReportUserMessage: terminal child failures are
 // delivered into the parent context as an explicit failure block (never as a
 // report) so a later wake-up — by ANY sibling's settlement — cannot present the
@@ -8572,12 +8583,7 @@ export class TaskService implements AgentTaskIntegration {
     const existingTaskIds = new Set<string>();
     for (const message of historyResult.data) {
       if (message.role !== "user" || message.metadata?.synthetic !== true) continue;
-      const taskId = parseTerminalSubagentTaskId(
-        message.parts
-          .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
-          .map((part) => part.text)
-          .join("\n")
-      );
+      const taskId = parseTerminalSubagentTaskId(joinMessageText(message));
       if (taskId == null) continue;
       existingTaskIds.add(taskId);
       existingReportMessages.set(taskId, message);
@@ -8729,11 +8735,7 @@ export class TaskService implements AgentTaskIntegration {
 
     for (const message of historyResult.data) {
       if (message.role === "user" && message.metadata?.synthetic === true) {
-        const text = message.parts
-          .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
-          .map((part) => part.text)
-          .join("\n");
-        const taskId = parseTerminalSubagentTaskId(text);
+        const taskId = parseTerminalSubagentTaskId(joinMessageText(message));
         const historySequence = message.metadata?.historySequence;
         if (taskId != null && pendingIds.has(taskId) && typeof historySequence === "number") {
           terminalSequenceByTaskId.set(taskId, historySequence);

From 20d983847c58b33b11fbf76be68e9c441f4060f5 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 08:30:35 +0000
Subject: [PATCH 44/94] refactor: share the agent-plugin error diagnostic push

resolveComponentPath and discoverPluginAt each wrote the same
log.warn-then-push-error-diagnostic block by hand (3 copies). Extract
pushErrorDiagnostic so the log prefix, severity, and diagnostic shape
stay in one place. Behavior-preserving: identical log text and
diagnostic objects, same log-before-push ordering.
---
 src/node/services/agentPlugins/discovery.ts | 37 ++++++++++++++++-----
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/src/node/services/agentPlugins/discovery.ts b/src/node/services/agentPlugins/discovery.ts
index 3c2b42c3a0..35cbc51e30 100644
--- a/src/node/services/agentPlugins/discovery.ts
+++ b/src/node/services/agentPlugins/discovery.ts
@@ -193,6 +193,28 @@ export interface DiscoverAgentPluginsResult {
   diagnostics: AgentPluginDiagnostic[];
 }
 
+/**
+ * Record a plugin/component failure (§11.3): warn once with the owning plugin
+ * directory for operator context, then surface the same text as a diagnostic.
+ */
+function pushErrorDiagnostic(args: {
+  diagnostics: AgentPluginDiagnostic[];
+  /** Plugin directory used as the log prefix (context for the operator). */
+  pluginPath: string;
+  /** Path the diagnostic refers to; may be a component inside the plugin. */
+  path: string;
+  scope: AgentPluginScope;
+  message: string;
+}): void {
+  log.warn(`Agent plugin ${args.pluginPath}: ${args.message}`);
+  args.diagnostics.push({
+    path: args.path,
+    scope: args.scope,
+    severity: "error",
+    message: args.message,
+  });
+}
+
 async function listChildDirectories(containerPath: string): Promise<string[]> {
   try {
     const entries = await fsPromises.readdir(containerPath, { withFileTypes: true });
@@ -236,11 +258,11 @@ async function resolveComponentPath(args: {
     }
 
     const message = `${args.componentLabel} resolves outside the plugin root; ignoring this component: ${getErrorMessage(error)}`;
-    log.warn(`Agent plugin ${args.rootReal}: ${message}`);
-    args.diagnostics.push({
+    pushErrorDiagnostic({
+      diagnostics: args.diagnostics,
+      pluginPath: args.rootReal,
       path: candidate,
       scope: args.scope,
-      severity: "error",
       message,
     });
     return undefined;
@@ -256,11 +278,11 @@ async function resolveComponentPath(args: {
   const kindOk = args.expectKind === "file" ? stat.isFile() : stat.isDirectory();
   if (!kindOk) {
     const message = `${args.componentLabel} must be a ${args.expectKind === "file" ? "regular file" : "directory"}; ignoring this component`;
-    log.warn(`Agent plugin ${args.rootReal}: ${message}`);
-    args.diagnostics.push({
+    pushErrorDiagnostic({
+      diagnostics: args.diagnostics,
+      pluginPath: args.rootReal,
       path: candidate,
       scope: args.scope,
-      severity: "error",
       message,
     });
     return undefined;
@@ -291,8 +313,7 @@ async function discoverPluginAt(args: {
   const { pluginDir, scope, diagnostics } = args;
 
   const pushError = (targetPath: string, message: string): void => {
-    log.warn(`Agent plugin ${pluginDir}: ${message}`);
-    diagnostics.push({ path: targetPath, scope, severity: "error", message });
+    pushErrorDiagnostic({ diagnostics, pluginPath: pluginDir, path: targetPath, scope, message });
   };
 
   // The canonical plugin root anchors every §4.1 containment check.

From 97fe8d44716bb6e65c6232467efd6660a5a1dda6 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 8 Aug 2026 00:16:43 +0000
Subject: [PATCH 45/94] refactor: extract projectSelectOptions helper for
 creation project pickers

---
 .../features/ChatInput/CreationControls.tsx   |  7 ++----
 .../ChatInput/CreationProjectSelect.tsx       | 23 ++++++++++++++++++-
 src/browser/features/ChatInput/index.tsx      | 12 +++-------
 3 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/src/browser/features/ChatInput/CreationControls.tsx b/src/browser/features/ChatInput/CreationControls.tsx
index 5c958d1acd..b2ba4e552e 100644
--- a/src/browser/features/ChatInput/CreationControls.tsx
+++ b/src/browser/features/ChatInput/CreationControls.tsx
@@ -23,7 +23,7 @@ import {
 import { GitBranch, Loader2, Wand2 } from "lucide-react";
 import type { ProjectConfig } from "@/common/types/project";
 import { formatProjectHierarchyLabel } from "@/common/utils/subProjects";
-import { CreationProjectSelect } from "./CreationProjectSelect";
+import { CreationProjectSelect, projectSelectOptions } from "./CreationProjectSelect";
 import { RuntimeConfigInput } from "@/browser/components/RuntimeConfigInput/RuntimeConfigInput";
 import { usePerfRenderMarker } from "@/browser/utils/perf/PerfRenderMarker";
 import { cn } from "@/common/lib/utils";
@@ -745,10 +745,7 @@ function CreationControlsContent(props: CreationControlsProps) {
             <CreationProjectSelect
               selected={selected}
               selectedLabel={formatProjectHierarchyLabel(selected, props.userProjects)}
-              options={Array.from(props.userProjects.keys()).map((path) => ({
-                value: path,
-                label: formatProjectHierarchyLabel(path, props.userProjects),
-              }))}
+              options={projectSelectOptions(props.userProjects)}
               onChange={props.onSelectedProjectPathChange}
             />
           );
diff --git a/src/browser/features/ChatInput/CreationProjectSelect.tsx b/src/browser/features/ChatInput/CreationProjectSelect.tsx
index 89359a01aa..d7559f5476 100644
--- a/src/browser/features/ChatInput/CreationProjectSelect.tsx
+++ b/src/browser/features/ChatInput/CreationProjectSelect.tsx
@@ -6,12 +6,33 @@ import {
   SelectValue,
 } from "@/browser/components/SelectPrimitive/SelectPrimitive";
 import { Tooltip, TooltipTrigger, TooltipContent } from "@/browser/components/Tooltip/Tooltip";
+import type { ProjectConfig } from "@/common/types/project";
+import { formatProjectHierarchyLabel } from "@/common/utils/subProjects";
+
+export interface CreationProjectOption {
+  value: string;
+  label: string;
+}
+
+/**
+ * Every user project as picker options, labeled with the same hierarchy label
+ * the trigger uses so sub-projects read as "parent/child" in both places.
+ * Shared so callers that prepend extra entries (e.g. Scratch) stay consistent.
+ */
+export function projectSelectOptions(
+  userProjects: Map<string, ProjectConfig>
+): CreationProjectOption[] {
+  return Array.from(userProjects.keys()).map((path) => ({
+    value: path,
+    label: formatProjectHierarchyLabel(path, userProjects),
+  }));
+}
 
 interface CreationProjectSelectProps {
   selected: string;
   selectedLabel: string;
   tooltip?: string;
-  options: Array<{ value: string; label: string }>;
+  options: CreationProjectOption[];
   onChange: (value: string) => void;
 }
 
diff --git a/src/browser/features/ChatInput/index.tsx b/src/browser/features/ChatInput/index.tsx
index cd65d1c34f..f09d1b38a9 100644
--- a/src/browser/features/ChatInput/index.tsx
+++ b/src/browser/features/ChatInput/index.tsx
@@ -84,12 +84,9 @@ import {
   convertSymbolCommandAtCursor,
   convertTerminatedSymbolCommand,
 } from "@/browser/features/ChatInput/symbolShortcuts";
-import {
-  formatProjectHierarchyLabel,
-  resolveWorkspaceCreationScope,
-} from "@/common/utils/subProjects";
+import { resolveWorkspaceCreationScope } from "@/common/utils/subProjects";
 import { SCRATCH_PROJECT_CONFIG_KEY, SCRATCH_PROJECT_NAME } from "@/common/constants/scratch";
-import { CreationProjectSelect } from "./CreationProjectSelect";
+import { CreationProjectSelect, projectSelectOptions } from "./CreationProjectSelect";
 import { Tooltip, TooltipTrigger, TooltipContent } from "@/browser/components/Tooltip/Tooltip";
 import { AgentModePicker } from "@/browser/components/AgentModePicker/AgentModePicker";
 import { ContextUsageIndicatorButton } from "@/browser/components/ContextUsageIndicatorButton/ContextUsageIndicatorButton";
@@ -2568,10 +2565,7 @@ const ChatInputInner: React.FC<ChatInputProps> = (props) => {
                 tooltip={SCRATCH_PROJECT_NAME}
                 options={[
                   { value: SCRATCH_PROJECT_CONFIG_KEY, label: SCRATCH_PROJECT_NAME },
-                  ...Array.from(userProjects.keys()).map((path) => ({
-                    value: path,
-                    label: formatProjectHierarchyLabel(path, userProjects),
-                  })),
+                  ...projectSelectOptions(userProjects),
                 ]}
                 onChange={(path) => {
                   if (path !== SCRATCH_PROJECT_CONFIG_KEY) {

From fc2c1bb1e556e4ebc91845eb458eb6dd369149b5 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 20:14:40 +0000
Subject: [PATCH 46/94] refactor: extract shared raw-tool wrapper for MCP
 startup paths

startStdioInstance and startRemoteInstance each defined a byte-identical
wrapRawTools lambda over wrapMCPTools. Extract createRawToolWrapper so the
wrapping options (activity tracking + marking the live instance closed) live
in one place. Behavior-preserving.
---
 src/node/services/mcpServerManager.ts | 39 +++++++++++++++++----------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/src/node/services/mcpServerManager.ts b/src/node/services/mcpServerManager.ts
index f716ba35a5..83ab17040f 100644
--- a/src/node/services/mcpServerManager.ts
+++ b/src/node/services/mcpServerManager.ts
@@ -980,6 +980,29 @@ interface MCPServerInstance {
   close: () => Promise<void>;
 }
 
+/**
+ * Build the raw-tool wrapper shared by the stdio and remote startup paths.
+ *
+ * Both paths wrap freshly listed MCP tools with the same options — activity
+ * tracking plus marking the live instance closed when a tool call detects a
+ * dead client — and both re-wrap through refreshTools on 2026-07-28+
+ * connections, so the options live in one place instead of being restated per
+ * transport. instanceRef is passed by reference because the instance is only
+ * assigned after the wrapper is built.
+ */
+function createRawToolWrapper(
+  onActivity: () => void,
+  instanceRef: { current: MCPServerInstance | null }
+): (raw: Record<string, Tool>) => Record<string, Tool> {
+  return (raw) =>
+    wrapMCPTools(raw, {
+      onActivity,
+      onClosed: () => {
+        if (instanceRef.current) instanceRef.current.isClosed = true;
+      },
+    });
+}
+
 export type MCPTransportMode = "none" | "stdio_only" | "http_only" | "sse_only" | "mixed";
 
 export interface MCPWorkspaceStats {
@@ -3744,13 +3767,7 @@ export class MCPServerManager {
           return null;
         }
 
-        const wrapRawTools = (raw: Record<string, Tool>) =>
-          wrapMCPTools(raw, {
-            onActivity,
-            onClosed: () => {
-              if (instanceRef.current) instanceRef.current.isClosed = true;
-            },
-          });
+        const wrapRawTools = createRawToolWrapper(onActivity, instanceRef);
 
         // eslint-disable-next-line local/no-chained-type-assertions -- grandfathered when the rule was introduced; fix the underlying type instead of copying this pattern
         const tools = wrapRawTools(rawTools as unknown as Record<string, Tool>);
@@ -3994,13 +4011,7 @@ export class MCPServerManager {
 
       let clientClosed = false;
 
-      const wrapRawTools = (raw: Record<string, Tool>) =>
-        wrapMCPTools(raw, {
-          onActivity,
-          onClosed: () => {
-            if (instanceRef.current) instanceRef.current.isClosed = true;
-          },
-        });
+      const wrapRawTools = createRawToolWrapper(onActivity, instanceRef);
 
       // eslint-disable-next-line local/no-chained-type-assertions -- grandfathered when the rule was introduced; fix the underlying type instead of copying this pattern
       const tools = wrapRawTools(rawTools as unknown as Record<string, Tool>);

From 82cf79a122e7ccb36daef44487940357418e50a7 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 08:41:52 +0000
Subject: [PATCH 47/94] refactor: extract createExecError for the three exec
 failure paths

disposableExec.ts built the same augmented Error in three places (the
pre-execution abort in execFileAsync, plus both close handlers): an
inline `as Error & { code, signal, stdout, stderr }` cast followed by
four property assignments. Extract createExecError so the rejection
shape is defined once and cannot drift between the paths.

Behavior-preserving: same message strings, same field values, same
rejection timing. The only observable difference is one extra stack
frame, which nothing asserts on.
---
 src/node/utils/disposableExec.ts | 68 +++++++++++++++++---------------
 1 file changed, 36 insertions(+), 32 deletions(-)

diff --git a/src/node/utils/disposableExec.ts b/src/node/utils/disposableExec.ts
index d396527d4e..5cff41769e 100644
--- a/src/node/utils/disposableExec.ts
+++ b/src/node/utils/disposableExec.ts
@@ -191,6 +191,34 @@ class DisposableExec implements Disposable {
   }
 }
 
+/**
+ * Rejection shape shared by {@link execAsync} and {@link execFileAsync}: an `Error` carrying the
+ * process outcome so callers can branch on exit code or signal instead of parsing the message.
+ */
+interface ExecError extends Error {
+  code: number | null;
+  signal: string | null;
+  stdout: string;
+  stderr: string;
+}
+
+/**
+ * Builds the augmented rejection error for a failed command. Extracted because all three failure
+ * paths (pre-execution abort, and the `close` handlers of `execAsync`/`execFileAsync`) must attach
+ * the same four fields; repeating the cast plus the assignments let those shapes drift.
+ */
+function createExecError(
+  message: string,
+  outcome: Pick<ExecError, "code" | "signal" | "stdout" | "stderr">
+): ExecError {
+  const error = new Error(message) as ExecError;
+  error.code = outcome.code;
+  error.signal = outcome.signal;
+  error.stdout = outcome.stdout;
+  error.stderr = outcome.stderr;
+  return error;
+}
+
 /**
  * Options for execAsync.
  */
@@ -245,17 +273,7 @@ export function execAsync(command: string, options?: ExecAsyncOptions): Disposab
           (exitSignal
             ? `Command killed by signal ${exitSignal}`
             : `Command failed with exit code ${exitCode ?? "unknown"}`);
-        const error = new Error(errorMsg) as Error & {
-          code: number | null;
-          signal: string | null;
-          stdout: string;
-          stderr: string;
-        };
-        error.code = exitCode;
-        error.signal = exitSignal;
-        error.stdout = stdout;
-        error.stderr = stderr;
-        reject(error);
+        reject(createExecError(errorMsg, { code: exitCode, signal: exitSignal, stdout, stderr }));
       }
     });
 
@@ -304,16 +322,12 @@ export function execFileAsync(
   options?: ExecFileAsyncOptions
 ): DisposableExec {
   if (options?.signal?.aborted) {
-    const error = new Error("Command aborted before execution") as Error & {
-      code: number | null;
-      signal: string | null;
-      stdout: string;
-      stderr: string;
-    };
-    error.code = null;
-    error.signal = null;
-    error.stdout = "";
-    error.stderr = "";
+    const error = createExecError("Command aborted before execution", {
+      code: null,
+      signal: null,
+      stdout: "",
+      stderr: "",
+    });
     const result = Promise.reject(error);
     void result.catch(() => undefined);
     return new DisposableExec(result);
@@ -403,17 +417,7 @@ export function execFileAsync(
             (exitSignal
               ? `Command killed by signal ${exitSignal}`
               : `Command failed with exit code ${exitCode ?? "unknown"}`);
-        const error = new Error(errorMsg) as Error & {
-          code: number | null;
-          signal: string | null;
-          stdout: string;
-          stderr: string;
-        };
-        error.code = exitCode;
-        error.signal = exitSignal;
-        error.stdout = stdout;
-        error.stderr = stderr;
-        reject(error);
+        reject(createExecError(errorMsg, { code: exitCode, signal: exitSignal, stdout, stderr }));
       }
     });
 

From b3104dd8b8ea790e63f0d6a2adbd29651756f83d Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 00:48:55 +0000
Subject: [PATCH 48/94] refactor: dedupe popover error anchor math into
 resolvePopoverErrorAnchor

Ten call sites across ProjectSidebar, WorkspaceMenuBar and ArchivedWorkspaces each
re-derived the same anchor for usePopoverError's showError: convert the trigger's
viewport rect into document space (rect.top + window.scrollY) and offset a bare 10px
past its right edge. Extract resolvePopoverErrorAnchor into usePopoverError, where the
anchor type already lives, name the gutter constant once, and give the inline anchor
shape a PopoverErrorAnchor alias.

Behavior-preserving: every site fed the identical expression to showError, and the
element-absent branches all collapse to undefined, which showError already treats as
'use default corner placement'.
---
 .../ArchivedWorkspaces/ArchivedWorkspaces.tsx | 19 ++++-------
 .../ProjectSidebar/ProjectSidebar.tsx         | 31 +++--------------
 .../WorkspaceMenuBar/WorkspaceMenuBar.tsx     | 33 +++++--------------
 src/browser/hooks/usePopoverError.ts          | 30 +++++++++++++++--
 4 files changed, 48 insertions(+), 65 deletions(-)

diff --git a/src/browser/components/ArchivedWorkspaces/ArchivedWorkspaces.tsx b/src/browser/components/ArchivedWorkspaces/ArchivedWorkspaces.tsx
index bd94c4b24d..69440d22bc 100644
--- a/src/browser/components/ArchivedWorkspaces/ArchivedWorkspaces.tsx
+++ b/src/browser/components/ArchivedWorkspaces/ArchivedWorkspaces.tsx
@@ -8,7 +8,7 @@ import { getErrorMessage } from "@/common/utils/errors";
 import { useAPI } from "@/browser/contexts/API";
 import { useWorkspaceContext } from "@/browser/contexts/WorkspaceContext";
 import { usePersistedState } from "@/browser/hooks/usePersistedState";
-import { usePopoverError } from "@/browser/hooks/usePopoverError";
+import { resolvePopoverErrorAnchor, usePopoverError } from "@/browser/hooks/usePopoverError";
 import { ChevronDown, ChevronRight, FolderX, Loader2, Search, Trash2 } from "lucide-react";
 import { ArchiveIcon, ArchiveRestoreIcon } from "../icons/ArchiveIcon/ArchiveIcon";
 import { Tooltip, TooltipTrigger, TooltipContent } from "../Tooltip/Tooltip";
@@ -584,15 +584,11 @@ export const ArchivedWorkspaces: React.FC<ArchivedWorkspacesProps> = ({
         return;
       }
 
-      if (anchorEl) {
-        const rect = anchorEl.getBoundingClientRect();
-        unarchiveError.showError(workspaceId, result.error ?? "Failed to restore workspace", {
-          top: rect.top + window.scrollY,
-          left: rect.right + 10,
-        });
-      } else {
-        unarchiveError.showError(workspaceId, result.error ?? "Failed to restore workspace");
-      }
+      unarchiveError.showError(
+        workspaceId,
+        result.error ?? "Failed to restore workspace",
+        resolvePopoverErrorAnchor(anchorEl)
+      );
     } finally {
       setProcessingIds((prev) => {
         const next = new Set(prev);
@@ -675,8 +671,7 @@ export const ArchivedWorkspaces: React.FC<ArchivedWorkspacesProps> = ({
   };
 
   const handleDeleteWorktree = async (workspaceId: string, anchorEl?: HTMLElement) => {
-    const rect = anchorEl?.getBoundingClientRect();
-    const anchor = rect ? { top: rect.top + window.scrollY, left: rect.right + 10 } : undefined;
+    const anchor = resolvePopoverErrorAnchor(anchorEl);
 
     if (!api) {
       deleteWorktreeError.showError(workspaceId, "Not connected to server", anchor);
diff --git a/src/browser/components/ProjectSidebar/ProjectSidebar.tsx b/src/browser/components/ProjectSidebar/ProjectSidebar.tsx
index 9c1800fbf0..cbbe5a2567 100644
--- a/src/browser/components/ProjectSidebar/ProjectSidebar.tsx
+++ b/src/browser/components/ProjectSidebar/ProjectSidebar.tsx
@@ -126,7 +126,7 @@ import {
 } from "lucide-react";
 import { useWorkspaceActions } from "@/browser/contexts/WorkspaceContext";
 import { useRouter } from "@/browser/contexts/RouterContext";
-import { usePopoverError } from "@/browser/hooks/usePopoverError";
+import { resolvePopoverErrorAnchor, usePopoverError } from "@/browser/hooks/usePopoverError";
 import { forkWorkspace } from "@/browser/utils/chatCommands";
 import { PopoverError } from "../PopoverError/PopoverError";
 import { SectionHeader } from "../SectionHeader/SectionHeader";
@@ -1017,14 +1017,7 @@ const ProjectSidebarInner: React.FC<ProjectSidebarProps> = ({
         return;
       }
 
-      let anchor: { top: number; left: number } | undefined;
-      if (buttonElement) {
-        const rect = buttonElement.getBoundingClientRect();
-        anchor = {
-          top: rect.top + window.scrollY,
-          left: rect.right + 10,
-        };
-      }
+      const anchor = resolvePopoverErrorAnchor(buttonElement);
 
       try {
         const result = await forkWorkspace({
@@ -1046,14 +1039,7 @@ const ProjectSidebarInner: React.FC<ProjectSidebarProps> = ({
 
   const handleStopRuntime = useCallback(
     async (workspaceId: string, buttonElement?: HTMLElement) => {
-      let anchor: { top: number; left: number } | undefined;
-      if (buttonElement) {
-        const rect = buttonElement.getBoundingClientRect();
-        anchor = {
-          top: rect.top + window.scrollY,
-          left: rect.right + 10,
-        };
-      }
+      const anchor = resolvePopoverErrorAnchor(buttonElement);
 
       if (!api) {
         workspaceStopRuntimeError.showError(workspaceId, "Not connected to server", anchor);
@@ -1375,16 +1361,7 @@ const ProjectSidebarInner: React.FC<ProjectSidebarProps> = ({
   ) => {
     // Capture the anchor location up front because the sub-project action menu unmounts its
     // button immediately after click; failures still need stable error placement.
-    const anchor =
-      buttonElement != null
-        ? (() => {
-            const buttonRect = buttonElement.getBoundingClientRect();
-            return {
-              top: buttonRect.top + window.scrollY,
-              left: buttonRect.right + 10,
-            };
-          })()
-        : undefined;
+    const anchor = resolvePopoverErrorAnchor(buttonElement);
 
     // Removing a sub-project unregisters it and clears the cwd pointer from its workspaces.
     // projects.list excludes archived workspaces, so this count covers live ones only;
diff --git a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
index 5afc086d4f..2a496007d8 100644
--- a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
+++ b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
@@ -33,7 +33,7 @@ import type { TerminalSessionCreateOptions } from "@/browser/utils/terminal";
 import { useOpenTerminal } from "@/browser/hooks/useOpenTerminal";
 import { useOpenInEditor } from "@/browser/hooks/useOpenInEditor";
 import { usePersistedState } from "@/browser/hooks/usePersistedState";
-import { usePopoverError } from "@/browser/hooks/usePopoverError";
+import { resolvePopoverErrorAnchor, usePopoverError } from "@/browser/hooks/usePopoverError";
 import { isDesktopMode, DESKTOP_TITLEBAR_HEIGHT_CLASS } from "@/browser/hooks/useDesktopTitlebar";
 import { useExperimentValue } from "@/browser/hooks/useExperiments";
 import { DebugLlmRequestModal } from "../DebugLlmRequestModal/DebugLlmRequestModal";
@@ -269,17 +269,10 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
   const isDevcontainerWorkspace = isDevcontainerRuntime(runtimeConfig);
   const isRuntimeRunning = isDevcontainerWorkspace && runtimeStatus === "running";
 
-  const getMoreMenuAnchor = useCallback(() => {
-    const rect = moreActionsButtonRef.current?.getBoundingClientRect();
-    if (!rect) {
-      return undefined;
-    }
-
-    return {
-      top: rect.top + window.scrollY,
-      left: rect.right + 10,
-    };
-  }, []);
+  const getMoreMenuAnchor = useCallback(
+    () => resolvePopoverErrorAnchor(moreActionsButtonRef.current),
+    []
+  );
 
   const handleOpenTouchFullscreenReview = useCallback(() => {
     window.dispatchEvent(
@@ -327,11 +320,10 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
           return;
         }
         if (!res.success) {
-          const rect = anchorEl?.getBoundingClientRect();
           archiveError.showError(
             workspaceId,
             res.error ?? "Failed to archive chat",
-            rect ? { top: rect.top + window.scrollY, left: rect.right + 10 } : undefined
+            resolvePopoverErrorAnchor(anchorEl)
           );
         }
       } finally {
@@ -358,11 +350,10 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
         // Run preflight to check for untracked files that can't be preserved.
         const preflight = await preflightArchiveWorkspace(workspaceId);
         if (!preflight.success) {
-          const rect = anchorEl?.getBoundingClientRect();
           archiveError.showError(
             workspaceId,
             preflight.error ?? "Failed to check archive readiness",
-            rect ? { top: rect.top + window.scrollY, left: rect.right + 10 } : undefined
+            resolvePopoverErrorAnchor(anchorEl)
           );
           return;
         }
@@ -391,18 +382,12 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
 
   const handleForkChat = useCallback(
     async (anchorEl: HTMLElement) => {
+      const anchor = resolvePopoverErrorAnchor(anchorEl);
       if (!api) {
-        const rect = anchorEl.getBoundingClientRect();
-        forkError.showError(workspaceId, "Not connected to server", {
-          top: rect.top + window.scrollY,
-          left: rect.right + 10,
-        });
+        forkError.showError(workspaceId, "Not connected to server", anchor);
         return;
       }
 
-      const rect = anchorEl.getBoundingClientRect();
-      const anchor = { top: rect.top + window.scrollY, left: rect.right + 10 };
-
       try {
         const result = await forkWorkspace({
           client: api,
diff --git a/src/browser/hooks/usePopoverError.ts b/src/browser/hooks/usePopoverError.ts
index 0d40c8efee..8e4439ae4c 100644
--- a/src/browser/hooks/usePopoverError.ts
+++ b/src/browser/hooks/usePopoverError.ts
@@ -1,17 +1,43 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 
+export interface PopoverErrorAnchor {
+  top: number;
+  left: number;
+}
+
 export interface PopoverErrorState {
   id: string;
   error: string;
-  position: { top: number; left: number };
+  position: PopoverErrorAnchor;
 }
 
 export interface UsePopoverErrorResult {
   error: PopoverErrorState | null;
-  showError: (id: string, error: string, anchor?: { top: number; left: number }) => void;
+  showError: (id: string, error: string, anchor?: PopoverErrorAnchor) => void;
   clearError: () => void;
 }
 
+/** Gutter between the triggering control's right edge and the error popover. */
+const POPOVER_ERROR_ANCHOR_GAP_PX = 10;
+
+/**
+ * Places an error popover just outside the right edge of the control that triggered it.
+ * Every trigger has to apply the same two conversions — getBoundingClientRect is
+ * viewport-relative while the popover is positioned in document space, hence the scrollY
+ * offset — so keep them here rather than re-deriving the arithmetic at each call site.
+ * A missing element yields `undefined`, which lets showError fall back to its default
+ * corner placement (callers whose trigger unmounts on click pass it through the same way).
+ */
+export function resolvePopoverErrorAnchor(
+  element: HTMLElement | null | undefined
+): PopoverErrorAnchor | undefined {
+  if (element == null) {
+    return undefined;
+  }
+  const rect = element.getBoundingClientRect();
+  return { top: rect.top + window.scrollY, left: rect.right + POPOVER_ERROR_ANCHOR_GAP_PX };
+}
+
 /**
  * Hook for managing popover error state with auto-dismiss and click-outside behavior.
  * @param autoDismissMs - Time in ms before auto-dismissing (default: 5000)

From 4600083b9023c9fd49352ec4dd7768d58f38f71c Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 04:41:30 +0000
Subject: [PATCH 49/94] refactor: dedupe the notification settings panel in
 WorkspaceMenuBar

The notification settings control set (notify-on-response checkbox,
auto-enable checkbox, and docs link) was inlined twice verbatim: once in
the hover TooltipContent and once in the click PopoverContent. Build the
element once and render it in both slots so the two affordances cannot
drift apart.
---
 .../WorkspaceMenuBar/WorkspaceMenuBar.tsx     | 110 +++++++-----------
 1 file changed, 42 insertions(+), 68 deletions(-)

diff --git a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
index 2a496007d8..201d313568 100644
--- a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
+++ b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
@@ -561,6 +561,46 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
   // those controls and the MCP/editor/terminal buttons become unclickable.
   const isDesktop = isDesktopMode();
 
+  // The notification settings panel is reachable two ways: the hover tooltip and the
+  // click popover. Both render the identical control set, so build the tree once and
+  // render it in both slots to stop the two copies from drifting apart.
+  const notificationSettingsContent = (
+    <div className="flex flex-col gap-2">
+      <label className="flex cursor-pointer items-center gap-2">
+        <Checkbox
+          checked={notifyOnResponse}
+          onCheckedChange={(checked) => setNotifyOnResponse(checked === true)}
+        />
+        <span className="text-foreground">
+          Notify on all responses{" "}
+          <span className="text-muted-foreground">
+            ({formatKeybind(KEYBINDS.TOGGLE_NOTIFICATIONS)})
+          </span>
+        </span>
+      </label>
+      <label className="flex cursor-pointer items-start gap-2">
+        <Checkbox
+          checked={autoEnableNotifications}
+          onCheckedChange={(checked) => setAutoEnableNotifications(checked === true)}
+        />
+        <span className="text-muted-foreground">
+          Auto-enable for new workspaces in this project
+        </span>
+      </label>
+      <p className="text-muted-foreground border-separator-light border-t pt-2">
+        Agents can also notify on specific events.{" "}
+        <a
+          href="https://mux.coder.com/config/notifications"
+          target="_blank"
+          rel="noopener noreferrer"
+          className="text-accent hover:underline"
+        >
+          Learn more
+        </a>
+      </p>
+    </div>
+  );
+
   return (
     <div
       ref={menuBarRef}
@@ -664,40 +704,7 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
               </PopoverTrigger>
             </TooltipTrigger>
             <TooltipContent side="bottom" align="end">
-              <div className="flex flex-col gap-2">
-                <label className="flex cursor-pointer items-center gap-2">
-                  <Checkbox
-                    checked={notifyOnResponse}
-                    onCheckedChange={(checked) => setNotifyOnResponse(checked === true)}
-                  />
-                  <span className="text-foreground">
-                    Notify on all responses{" "}
-                    <span className="text-muted-foreground">
-                      ({formatKeybind(KEYBINDS.TOGGLE_NOTIFICATIONS)})
-                    </span>
-                  </span>
-                </label>
-                <label className="flex cursor-pointer items-start gap-2">
-                  <Checkbox
-                    checked={autoEnableNotifications}
-                    onCheckedChange={(checked) => setAutoEnableNotifications(checked === true)}
-                  />
-                  <span className="text-muted-foreground">
-                    Auto-enable for new workspaces in this project
-                  </span>
-                </label>
-                <p className="text-muted-foreground border-separator-light border-t pt-2">
-                  Agents can also notify on specific events.{" "}
-                  <a
-                    href="https://mux.coder.com/config/notifications"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    className="text-accent hover:underline"
-                  >
-                    Learn more
-                  </a>
-                </p>
-              </div>
+              {notificationSettingsContent}
             </TooltipContent>
           </Tooltip>
 
@@ -706,40 +713,7 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
             align="end"
             className="bg-modal-bg border-separator-light w-64 overflow-visible rounded px-[10px] py-[6px] text-[11px] font-normal shadow-[0_2px_8px_rgba(0,0,0,0.4)]"
           >
-            <div className="flex flex-col gap-2">
-              <label className="flex cursor-pointer items-center gap-2">
-                <Checkbox
-                  checked={notifyOnResponse}
-                  onCheckedChange={(checked) => setNotifyOnResponse(checked === true)}
-                />
-                <span className="text-foreground">
-                  Notify on all responses{" "}
-                  <span className="text-muted-foreground">
-                    ({formatKeybind(KEYBINDS.TOGGLE_NOTIFICATIONS)})
-                  </span>
-                </span>
-              </label>
-              <label className="flex cursor-pointer items-start gap-2">
-                <Checkbox
-                  checked={autoEnableNotifications}
-                  onCheckedChange={(checked) => setAutoEnableNotifications(checked === true)}
-                />
-                <span className="text-muted-foreground">
-                  Auto-enable for new workspaces in this project
-                </span>
-              </label>
-              <p className="text-muted-foreground border-separator-light border-t pt-2">
-                Agents can also notify on specific events.{" "}
-                <a
-                  href="https://mux.coder.com/config/notifications"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="text-accent hover:underline"
-                >
-                  Learn more
-                </a>
-              </p>
-            </div>
+            {notificationSettingsContent}
           </PopoverContent>
         </Popover>
         <SkillIndicator

From e2ba40524064ea774a21df82da0535ffff49f404 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 08:36:41 +0000
Subject: [PATCH 50/94] refactor: dedupe persisted-choice normalization in
 AnalyticsDashboard

The three normalize* helpers were structurally identical (typeof guard +
Set membership + cast + literal fallback). Collapse them into a single
generic normalizePersistedChoice<T>() and regroup VALID_TIME_ZONE_MODES
with its sibling constants. Behavior-preserving: same valid-value sets
and same fallbacks (30d / duration / local).
---
 .../features/Analytics/AnalyticsDashboard.tsx | 48 +++++++++++--------
 1 file changed, 27 insertions(+), 21 deletions(-)

diff --git a/src/browser/features/Analytics/AnalyticsDashboard.tsx b/src/browser/features/Analytics/AnalyticsDashboard.tsx
index 6996e2a8ca..2f98a1b020 100644
--- a/src/browser/features/Analytics/AnalyticsDashboard.tsx
+++ b/src/browser/features/Analytics/AnalyticsDashboard.tsx
@@ -44,22 +44,27 @@ type TimeZoneMode = "local" | "utc";
 
 const VALID_TIME_RANGES = new Set<string>(["7d", "30d", "90d", "all"]);
 const VALID_TIMING_METRICS = new Set<string>(["ttft", "duration", "tps"]);
-
 const VALID_TIME_ZONE_MODES = new Set<string>(["local", "utc"]);
+
 const ANALYTICS_TIME_RANGE_STORAGE_KEY = "analytics:timeRange";
 const ANALYTICS_TIMING_METRIC_STORAGE_KEY = "analytics:timingMetric";
 const ANALYTICS_TIME_ZONE_MODE_STORAGE_KEY = "analytics:timeZoneMode";
 
-/** Coerce a persisted value to a known TimeRange, falling back to "30d" if stale/corrupted. */
-function normalizeTimeRange(value: unknown): TimeRange {
-  return typeof value === "string" && VALID_TIME_RANGES.has(value) ? (value as TimeRange) : "30d";
-}
-
-/** Coerce a persisted value to a known TimingMetric, falling back to "duration" if stale/corrupted. */
-function normalizeTimingMetric(value: unknown): TimingMetric {
-  return typeof value === "string" && VALID_TIMING_METRICS.has(value)
-    ? (value as TimingMetric)
-    : "duration";
+/**
+ * Coerce a persisted value to a member of `validValues`, falling back to
+ * `fallback` if stale/corrupted. Persisted dashboard selections come from
+ * localStorage, so every read has to tolerate arbitrary JSON.
+ *
+ * Pass the union explicitly (e.g. `normalizePersistedChoice<TimeRange>(...)`);
+ * inferring `T` from `fallback` alone would narrow the result to that single
+ * literal instead of the full union.
+ */
+function normalizePersistedChoice<T extends string>(
+  value: unknown,
+  validValues: ReadonlySet<string>,
+  fallback: T
+): T {
+  return typeof value === "string" && validValues.has(value) ? (value as T) : fallback;
 }
 
 /** Build a calendar-date boundary for the selected timezone. */
@@ -116,13 +121,6 @@ function computeDateRange(
   }
 }
 
-/** Coerce a persisted value to a supported timezone mode. */
-function normalizeTimeZoneMode(value: unknown): TimeZoneMode {
-  return typeof value === "string" && VALID_TIME_ZONE_MODES.has(value)
-    ? (value as TimeZoneMode)
-    : "local";
-}
-
 function getBrowserTimeZone(): string {
   return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
 }
@@ -147,9 +145,17 @@ export function AnalyticsDashboard(props: AnalyticsDashboardProps) {
 
   // Coerce persisted values to known enums — stale/corrupted localStorage
   // entries self-heal to defaults instead of crashing the dashboard.
-  const timeRange = normalizeTimeRange(rawTimeRange);
-  const timingMetric = normalizeTimingMetric(rawTimingMetric);
-  const timeZoneMode = normalizeTimeZoneMode(rawTimeZoneMode);
+  const timeRange = normalizePersistedChoice<TimeRange>(rawTimeRange, VALID_TIME_RANGES, "30d");
+  const timingMetric = normalizePersistedChoice<TimingMetric>(
+    rawTimingMetric,
+    VALID_TIMING_METRICS,
+    "duration"
+  );
+  const timeZoneMode = normalizePersistedChoice<TimeZoneMode>(
+    rawTimeZoneMode,
+    VALID_TIME_ZONE_MODES,
+    "local"
+  );
   const timeZone = timeZoneMode === "utc" ? "UTC" : getBrowserTimeZone();
 
   const dateRange = computeDateRange(timeRange, "UTC");

From 1b12ea456eff78d9d6b0c47b2d8e8afab87fd040 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 12:20:29 +0000
Subject: [PATCH 51/94] refactor: extract mergeFetchHeaders for provider fetch
 wrappers

The devtools-stripping, Copilot, and Coder fetch wrappers each built their
effective request headers with the same six-line block (seed from the
Request input, overlay init.headers). Extract it into a single local
helper so the three sites cannot drift apart.
---
 src/node/services/providerModelFactory.ts | 46 +++++++++++++----------
 1 file changed, 26 insertions(+), 20 deletions(-)

diff --git a/src/node/services/providerModelFactory.ts b/src/node/services/providerModelFactory.ts
index 832c261a83..4ff5d1e289 100644
--- a/src/node/services/providerModelFactory.ts
+++ b/src/node/services/providerModelFactory.ts
@@ -597,6 +597,29 @@ function wrapFetchStrippingEmptyAuthHeaders(baseFetch: typeof fetch): typeof fet
   return Object.assign(wrappedFetch, baseFetch) as typeof fetch;
 }
 
+/**
+ * Build the effective request headers for a fetch wrapper.
+ *
+ * A fetch wrapper that wants to add/remove headers cannot just read one side:
+ * headers can arrive on a `Request` input, on `init.headers`, or both. Start
+ * from the Request's headers (when input is a Request), then overlay
+ * `init.headers` so per-call overrides win — matching how the platform fetch
+ * resolves the pair. Returning a fresh `Headers` also keeps callers from
+ * mutating a `Request`'s immutable header list.
+ */
+function mergeFetchHeaders(
+  input: Parameters<typeof fetch>[0],
+  init?: Parameters<typeof fetch>[1]
+): Headers {
+  const merged = new Headers(input instanceof Request ? input.headers : undefined);
+  if (init?.headers) {
+    for (const [key, value] of new Headers(init.headers).entries()) {
+      merged.set(key, value);
+    }
+  }
+  return merged;
+}
+
 /**
  * Get fetch function for provider - use custom if provided, otherwise unlimited timeout default
  */
@@ -614,14 +637,7 @@ function getProviderFetch(providerConfig: ProviderConfig): typeof fetch {
     input: Parameters<typeof fetch>[0],
     init?: Parameters<typeof fetch>[1]
   ): Promise<Response> => {
-    // Build merged headers: start from the Request (if any), then overlay init.headers.
-    const merged = new Headers(input instanceof Request ? input.headers : undefined);
-    if (init?.headers) {
-      for (const [key, value] of new Headers(init.headers).entries()) {
-        merged.set(key, value);
-      }
-    }
-
+    const merged = mergeFetchHeaders(input, init);
     captureAndStripDevToolsHeader(merged);
     return customFetch(input, { ...init, headers: merged });
   };
@@ -2104,12 +2120,7 @@ export class ProviderModelFactory {
           input: Parameters<typeof fetch>[0],
           init?: Parameters<typeof fetch>[1]
         ) => {
-          const headers = new Headers(input instanceof Request ? input.headers : undefined);
-          if (init?.headers) {
-            for (const [key, value] of new Headers(init.headers).entries()) {
-              headers.set(key, value);
-            }
-          }
+          const headers = mergeFetchHeaders(input, init);
           headers.set("Authorization", `Bearer ${resolvedApiKey ?? ""}`);
           headers.set("Openai-Intent", "conversation-edits");
 
@@ -2312,12 +2323,7 @@ export class ProviderModelFactory {
           // bypassed by a check that passed before the await.
           assertCoderModelAllowedByPolicy();
 
-          const headers = new Headers(input instanceof Request ? input.headers : undefined);
-          if (init?.headers) {
-            for (const [key, value] of new Headers(init.headers).entries()) {
-              headers.set(key, value);
-            }
-          }
+          const headers = mergeFetchHeaders(input, init);
           headers.set("Authorization", `Bearer ${authResult.data.access}`);
           // The Anthropic SDK authenticates via x-api-key; the bridge reads the
           // Bearer token instead, so drop the placeholder key.

From 1938694d61a021f5624ac8ec885fe6da0cfe5d3e Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 16:24:34 +0000
Subject: [PATCH 52/94] refactor: dedupe unknown-to-record narrowing in
 PRStatusStore

#3840 (stack-aware PR indicator) added seven more copies of the
`typeof x !== "object" || x === null` guard followed by an
`x as Record<string, unknown>` cast, and re-inlined the `data.repository`
GraphQL descent that fetchMergeQueueEntry already had.

Extract two module-private helpers (matching the existing per-module
`isRecord` convention in stableStringify/toolOutputUiOnly/etc.) and route
all eleven sites through them. `asRecord` keeps the original semantics
exactly, including letting arrays through, so callers still reject them
via the field checks that follow.

Behavior-preserving; net -17 lines.
---
 src/browser/stores/PRStatusStore.ts | 91 ++++++++++++-----------------
 1 file changed, 37 insertions(+), 54 deletions(-)

diff --git a/src/browser/stores/PRStatusStore.ts b/src/browser/stores/PRStatusStore.ts
index ce7fc5938a..c2be1e1321 100644
--- a/src/browser/stores/PRStatusStore.ts
+++ b/src/browser/stores/PRStatusStore.ts
@@ -91,6 +91,25 @@ const prStatusLRU = createLRUCache<PersistedPRStatus>({
   // No TTL - we refresh on mount anyway, just want instant display
 });
 
+/**
+ * Narrows an untrusted `gh` JSON value to an indexable record.
+ *
+ * Every parser in this module walks raw CLI/GraphQL output field by field, so they all need the
+ * same "is this an object I can index into?" gate before reading properties. Arrays intentionally
+ * pass (they are `typeof "object"`); callers reject them via the field checks that follow.
+ */
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null ? (value as Record<string, unknown>) : null;
+}
+
+/**
+ * Descends into the `data.repository` envelope that wraps every `gh api graphql` response,
+ * returning the repository's selected fields, or null if either level is missing/not an object.
+ */
+function graphqlRepositoryFields(raw: unknown): Record<string, unknown> | null {
+  return asRecord(asRecord(asRecord(raw)?.data)?.repository);
+}
+
 function summarizeStatusCheckRollup(raw: unknown): {
   hasPendingChecks: boolean;
   hasFailedChecks: boolean;
@@ -103,11 +122,11 @@ function summarizeStatusCheckRollup(raw: unknown): {
   let hasFailedChecks = false;
 
   for (const item of raw) {
-    if (typeof item !== "object" || item === null) {
+    const record = asRecord(item);
+    if (!record) {
       continue;
     }
 
-    const record = item as Record<string, unknown>;
     const status = record.status;
     const conclusion = record.conclusion;
 
@@ -143,11 +162,11 @@ function summarizeStatusCheckRollup(raw: unknown): {
  * Parse merge queue entry data from GitHub GraphQL response payloads.
  */
 export function parseMergeQueueEntry(raw: unknown): MergeQueueEntry | null {
-  if (typeof raw !== "object" || raw === null) {
+  const record = asRecord(raw);
+  if (!record) {
     return null;
   }
 
-  const record = raw as Record<string, unknown>;
   const state = typeof record.state === "string" ? record.state : "QUEUED";
   const positionRaw = record.position;
   const position =
@@ -164,13 +183,8 @@ function isStackPRState(value: unknown): value is NonNullable<WorkspaceStackBran
 
 export function parseStackViewOutput(output: string): WorkspaceStackInfo | null {
   try {
-    const parsed = JSON.parse(output) as unknown;
-    if (typeof parsed !== "object" || parsed === null) {
-      return null;
-    }
-
-    const record = parsed as Record<string, unknown>;
-    if (record.no_stack === true || typeof record.trunk !== "string") {
+    const record = asRecord(JSON.parse(output) as unknown);
+    if (!record || record.no_stack === true || typeof record.trunk !== "string") {
       return null;
     }
     if (!Array.isArray(record.branches) || record.branches.length < 2) {
@@ -179,12 +193,9 @@ export function parseStackViewOutput(output: string): WorkspaceStackInfo | null
 
     const branches: WorkspaceStackBranch[] = [];
     for (const rawBranch of record.branches) {
-      if (typeof rawBranch !== "object" || rawBranch === null) {
-        return null;
-      }
-
-      const branchRecord = rawBranch as Record<string, unknown>;
+      const branchRecord = asRecord(rawBranch);
       if (
+        !branchRecord ||
         typeof branchRecord.name !== "string" ||
         typeof branchRecord.isCurrent !== "boolean" ||
         typeof branchRecord.isMerged !== "boolean" ||
@@ -196,12 +207,9 @@ export function parseStackViewOutput(output: string): WorkspaceStackInfo | null
 
       let pr: WorkspaceStackBranch["pr"];
       if (branchRecord.pr != null) {
-        if (typeof branchRecord.pr !== "object") {
-          return null;
-        }
-
-        const prRecord = branchRecord.pr as Record<string, unknown>;
+        const prRecord = asRecord(branchRecord.pr);
         if (
+          !prRecord ||
           typeof prRecord.number !== "number" ||
           !Number.isInteger(prRecord.number) ||
           prRecord.number <= 0 ||
@@ -241,21 +249,11 @@ export function mergeStackPullRequestMetadata(
   stack: WorkspaceStackInfo,
   raw: unknown
 ): WorkspaceStackInfo {
-  if (typeof raw !== "object" || raw === null) {
-    return stack;
-  }
-
-  const data = (raw as Record<string, unknown>).data;
-  if (typeof data !== "object" || data === null) {
+  const pullRequests = graphqlRepositoryFields(raw);
+  if (!pullRequests) {
     return stack;
   }
 
-  const repository = (data as Record<string, unknown>).repository;
-  if (typeof repository !== "object" || repository === null) {
-    return stack;
-  }
-
-  const pullRequests = repository as Record<string, unknown>;
   return {
     ...stack,
     branches: stack.branches.map((branch) => {
@@ -263,13 +261,8 @@ export function mergeStackPullRequestMetadata(
         return branch;
       }
 
-      const rawPullRequest = pullRequests[`p${branch.pr.number}`];
-      if (typeof rawPullRequest !== "object" || rawPullRequest === null) {
-        return branch;
-      }
-
-      const pullRequest = rawPullRequest as Record<string, unknown>;
-      if (pullRequest.number !== branch.pr.number) {
+      const pullRequest = asRecord(pullRequests[`p${branch.pr.number}`]);
+      if (!pullRequest || pullRequest.number !== branch.pr.number) {
         return branch;
       }
 
@@ -856,23 +849,13 @@ export class PRStatusStore {
         return null;
       }
 
-      const parsed = JSON.parse(result.data.output) as Record<string, unknown>;
-      const data = parsed.data;
-      if (typeof data !== "object" || data === null) {
-        return null;
-      }
-
-      const repository = (data as Record<string, unknown>).repository;
-      if (typeof repository !== "object" || repository === null) {
-        return null;
-      }
-
-      const pullRequest = (repository as Record<string, unknown>).pullRequest;
-      if (typeof pullRequest !== "object" || pullRequest === null) {
+      const repository = graphqlRepositoryFields(JSON.parse(result.data.output) as unknown);
+      const pullRequest = asRecord(repository?.pullRequest);
+      if (!pullRequest) {
         return null;
       }
 
-      return parseMergeQueueEntry((pullRequest as Record<string, unknown>).mergeQueueEntry);
+      return parseMergeQueueEntry(pullRequest.mergeQueueEntry);
     } catch {
       return null;
     }

From d50223a466a5aec7b3400216051c5236c506b714 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 20:21:10 +0000
Subject: [PATCH 53/94] refactor: dedupe native-xhigh label branches in
 getThinkingDisplayLabel

#3842 (Grok 4.6) added a second `level === "xhigh" && <predicate>` branch
returning "XHIGH", directly beside the existing Anthropic one. Both guards
are pure string/regex predicates and both branches return the same label,
so they collapse into one condition with an `||` chain. The two situational
comments merge into a single explanation of what the branch is for.

Behavior-preserving: short-circuit evaluation keeps the Anthropic check
first, and the fall-through to THINKING_DISPLAY_LABELS is unchanged.
---
 src/common/types/thinking.ts | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/common/types/thinking.ts b/src/common/types/thinking.ts
index 03af2c3cbf..66b1efd60d 100644
--- a/src/common/types/thinking.ts
+++ b/src/common/types/thinking.ts
@@ -45,11 +45,16 @@ export function getThinkingDisplayLabel(level: ThinkingLevel, modelString?: stri
       return "XHIGH";
     }
 
-    // Anthropic Opus 4.7+: xhigh is a distinct effort level from max
-    if (level === "xhigh" && anthropicSupportsNativeXhigh(modelString)) return "XHIGH";
-
-    // Grok 4.6: xhigh is a distinct native reasoning effort (its policy has no max).
-    if (level === "xhigh" && isGrok46Model(modelString)) return "XHIGH";
+    // Non-OpenAI models where xhigh is a distinct native effort rather than an
+    // alias for max: Anthropic Opus 4.7+ / Sonnet 5+ (max is a separate level)
+    // and Grok 4.6 (its thinking policy has no max at all). Everywhere else
+    // xhigh falls through to the shared "MAX" label below.
+    if (
+      level === "xhigh" &&
+      (anthropicSupportsNativeXhigh(modelString) || isGrok46Model(modelString))
+    ) {
+      return "XHIGH";
+    }
   }
   return THINKING_DISPLAY_LABELS[level];
 }

From c86507e10bc66877dc0dfdd1ab4be68592d61fe8 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 00:19:46 +0000
Subject: [PATCH 54/94] refactor: extract rebuild_native_module helper in
 postinstall.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The node-pty and DuckDB rebuild blocks were near-identical: same stamp-hit
short-circuit, same rebuild invocation, same non-fatal failure handler, same
three log lines — differing only in label, module path, and stamp file.
Collapsed both into a rebuild_native_module() helper.

Behavior-preserving: verified with a differential harness that runs the old
and new scripts against identical fake node_modules trees across 11 scenarios
(cold/warm stamps, each module alone, neither module, no electron, headless,
dependency install, rebuild failure, missing npx/bunx). Output and resulting
stamp files were byte-identical in every case.
---
 scripts/postinstall.sh | 55 +++++++++++++++++++++---------------------
 1 file changed, 27 insertions(+), 28 deletions(-)

diff --git a/scripts/postinstall.sh b/scripts/postinstall.sh
index e9e92902d5..193becf4dc 100755
--- a/scripts/postinstall.sh
+++ b/scripts/postinstall.sh
@@ -81,40 +81,39 @@ else
   exit 0
 fi
 
-# 6) Rebuild node-pty (once per version/platform)
-if [ "$HAS_NODE_PTY" = "1" ]; then
-  if [ -f "$NODE_PTY_STAMP_FILE" ]; then
-    echo "✅ node-pty already rebuilt for Electron ${ELECTRON_VERSION} on ${PLATFORM}/${ARCH} – skipping"
-  else
-    echo "🔧 Rebuilding node-pty for Electron ${ELECTRON_VERSION} on ${PLATFORM}/${ARCH}..."
-    $REBUILD_CMD @electron/rebuild -f -m node_modules/node-pty || {
-      echo "⚠️  Failed to rebuild native modules"
-      echo "   Terminal functionality may not work in desktop mode."
-      echo "   Run 'make rebuild-native' manually to fix."
-      exit 0
-    }
-    touch "$NODE_PTY_STAMP_FILE"
-    echo "✅ node-pty rebuilt successfully (cached at $NODE_PTY_STAMP_FILE)"
+# 6) Rebuild one native module for Electron's ABI, skipping when its stamp exists.
+# A rebuild failure is non-fatal (desktop terminal/DB features degrade, install succeeds),
+# so the failure path exits the whole script with 0 rather than returning to the caller.
+rebuild_native_module() {
+  label="$1"
+  module_path="$2"
+  stamp_file="$3"
+
+  if [ -f "$stamp_file" ]; then
+    echo "✅ ${label} already rebuilt for Electron ${ELECTRON_VERSION} on ${PLATFORM}/${ARCH} – skipping"
+    return 0
   fi
+
+  echo "🔧 Rebuilding ${label} for Electron ${ELECTRON_VERSION} on ${PLATFORM}/${ARCH}..."
+  $REBUILD_CMD @electron/rebuild -f -m "$module_path" || {
+    echo "⚠️  Failed to rebuild native modules"
+    echo "   Terminal functionality may not work in desktop mode."
+    echo "   Run 'make rebuild-native' manually to fix."
+    exit 0
+  }
+  touch "$stamp_file"
+  echo "✅ ${label} rebuilt successfully (cached at $stamp_file)"
+}
+
+# 7) Rebuild native modules (once per version/platform)
+if [ "$HAS_NODE_PTY" = "1" ]; then
+  rebuild_native_module "node-pty" "node_modules/node-pty" "$NODE_PTY_STAMP_FILE"
 else
   echo "ℹ️  node-pty package missing – skipping node-pty rebuild"
 fi
 
-# 7) Rebuild DuckDB (once per version/platform)
 if [ "$HAS_DUCKDB" = "1" ]; then
-  if [ -f "$DUCKDB_STAMP_FILE" ]; then
-    echo "✅ DuckDB already rebuilt for Electron ${ELECTRON_VERSION} on ${PLATFORM}/${ARCH} – skipping"
-  else
-    echo "🔧 Rebuilding DuckDB for Electron ${ELECTRON_VERSION} on ${PLATFORM}/${ARCH}..."
-    $REBUILD_CMD @electron/rebuild -f -m node_modules/@duckdb/node-bindings || {
-      echo "⚠️  Failed to rebuild native modules"
-      echo "   Terminal functionality may not work in desktop mode."
-      echo "   Run 'make rebuild-native' manually to fix."
-      exit 0
-    }
-    touch "$DUCKDB_STAMP_FILE"
-    echo "✅ DuckDB rebuilt successfully (cached at $DUCKDB_STAMP_FILE)"
-  fi
+  rebuild_native_module "DuckDB" "node_modules/@duckdb/node-bindings" "$DUCKDB_STAMP_FILE"
 else
   echo "ℹ️  DuckDB packages missing – skipping DuckDB rebuild"
 fi

From 40f3441aacc7951b4ba10181dfd3b2ce7fafb581 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 20:18:08 +0000
Subject: [PATCH 55/94] refactor: dedupe Gemini Flash thinking-level tier
 prefixes

isGeminiFlashThinkingLevelModelName grew one near-identical
startsWith(tier) && !startsWith(tier + "-lite") clause per Flash release
(3.5, 3.6, and now 3.7 in #3845). Collapse the dotted tiers into a
prefix list plus a shared matcher so the next repoint is a one-line
addition. The dashless gemini-3-flash tier keeps its stricter
exact-or-dash boundary check and stays spelled out.

Behavior-preserving: verified against the previous implementation over
200k generated model IDs with zero mismatches.
---
 src/common/utils/thinking/policy.ts | 35 +++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/src/common/utils/thinking/policy.ts b/src/common/utils/thinking/policy.ts
index 808c48b230..848dba0f43 100644
--- a/src/common/utils/thinking/policy.ts
+++ b/src/common/utils/thinking/policy.ts
@@ -37,6 +37,24 @@ import { normalizeSelectedModel, normalizeToCanonical } from "@/common/utils/ai/
  */
 export type ThinkingPolicy = readonly ThinkingLevel[];
 
+/**
+ * Dotted Gemini Flash tiers that use Google's thinkingLevel config. Matching is
+ * prefix-based so version suffixes (`-001`, `-latest`, `-preview-…`) are covered;
+ * each tier's `-lite` sibling still uses thinkingBudget and is excluded.
+ *
+ * Every Flash release repoints the `gemini-flash` alias, so keep new tiers as a
+ * one-line addition here instead of another copy of the prefix/`-lite` pair.
+ */
+const GEMINI_FLASH_THINKING_LEVEL_TIERS = [
+  "gemini-3.5-flash",
+  "gemini-3.6-flash",
+  "gemini-3.7-flash",
+] as const;
+
+function matchesFlashTierExcludingLite(normalized: string, tier: string): boolean {
+  return normalized.startsWith(tier) && !normalized.startsWith(`${tier}-lite`);
+}
+
 /**
  * True when modelName is a bare Gemini Flash chat model ID using Google's
  * thinkingLevel config (minimal/low/medium/high) instead of Gemini 2.x thinkingBudget.
@@ -44,14 +62,17 @@ export type ThinkingPolicy = readonly ThinkingLevel[];
  */
 export function isGeminiFlashThinkingLevelModelName(modelName: string): boolean {
   const normalized = modelName.trim().toLowerCase();
+  // The dashless `gemini-3-flash` tier keeps a stricter boundary check (exact ID or a
+  // dash-delimited suffix such as `gemini-3-flash-preview-20251217`) rather than the
+  // plain prefix match the dotted tiers use, so it stays spelled out here.
+  const isGemini3FlashTier =
+    (normalized === "gemini-3-flash" || normalized.startsWith("gemini-3-flash-")) &&
+    !normalized.startsWith("gemini-3-flash-lite");
   return (
-    ((normalized === "gemini-3-flash" || normalized.startsWith("gemini-3-flash-")) &&
-      !normalized.startsWith("gemini-3-flash-lite")) ||
-    (normalized.startsWith("gemini-3.5-flash") &&
-      !normalized.startsWith("gemini-3.5-flash-lite")) ||
-    (normalized.startsWith("gemini-3.6-flash") &&
-      !normalized.startsWith("gemini-3.6-flash-lite")) ||
-    (normalized.startsWith("gemini-3.7-flash") && !normalized.startsWith("gemini-3.7-flash-lite"))
+    isGemini3FlashTier ||
+    GEMINI_FLASH_THINKING_LEVEL_TIERS.some((tier) =>
+      matchesFlashTierExcludingLite(normalized, tier)
+    )
   );
 }
 

From 1b1247fd691f43a9ef6ba1d0eac9e1d141f9b13d Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:18:33 +0000
Subject: [PATCH 56/94] refactor: dedupe the task-group running-work predicate

`TaskGroupListItem` computed `props.isRunActive === true || props.runningCount > 0`
twice: once inside `getAggregateVisualState` to decide the "active" status-dot
state, and once as the `hasRunningWork` local that drives `data-running`, the
green kind icon, and the brighter title text. Extracted a module-level
`groupHasRunningWork(props)` predicate and routed both sites through it so the
status dot and the running-state text/icon treatment cannot drift apart.

Behavior-preserving: identical expression, same call sites, no control-flow change.
---
 .../components/ProjectSidebar/TaskGroupListItem.tsx | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/browser/components/ProjectSidebar/TaskGroupListItem.tsx b/src/browser/components/ProjectSidebar/TaskGroupListItem.tsx
index f81cf22ec6..82f4928e65 100644
--- a/src/browser/components/ProjectSidebar/TaskGroupListItem.tsx
+++ b/src/browser/components/ProjectSidebar/TaskGroupListItem.tsx
@@ -28,6 +28,15 @@ interface TaskGroupListItemProps {
   onToggle: () => void;
 }
 
+/**
+ * A group is "working" when the workflow run itself is active or any member is
+ * still running. Both the aggregate status dot and the running-state icon/title
+ * treatment key off this predicate, so they cannot drift apart.
+ */
+function groupHasRunningWork(props: TaskGroupListItemProps): boolean {
+  return props.isRunActive === true || props.runningCount > 0;
+}
+
 /**
  * Aggregate member state in the same visual language as agent rows. Running
  * wins over interrupted: while any member still works the group is making
@@ -35,7 +44,7 @@ interface TaskGroupListItemProps {
  * running anymore.
  */
 function getAggregateVisualState(props: TaskGroupListItemProps): VisualState {
-  if (props.isRunActive === true || props.runningCount > 0) {
+  if (groupHasRunningWork(props)) {
     return "active";
   }
   if (props.interruptedCount > 0) {
@@ -45,7 +54,7 @@ function getAggregateVisualState(props: TaskGroupListItemProps): VisualState {
 }
 
 export function TaskGroupListItem(props: TaskGroupListItemProps) {
-  const hasRunningWork = props.isRunActive === true || props.runningCount > 0;
+  const hasRunningWork = groupHasRunningWork(props);
   const aggregateState = getAggregateVisualState(props);
   const statusDescriptionId = `task-group-status-${props.groupId}`;
   const paddingLeft = getSidebarItemPaddingLeft(props.depth);

From 0489337043ec06d40c35a0596e1ae53b5510acb6 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 12:20:26 +0000
Subject: [PATCH 57/94] refactor: dedupe plural-suffix logic in sidebar
 activity labels

The sidebar activity formatters repeated the same `count === 1 ? "" : "s"`
ternary at three call sites. Extract a local `pluralSuffix` helper so the
pluralization rule lives in one place. Behavior-preserving.
---
 src/browser/components/AgentListItem/AgentListItem.tsx | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/browser/components/AgentListItem/AgentListItem.tsx b/src/browser/components/AgentListItem/AgentListItem.tsx
index 3b3cea3fb2..d23f9c5f41 100644
--- a/src/browser/components/AgentListItem/AgentListItem.tsx
+++ b/src/browser/components/AgentListItem/AgentListItem.tsx
@@ -218,8 +218,13 @@ function HeartbeatFallbackIcon() {
   );
 }
 
+/** Plural "s" for the sidebar activity counts, which are all regular nouns. */
+function pluralSuffix(count: number): string {
+  return count === 1 ? "" : "s";
+}
+
 function formatSubAgentCount(count: number, label: "active" | "queued"): string {
-  return `${count} sub-agent${count === 1 ? "" : "s"} ${label}`;
+  return `${count} sub-agent${pluralSuffix(count)} ${label}`;
 }
 
 function formatDelegatedActivityText(activity: WorkspaceDelegatedActivity): string | null {
@@ -295,8 +300,7 @@ function formatHiddenSubAgentsPresentation(
         ? summary.runningWorkflowAgentCount
         : summary.queuedWorkflowAgentCount;
       // Gap-only runs have no countable workers; skip the "(0 agents)" noise.
-      const agentSuffix =
-        agentCount > 0 ? ` (${agentCount} agent${agentCount === 1 ? "" : "s"})` : "";
+      const agentSuffix = agentCount > 0 ? ` (${agentCount} agent${pluralSuffix(agentCount)})` : "";
       const queuedSuffix =
         hasRunningRun && summary.queuedWorkflowAgentCount > 0
           ? ` · ${summary.queuedWorkflowAgentCount} queued`

From bcfcc57914b6a7bc2a70d16f6394a074d313a981 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 20:12:58 +0000
Subject: [PATCH 58/94] refactor: extract splitCoderGatewayModelId helper

#3844 (generalize Coder AI Gateway to arbitrary provider instances) left
resolveCoderWireCanonicalModel and resolveCoderMetadataCanonicalModel each
inlining a byte-identical prelude: the `<instance>/<model>` separator scan,
the empty-half guard, the resolveCoderGatewayProvider lookup over both
parsed provider lists, and the null-provider guard.

Extract it into a module-private splitCoderGatewayModelId helper returning
{ provider, modelId }. Behavior-preserving: identical guards in identical
order, same null outcomes, same instance-stripped model ID.

Auto-cleanup checkpoint: f3a1cba2cc5201bdd90e40deb38e13e288330574
---
 src/common/constants/coderOAuth.ts | 59 ++++++++++++++++++------------
 1 file changed, 35 insertions(+), 24 deletions(-)

diff --git a/src/common/constants/coderOAuth.ts b/src/common/constants/coderOAuth.ts
index 21aff7ec31..36df22f3ea 100644
--- a/src/common/constants/coderOAuth.ts
+++ b/src/common/constants/coderOAuth.ts
@@ -125,19 +125,17 @@ export function parseCoderGatewayProviders(value: unknown): CoderGatewayProvider
 }
 
 /**
- * Wire-canonical identity for a Coder gateway model ID that stayed
- * gateway-scoped (custom-named instance, or an instance whose name is not a
- * canonical coder route): the origin whose payload/options/header format the
- * request will actually speak, plus the instance-stripped model ID.
- * Thinking/cache/beta-header builders must target the WIRE, not the "coder"
- * gateway prefix — otherwise a coder:prod-anthropic/<model> request silently
- * drops the thinking and context options a coder:anthropic/<model> request
- * would carry. Returns null when the instance is unknown or unsupported.
+ * Split a gateway-scoped `<instance>/<model>` ID into the gateway provider it
+ * addresses and the instance-stripped model ID. Returns null when the ID is
+ * not `<instance>/<model>` shaped (no separator, or an empty instance/model
+ * half) or when the instance resolves to no known provider — the same
+ * "cannot know the upstream" outcome both canonical-identity resolvers below
+ * report to their callers.
  */
-export function resolveCoderWireCanonicalModel(
+function splitCoderGatewayModelId(
   gatewayModelId: string,
   metadata?: { discoveredProviders?: unknown; additionalProviders?: unknown }
-): { origin: "anthropic" | "openai"; modelId: string; providerType: string } | null {
+): { provider: CoderGatewayProvider; modelId: string } | null {
   const separatorIndex = gatewayModelId.indexOf("/");
   if (separatorIndex <= 0 || separatorIndex === gatewayModelId.length - 1) {
     return null;
@@ -150,17 +148,38 @@ export function resolveCoderWireCanonicalModel(
   if (!provider) {
     return null;
   }
-  const wire = coderGatewayWireProtocol(provider.type);
+  return { provider, modelId: gatewayModelId.slice(separatorIndex + 1) };
+}
+
+/**
+ * Wire-canonical identity for a Coder gateway model ID that stayed
+ * gateway-scoped (custom-named instance, or an instance whose name is not a
+ * canonical coder route): the origin whose payload/options/header format the
+ * request will actually speak, plus the instance-stripped model ID.
+ * Thinking/cache/beta-header builders must target the WIRE, not the "coder"
+ * gateway prefix — otherwise a coder:prod-anthropic/<model> request silently
+ * drops the thinking and context options a coder:anthropic/<model> request
+ * would carry. Returns null when the instance is unknown or unsupported.
+ */
+export function resolveCoderWireCanonicalModel(
+  gatewayModelId: string,
+  metadata?: { discoveredProviders?: unknown; additionalProviders?: unknown }
+): { origin: "anthropic" | "openai"; modelId: string; providerType: string } | null {
+  const gatewayModel = splitCoderGatewayModelId(gatewayModelId, metadata);
+  if (!gatewayModel) {
+    return null;
+  }
+  const wire = coderGatewayWireProtocol(gatewayModel.provider.type);
   if (!wire) {
     return null;
   }
   return {
     origin: wire === "anthropic" ? "anthropic" : "openai",
-    modelId: gatewayModelId.slice(separatorIndex + 1),
+    modelId: gatewayModel.modelId,
     // The instance's exact type: origin collapses every OpenAI-shaped wire
     // to "openai", but some config is upstream-specific (e.g. the OpenAI ZDR
     // store flag applies to the real OpenAI Responses upstream only).
-    providerType: provider.type,
+    providerType: gatewayModel.provider.type,
   };
 }
 
@@ -179,19 +198,11 @@ export function resolveCoderMetadataCanonicalModel(
   gatewayModelId: string,
   metadata?: { discoveredProviders?: unknown; additionalProviders?: unknown }
 ): string | null {
-  const separatorIndex = gatewayModelId.indexOf("/");
-  if (separatorIndex <= 0 || separatorIndex === gatewayModelId.length - 1) {
-    return null;
-  }
-  const provider = resolveCoderGatewayProvider(
-    gatewayModelId.slice(0, separatorIndex),
-    parseCoderGatewayProviders(metadata?.discoveredProviders),
-    parseCoderGatewayProviders(metadata?.additionalProviders)
-  );
-  if (!provider) {
+  const gatewayModel = splitCoderGatewayModelId(gatewayModelId, metadata);
+  if (!gatewayModel) {
     return null;
   }
-  const modelId = gatewayModelId.slice(separatorIndex + 1);
+  const { provider, modelId } = gatewayModel;
   switch (provider.type) {
     case "anthropic":
     case "openai":

From ecfb1e1d87097e407b8eb18ce0ce405a88b9a37e Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 16 Aug 2026 00:35:43 +0000
Subject: [PATCH 59/94] refactor: dedupe timeline rule-vs-event row dispatch

Both the flat day list and an expanded machinery group branched on
isRuleKind() to choose between TimelineRuleRow and TimelineEventRow with
byte-identical props. Extract a TimelineRow dispatcher and route both
call sites through it.

Behavior-preserving: same components, same props, same keys.
---
 .../RightSidebar/Timeline/TimelinePanel.tsx   | 52 +++++++++----------
 1 file changed, 24 insertions(+), 28 deletions(-)

diff --git a/src/browser/features/RightSidebar/Timeline/TimelinePanel.tsx b/src/browser/features/RightSidebar/Timeline/TimelinePanel.tsx
index 2579111d74..2989ec949d 100644
--- a/src/browser/features/RightSidebar/Timeline/TimelinePanel.tsx
+++ b/src/browser/features/RightSidebar/Timeline/TimelinePanel.tsx
@@ -472,6 +472,21 @@ function TimelineEventRow(props: {
   );
 }
 
+// Rules and events render as different rows but take identical props, so both the flat day list and
+// an expanded machinery group (which mixes absorbed rules into its events) route through one
+// dispatcher instead of repeating the branch at each call site.
+function TimelineRow(props: {
+  event: TimelineEvent;
+  selected: boolean;
+  onSelect: (eventId: string) => void;
+}) {
+  return isRuleKind(getTimelineEventKind(props.event)) ? (
+    <TimelineRuleRow {...props} />
+  ) : (
+    <TimelineEventRow {...props} />
+  );
+}
+
 function CollapsedEventRun(props: {
   run: CollapsedRun;
   expanded: boolean;
@@ -502,23 +517,14 @@ function CollapsedEventRun(props: {
           <span className="counter-nums shrink-0">{counted.length}</span>
           <span className="min-w-0 truncate">{label} events</span>
         </button>
-        {props.run.events.map((event) =>
-          isRuleKind(getTimelineEventKind(event)) ? (
-            <TimelineRuleRow
-              key={event.id}
-              event={event}
-              selected={props.selectedEventId === event.id}
-              onSelect={props.onSelect}
-            />
-          ) : (
-            <TimelineEventRow
-              key={event.id}
-              event={event}
-              selected={props.selectedEventId === event.id}
-              onSelect={props.onSelect}
-            />
-          )
-        )}
+        {props.run.events.map((event) => (
+          <TimelineRow
+            key={event.id}
+            event={event}
+            selected={props.selectedEventId === event.id}
+            onSelect={props.onSelect}
+          />
+        ))}
       </div>
     );
   }
@@ -881,18 +887,8 @@ export function TimelinePanelView(props: TimelinePanelViewProps) {
                         />
                       );
                     }
-                    if (isRuleKind(getTimelineEventKind(item))) {
-                      return (
-                        <TimelineRuleRow
-                          key={item.id}
-                          event={item}
-                          selected={selectedEventId === item.id}
-                          onSelect={setSelectedEventId}
-                        />
-                      );
-                    }
                     return (
-                      <TimelineEventRow
+                      <TimelineRow
                         key={item.id}
                         event={item}
                         selected={selectedEventId === item.id}

From a88d7fe1b18adf1ee7ec19261eaf7bab9374ae59 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 16 Aug 2026 12:12:09 +0000
Subject: [PATCH 60/94] refactor: extract buildCommandReplacement for slash
 suggestion trailing space

---
 .../utils/slashCommands/suggestions.ts        | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/browser/utils/slashCommands/suggestions.ts b/src/browser/utils/slashCommands/suggestions.ts
index 5d5545124c..13bf7c8835 100644
--- a/src/browser/utils/slashCommands/suggestions.ts
+++ b/src/browser/utils/slashCommands/suggestions.ts
@@ -32,6 +32,15 @@ function filterAndMapSuggestions<T extends SuggestionDefinition>(
     .map((definition) => build(definition));
 }
 
+/**
+ * Command replacements end in a space so the caret lands where arguments go; a definition opts out
+ * with `appendSpace: false` when the command is complete on its own.
+ */
+function buildCommandReplacement(base: string, definition: SuggestionDefinition): string {
+  const appendSpace = definition.appendSpace ?? true;
+  return `${base}${appendSpace ? " " : ""}`;
+}
+
 function buildTopLevelSuggestions(
   partial: string,
   context: SlashSuggestionContext
@@ -40,13 +49,12 @@ function buildTopLevelSuggestions(
     COMMAND_DEFINITIONS,
     partial,
     (definition) => {
-      const appendSpace = definition.appendSpace ?? true;
-      const replacement = `/${definition.key}${appendSpace ? " " : ""}`;
+      const display = `/${definition.key}`;
       return {
         id: `command:${definition.key}`,
-        display: `/${definition.key}`,
+        display,
         description: definition.description,
-        replacement,
+        replacement: buildCommandReplacement(display, definition),
       };
     },
     (definition) => isSlashCommandVisible(definition, context)
@@ -165,14 +173,13 @@ function buildSubcommandSuggestions(
     subcommands,
     partial,
     (definition) => {
-      const appendSpace = definition.appendSpace ?? true;
       const replacementTokens = [...prefixTokens, definition.key];
       const replacementBase = `/${replacementTokens.join(" ")}`;
       return {
         id: `command:${replacementTokens.join(":")}`,
         display: definition.key,
         description: definition.description,
-        replacement: `${replacementBase}${appendSpace ? " " : ""}`,
+        replacement: buildCommandReplacement(replacementBase, definition),
       };
     },
     (definition) => isSlashCommandVisible(definition, context)

From 64fa271d2751e63aaab372581269b5ad1a8b6706 Mon Sep 17 00:00:00 2001
From: mux <mux@coder.com>
Date: Sun, 16 Aug 2026 20:14:25 +0000
Subject: [PATCH 61/94] refactor: dedupe the pending patch-artifact seed in
 generate()

Four writers in GitPatchArtifactService.generate() built the same
"existing artifact, or a freshly seeded pending one" expression inline:
the three workspace-shape guards (path/runtimeConfig/name missing) and
ensureProjectArtifact. All four copies were byte-identical.

Extract seedPendingArtifact(existing) plus failGeneration(error), which
collapses each guard from a 20-line updateArtifact call to one line.
The `??` short-circuit is preserved, so buildPendingProjectArtifacts is
still only evaluated when no artifact has been persisted yet.

The `!entry` guard and the outer catch keep their inline empty-project
seeds: neither has a workspace entry in scope to enumerate projects from.
---
 src/node/services/gitPatchArtifactService.ts | 107 +++++++------------
 1 file changed, 36 insertions(+), 71 deletions(-)

diff --git a/src/node/services/gitPatchArtifactService.ts b/src/node/services/gitPatchArtifactService.ts
index fc4967cf48..d73c6ee32c 100644
--- a/src/node/services/gitPatchArtifactService.ts
+++ b/src/node/services/gitPatchArtifactService.ts
@@ -586,78 +586,56 @@ export class GitPatchArtifactService {
 
       const ws = entry.workspace;
 
-      const workspacePath = coerceNonEmptyString(ws.path);
-      if (!workspacePath) {
+      // Once the workspace entry is known, every writer below seeds the same
+      // pending artifact when none has been persisted yet: one pending entry
+      // per project repo in the task workspace. The `!entry` path above cannot
+      // use this because it has no workspace to enumerate projects from, and
+      // the outer catch seeds an empty list for the same reason.
+      const seedPendingArtifact = (
+        existing: SubagentGitPatchArtifact | null
+      ): SubagentGitPatchArtifact =>
+        existing ??
+        buildPendingPatchArtifact({
+          childTaskId: childWorkspaceId,
+          parentWorkspaceId,
+          createdAtMs: nowMs,
+          updatedAtMs: nowMs,
+          projectArtifacts: buildPendingProjectArtifacts({
+            projectPath: entry.projectPath,
+            projects: ws.projects,
+            taskBaseCommitSha: coerceNonEmptyString(ws.taskBaseCommitSha) ?? undefined,
+            taskBaseCommitShaByProjectPath: ws.taskBaseCommitShaByProjectPath,
+          }),
+        });
+
+      // Marks every still-pending project artifact failed with the same reason.
+      // Used by the workspace-shape guards below, which cannot proceed to
+      // per-project patch generation at all.
+      const failGeneration = async (error: string): Promise<void> => {
         await updateArtifact((existing) =>
           failPendingProjectArtifacts({
-            artifact:
-              existing ??
-              buildPendingPatchArtifact({
-                childTaskId: childWorkspaceId,
-                parentWorkspaceId,
-                createdAtMs: nowMs,
-                updatedAtMs: nowMs,
-                projectArtifacts: buildPendingProjectArtifacts({
-                  projectPath: entry.projectPath,
-                  projects: ws.projects,
-                  taskBaseCommitSha: coerceNonEmptyString(ws.taskBaseCommitSha) ?? undefined,
-                  taskBaseCommitShaByProjectPath: ws.taskBaseCommitShaByProjectPath,
-                }),
-              }),
-            error: "Task workspace path missing.",
+            artifact: seedPendingArtifact(existing),
+            error,
             updatedAtMs: nowMs,
           })
         );
+      };
+
+      const workspacePath = coerceNonEmptyString(ws.path);
+      if (!workspacePath) {
+        await failGeneration("Task workspace path missing.");
         return;
       }
 
       if (!ws.runtimeConfig) {
-        await updateArtifact((existing) =>
-          failPendingProjectArtifacts({
-            artifact:
-              existing ??
-              buildPendingPatchArtifact({
-                childTaskId: childWorkspaceId,
-                parentWorkspaceId,
-                createdAtMs: nowMs,
-                updatedAtMs: nowMs,
-                projectArtifacts: buildPendingProjectArtifacts({
-                  projectPath: entry.projectPath,
-                  projects: ws.projects,
-                  taskBaseCommitSha: coerceNonEmptyString(ws.taskBaseCommitSha) ?? undefined,
-                  taskBaseCommitShaByProjectPath: ws.taskBaseCommitShaByProjectPath,
-                }),
-              }),
-            error: "Task runtimeConfig missing.",
-            updatedAtMs: nowMs,
-          })
-        );
+        await failGeneration("Task runtimeConfig missing.");
         return;
       }
 
       const fallbackName = workspacePath.split("/").pop() ?? workspacePath.split("\\").pop() ?? "";
       const workspaceName = coerceNonEmptyString(ws.name) ?? coerceNonEmptyString(fallbackName);
       if (!workspaceName) {
-        await updateArtifact((existing) =>
-          failPendingProjectArtifacts({
-            artifact:
-              existing ??
-              buildPendingPatchArtifact({
-                childTaskId: childWorkspaceId,
-                parentWorkspaceId,
-                createdAtMs: nowMs,
-                updatedAtMs: nowMs,
-                projectArtifacts: buildPendingProjectArtifacts({
-                  projectPath: entry.projectPath,
-                  projects: ws.projects,
-                  taskBaseCommitSha: coerceNonEmptyString(ws.taskBaseCommitSha) ?? undefined,
-                  taskBaseCommitShaByProjectPath: ws.taskBaseCommitShaByProjectPath,
-                }),
-              }),
-            error: "Task workspace name missing.",
-            updatedAtMs: nowMs,
-          })
-        );
+        await failGeneration("Task workspace name missing.");
         return;
       }
 
@@ -692,20 +670,7 @@ export class GitPatchArtifactService {
         nextProjectArtifact: SubagentGitProjectPatchArtifact
       ): Promise<void> => {
         await updateArtifact((existing) => {
-          const pendingArtifact =
-            existing ??
-            buildPendingPatchArtifact({
-              childTaskId: childWorkspaceId,
-              parentWorkspaceId,
-              createdAtMs: nowMs,
-              updatedAtMs: nowMs,
-              projectArtifacts: buildPendingProjectArtifacts({
-                projectPath: entry.projectPath,
-                projects: ws.projects,
-                taskBaseCommitSha: coerceNonEmptyString(ws.taskBaseCommitSha) ?? undefined,
-                taskBaseCommitShaByProjectPath: ws.taskBaseCommitShaByProjectPath,
-              }),
-            });
+          const pendingArtifact = seedPendingArtifact(existing);
           return upsertProjectArtifact({
             artifact: pendingArtifact,
             nextProjectArtifact,

From 4fb9d4917eaf00ea70262e8dcad591ebf0613a74 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 20:12:45 +0000
Subject: [PATCH 62/94] refactor: dedupe blob content-address computation in
 BlobStore

put() and get() each inlined the identical sha256 digest + `sha256:` prefix
construction to derive a blob's content address. Extracted into a module-level
blobRefFor() helper so both paths derive the ref through one expression.
---
 src/node/utils/journal/blobStore.ts | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/node/utils/journal/blobStore.ts b/src/node/utils/journal/blobStore.ts
index 633108eb25..14357983af 100644
--- a/src/node/utils/journal/blobStore.ts
+++ b/src/node/utils/journal/blobStore.ts
@@ -20,6 +20,16 @@ import type { BlobRef } from "@/common/types/durableEvent";
 import { BlobRefSchema } from "@/common/types/durableEvent";
 import { log } from "@/node/services/log";
 
+/**
+ * The content address (BlobRef) naming a buffer's bytes. put() uses it to name
+ * new content and get() uses it to verify bytes read back, and the two MUST
+ * derive it identically or a freshly written blob would fail its own hash
+ * check — so the digest and the `sha256:` prefix live in one place.
+ */
+function blobRefFor(content: Buffer): BlobRef {
+  return `sha256:${crypto.createHash("sha256").update(content).digest("hex")}`;
+}
+
 export class BlobStore {
   constructor(private readonly dir: string) {
     assert(dir.length > 0, "BlobStore requires a directory");
@@ -37,8 +47,7 @@ export class BlobStore {
   ): Promise<{ ref: BlobRef; size: number; created: boolean }> {
     const buffer =
       typeof content === "string" ? Buffer.from(content, "utf-8") : Buffer.from(content);
-    const hash = crypto.createHash("sha256").update(buffer).digest("hex");
-    const ref: BlobRef = `sha256:${hash}`;
+    const ref = blobRefFor(buffer);
     const blobPath = this.pathFor(ref);
 
     let existed = false;
@@ -80,8 +89,7 @@ export class BlobStore {
       }
       throw error;
     }
-    const hash = crypto.createHash("sha256").update(buffer).digest("hex");
-    if (`sha256:${hash}` !== ref) {
+    if (blobRefFor(buffer) !== ref) {
       log.warn(`BlobStore: hash mismatch for ${ref} (corrupted blob); treating as missing`);
       return null;
     }

From e0817aa36417f97333b178866e506aa252b3964f Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 00:33:02 +0000
Subject: [PATCH 63/94] refactor: dedupe sub-agent status presentations into
 one table

The taskExecutionStatus and taskStatus switches each carried their own copies of the Queued/Running/Completed/Interrupted presentation literals, so a label or icon class could drift between the two paths. Both now read from a single outcome-keyed table.
---
 .../SubAgentTasksDecoration.tsx               | 53 ++++++++++++-------
 1 file changed, 35 insertions(+), 18 deletions(-)

diff --git a/src/browser/components/SubAgentTasksDecoration/SubAgentTasksDecoration.tsx b/src/browser/components/SubAgentTasksDecoration/SubAgentTasksDecoration.tsx
index cc2a64cf2f..3a22b2dc76 100644
--- a/src/browser/components/SubAgentTasksDecoration/SubAgentTasksDecoration.tsx
+++ b/src/browser/components/SubAgentTasksDecoration/SubAgentTasksDecoration.tsx
@@ -221,46 +221,63 @@ export function mergeActiveWorkflowGroups(
   return merged;
 }
 
-export function getSubAgentStatusPresentation(workspace: FrontendWorkspaceMetadata): {
+interface SubAgentStatusPresentation {
   label: string;
   icon: typeof Clock3;
   iconClassName: string;
-} {
+}
+
+/**
+ * Presentations are keyed by outcome rather than by status because the two status sources below
+ * (taskExecutionStatus for a reawakened run, taskStatus for the retained base report) map several
+ * distinct statuses onto the same outcome. Keeping one table avoids the duplicated object literals
+ * the two switches used to carry, where a label or class could silently drift between them.
+ */
+const SUB_AGENT_STATUS_PRESENTATIONS = {
+  queued: { label: "Queued", icon: Clock3, iconClassName: "text-muted" },
+  starting: { label: "Starting", icon: LoaderCircle, iconClassName: "text-warning animate-spin" },
+  running: { label: "Running", icon: LoaderCircle, iconClassName: "text-success animate-spin" },
+  finishing: { label: "Finishing", icon: LoaderCircle, iconClassName: "text-warning animate-spin" },
+  completed: { label: "Completed", icon: CheckCircle2, iconClassName: "text-success" },
+  interrupted: { label: "Interrupted", icon: CircleSlash2, iconClassName: "text-muted" },
+  failed: { label: "Failed", icon: CircleX, iconClassName: "text-danger" },
+  inactive: { label: "Inactive", icon: CheckCircle2, iconClassName: "text-muted" },
+} satisfies Record<string, SubAgentStatusPresentation>;
+
+export function getSubAgentStatusPresentation(
+  workspace: FrontendWorkspaceMetadata
+): SubAgentStatusPresentation {
   // No execution status (never-reawakened sub-agent) falls through to taskStatus.
   if (workspace.taskExecutionStatus !== undefined) {
     switch (workspace.taskExecutionStatus) {
       case "queued":
-        return { label: "Queued", icon: Clock3, iconClassName: "text-muted" };
+        return SUB_AGENT_STATUS_PRESENTATIONS.queued;
       case "starting":
       case "running":
-        return {
-          label: "Running",
-          icon: LoaderCircle,
-          iconClassName: "text-success animate-spin",
-        };
+        return SUB_AGENT_STATUS_PRESENTATIONS.running;
       case "completed":
-        return { label: "Completed", icon: CheckCircle2, iconClassName: "text-success" };
+        return SUB_AGENT_STATUS_PRESENTATIONS.completed;
       case "interrupted":
-        return { label: "Interrupted", icon: CircleSlash2, iconClassName: "text-muted" };
+        return SUB_AGENT_STATUS_PRESENTATIONS.interrupted;
       case "error":
-        return { label: "Failed", icon: CircleX, iconClassName: "text-danger" };
+        return SUB_AGENT_STATUS_PRESENTATIONS.failed;
     }
   }
   switch (workspace.taskStatus) {
     case "queued":
-      return { label: "Queued", icon: Clock3, iconClassName: "text-muted" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.queued;
     case "starting":
-      return { label: "Starting", icon: LoaderCircle, iconClassName: "text-warning animate-spin" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.starting;
     case "running":
-      return { label: "Running", icon: LoaderCircle, iconClassName: "text-success animate-spin" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.running;
     case "awaiting_report":
-      return { label: "Finishing", icon: LoaderCircle, iconClassName: "text-warning animate-spin" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.finishing;
     case "reported":
-      return { label: "Completed", icon: CheckCircle2, iconClassName: "text-success" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.completed;
     case "interrupted":
-      return { label: "Interrupted", icon: CircleSlash2, iconClassName: "text-muted" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.interrupted;
     default:
-      return { label: "Inactive", icon: CheckCircle2, iconClassName: "text-muted" };
+      return SUB_AGENT_STATUS_PRESENTATIONS.inactive;
   }
 }
 

From f04cb1ddf3ccf95c21f9e3018a1e231a9706f8bf Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 20:33:54 +0000
Subject: [PATCH 64/94] refactor: dedupe the replay/lookup/watermark prelude in
 SessionTimingService

Five per-event handlers (stream delta, reasoning delta, tool-call
start/delta/end) each opened with the same four lines: drop replayed events,
look up the workspace's active stream, bail when there is none, then extend
lastEventTimestampMs. Extract touchActiveStream() so that shared bookkeeping
lives in one place and the five handlers cannot drift apart.

handleStreamStart keeps its own replay guard because it creates the state
rather than looking it up; handleStreamAbort/handleStreamEnd are untouched
because they never had the replay guard or the watermark bump.
---
 src/node/services/sessionTimingService.ts | 42 +++++++++++++----------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/src/node/services/sessionTimingService.ts b/src/node/services/sessionTimingService.ts
index b43a30a914..454683b36c 100644
--- a/src/node/services/sessionTimingService.ts
+++ b/src/node/services/sessionTimingService.ts
@@ -749,12 +749,29 @@ export class SessionTimingService {
     this.emitChange(data.workspaceId);
   }
 
-  handleStreamDelta(data: StreamDeltaEvent): void {
-    if (data.replay === true) return;
+  /**
+   * Resolve the live stream state a real (non-replay) event belongs to, advancing the stream's
+   * last-event watermark.
+   *
+   * Every per-event handler below opens with this same bookkeeping: replayed events re-deliver
+   * history and must never re-time a stream, an event for a workspace with no active stream has
+   * nothing to update, and anything that survives both checks still counts as activity. Returns
+   * `null` when the caller should drop the event.
+   */
+  private touchActiveStream(
+    data: Pick<StreamDeltaEvent, "replay" | "workspaceId" | "timestamp">
+  ): ActiveStreamState | null {
+    if (data.replay === true) return null;
     const state = this.activeStreams.get(data.workspaceId);
-    if (!state) return;
+    if (!state) return null;
 
     state.lastEventTimestampMs = Math.max(state.lastEventTimestampMs, data.timestamp);
+    return state;
+  }
+
+  handleStreamDelta(data: StreamDeltaEvent): void {
+    const state = this.touchActiveStream(data);
+    if (!state) return;
 
     const isFirstToken = data.delta.length > 0 && state.firstTokenTimeMs === null;
     if (isFirstToken) {
@@ -773,12 +790,9 @@ export class SessionTimingService {
   }
 
   handleReasoningDelta(data: ReasoningDeltaEvent): void {
-    if (data.replay === true) return;
-    const state = this.activeStreams.get(data.workspaceId);
+    const state = this.touchActiveStream(data);
     if (!state) return;
 
-    state.lastEventTimestampMs = Math.max(state.lastEventTimestampMs, data.timestamp);
-
     const isFirstToken = data.delta.length > 0 && state.firstTokenTimeMs === null;
     if (isFirstToken) {
       state.firstTokenTimeMs = data.timestamp;
@@ -800,12 +814,9 @@ export class SessionTimingService {
   }
 
   handleToolCallStart(data: ToolCallStartEvent): void {
-    if (data.replay === true) return;
-    const state = this.activeStreams.get(data.workspaceId);
+    const state = this.touchActiveStream(data);
     if (!state) return;
 
-    state.lastEventTimestampMs = Math.max(state.lastEventTimestampMs, data.timestamp);
-
     // Defensive: ignore duplicate tool-call-start events.
     if (state.pendingToolStarts.has(data.toolCallId)) {
       return;
@@ -837,11 +848,9 @@ export class SessionTimingService {
   }
 
   handleToolCallDelta(data: ToolCallDeltaEvent): void {
-    if (data.replay === true) return;
-    const state = this.activeStreams.get(data.workspaceId);
+    const state = this.touchActiveStream(data);
     if (!state) return;
 
-    state.lastEventTimestampMs = Math.max(state.lastEventTimestampMs, data.timestamp);
     state.deltaStorage.addDelta({
       tokens: data.tokens,
       timestamp: data.timestamp,
@@ -852,12 +861,9 @@ export class SessionTimingService {
   }
 
   handleToolCallEnd(data: ToolCallEndEvent): void {
-    if (data.replay === true) return;
-    const state = this.activeStreams.get(data.workspaceId);
+    const state = this.touchActiveStream(data);
     if (!state) return;
 
-    state.lastEventTimestampMs = Math.max(state.lastEventTimestampMs, data.timestamp);
-
     const start = state.pendingToolStarts.get(data.toolCallId);
     if (start === undefined) {
       this.emitChange(data.workspaceId);

From 85b34a7ce164f0168371963e7fe0ae0f70370e69 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:22:31 +0000
Subject: [PATCH 65/94] refactor: dedupe analytics date-filter epoch round-trip

The nine analytics hooks each repeated the same two-step conversion: narrow
the Date filters to epoch milliseconds for a stable dependency array, then
rebuild Dates inside the effect. Extract toEpochMs/fromEpochMs so the
round-trip (and the reason for it) lives in one place.

Behavior-preserving: both helpers are literal extractions of the duplicated
expressions.
---
 src/browser/hooks/useAnalytics.ts | 85 ++++++++++++++++++-------------
 1 file changed, 49 insertions(+), 36 deletions(-)

diff --git a/src/browser/hooks/useAnalytics.ts b/src/browser/hooks/useAnalytics.ts
index 346d285080..fbeb78e13e 100644
--- a/src/browser/hooks/useAnalytics.ts
+++ b/src/browser/hooks/useAnalytics.ts
@@ -41,6 +41,19 @@ interface DateFilterParams {
   to?: Date | null;
 }
 
+// Every analytics hook takes `Date` filters but reads them inside an effect. A `Date` is a
+// fresh reference on each render, so depending on it directly would re-fire the effect
+// constantly. Each hook therefore narrows the filters to epoch milliseconds (a stable
+// primitive) for its dependency array and rebuilds the `Date` inside the effect. These two
+// helpers keep both halves of that round-trip in one place.
+function toEpochMs(date: Date | null | undefined): number | null {
+  return date?.getTime() ?? null;
+}
+
+function fromEpochMs(epochMs: number | null): Date | null {
+  return epochMs == null ? null : new Date(epochMs);
+}
+
 interface AnalyticsNamespace {
   getSummary: (input: SummaryInput) => Promise<Summary>;
   getSpendOverTime: (input: SpendOverTimeInput) => Promise<SpendOverTimeItem[]>;
@@ -154,8 +167,8 @@ export function useAnalyticsSummary(
   projectPath?: string | null,
   dateFilters?: DateFilterParams
 ): AsyncState<Summary> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<Summary>>({
@@ -165,8 +178,8 @@ export function useAnalyticsSummary(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getSummary({ projectPath: projectPath ?? null, from: fromDate, to: toDate })
     );
@@ -187,8 +200,8 @@ export function useAnalyticsSpendOverTime(params: {
     "useAnalyticsSpendOverTime requires a valid granularity"
   );
 
-  const fromMs = params.from?.getTime() ?? null;
-  const toMs = params.to?.getTime() ?? null;
+  const fromMs = toEpochMs(params.from);
+  const toMs = toEpochMs(params.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<SpendOverTimeItem[]>>({
@@ -198,8 +211,8 @@ export function useAnalyticsSpendOverTime(params: {
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getSpendOverTime({
         projectPath: params.projectPath ?? null,
@@ -217,8 +230,8 @@ export function useAnalyticsSpendOverTime(params: {
 export function useAnalyticsSpendByProject(
   dateFilters?: DateFilterParams
 ): AsyncState<SpendByProjectItem[]> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<SpendByProjectItem[]>>({
@@ -228,8 +241,8 @@ export function useAnalyticsSpendByProject(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getSpendByProject({ from: fromDate, to: toDate })
     );
@@ -242,8 +255,8 @@ export function useAnalyticsSpendByModel(
   projectPath?: string | null,
   dateFilters?: DateFilterParams
 ): AsyncState<SpendByModelItem[]> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<SpendByModelItem[]>>({
@@ -253,8 +266,8 @@ export function useAnalyticsSpendByModel(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getSpendByModel({ projectPath: projectPath ?? null, from: fromDate, to: toDate })
     );
@@ -267,8 +280,8 @@ export function useAnalyticsTokensByModel(
   projectPath?: string | null,
   dateFilters?: DateFilterParams
 ): AsyncState<TokensByModelItem[]> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<TokensByModelItem[]>>({
@@ -278,8 +291,8 @@ export function useAnalyticsTokensByModel(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getTokensByModel({
         projectPath: projectPath ?? null,
@@ -302,8 +315,8 @@ export function useAnalyticsTimingDistribution(
     "useAnalyticsTimingDistribution requires a valid metric"
   );
 
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<TimingDistribution>>({
@@ -313,8 +326,8 @@ export function useAnalyticsTimingDistribution(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getTimingDistribution({
         metric,
@@ -332,8 +345,8 @@ export function useAnalyticsProviderCacheHitRatio(
   projectPath?: string | null,
   dateFilters?: DateFilterParams
 ): AsyncState<ProviderCacheHitRatioItem[]> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<ProviderCacheHitRatioItem[]>>({
@@ -343,8 +356,8 @@ export function useAnalyticsProviderCacheHitRatio(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getCacheHitRatioByProvider({
         projectPath: projectPath ?? null,
@@ -361,8 +374,8 @@ export function useAnalyticsAgentCostBreakdown(
   projectPath?: string | null,
   dateFilters?: DateFilterParams
 ): AsyncState<AgentCostItem[]> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<AgentCostItem[]>>({
@@ -372,8 +385,8 @@ export function useAnalyticsAgentCostBreakdown(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getAgentCostBreakdown({
         projectPath: projectPath ?? null,
@@ -390,8 +403,8 @@ export function useAnalyticsDelegationSummary(
   projectPath?: string | null,
   dateFilters?: DateFilterParams
 ): AsyncState<DelegationSummary> {
-  const fromMs = dateFilters?.from?.getTime() ?? null;
-  const toMs = dateFilters?.to?.getTime() ?? null;
+  const fromMs = toEpochMs(dateFilters?.from);
+  const toMs = toEpochMs(dateFilters?.to);
 
   const { api } = useAPI();
   const [state, setState] = useState<AsyncState<DelegationSummary>>({
@@ -401,8 +414,8 @@ export function useAnalyticsDelegationSummary(
   });
 
   useEffect(() => {
-    const fromDate = fromMs == null ? null : new Date(fromMs);
-    const toDate = toMs == null ? null : new Date(toMs);
+    const fromDate = fromEpochMs(fromMs);
+    const toDate = fromEpochMs(toMs);
     return runAnalyticsEffect(api, setState, (analyticsApi) =>
       analyticsApi.getDelegationSummary({
         projectPath: projectPath ?? null,

From 847e18d6219c29d4c8b5deacea5e0fbe5b6b66ea Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 04:30:11 +0000
Subject: [PATCH 66/94] refactor: dedupe budget-exceeded reporting in the run
 CLI

---
 src/cli/run.ts | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/src/cli/run.ts b/src/cli/run.ts
index 7dc584c49d..dbcf4f2323 100644
--- a/src/cli/run.ts
+++ b/src/cli/run.ts
@@ -995,6 +995,17 @@ async function main(): Promise<number> {
   // Budget tracking state
   let budgetExceeded = false;
 
+  // Three separate budget checks (stream-end, sub-agent usage roll-up, and usage-delta) all
+  // report an exceeded budget the same way; only whether the stream still needs interrupting
+  // differs. Share the reporting so the JSON event and the human-readable line cannot drift.
+  const reportBudgetExceeded = (cost: number, budgetLimit: number): void => {
+    budgetExceeded = true;
+    emitJsonLine({ type: "budget-exceeded", spent: cost, budget: budgetLimit });
+    writeHumanLineClosed(
+      `\n${chalk.yellow(`Budget exceeded ($${cost.toFixed(2)} of $${budgetLimit.toFixed(2)}) - stopping`)}`
+    );
+  };
+
   // Centralized output type tracking for spacing
   type OutputType = "none" | "text" | "thinking" | "tool";
   let lastOutputType: OutputType = "none";
@@ -1315,10 +1326,7 @@ async function main(): Promise<number> {
           }
 
           if (cost !== undefined && cost > budget) {
-            budgetExceeded = true;
-            const msg = `Budget exceeded ($${cost.toFixed(2)} of $${budget.toFixed(2)}) - stopping`;
-            emitJsonLine({ type: "budget-exceeded", spent: cost, budget });
-            writeHumanLineClosed(`\n${chalk.yellow(msg)}`);
+            reportBudgetExceeded(cost, budget);
             // Don't interrupt - stream is already ending
           }
         }
@@ -1352,10 +1360,7 @@ async function main(): Promise<number> {
         }
 
         if (cost !== undefined && cost > budget) {
-          budgetExceeded = true;
-          const msg = `Budget exceeded ($${cost.toFixed(2)} of $${budget.toFixed(2)}) - stopping`;
-          emitJsonLine({ type: "budget-exceeded", spent: cost, budget });
-          writeHumanLineClosed(`\n${chalk.yellow(msg)}`);
+          reportBudgetExceeded(cost, budget);
           void session.interruptStream({ abandonPartial: false });
         }
       }
@@ -1393,10 +1398,7 @@ async function main(): Promise<number> {
         }
 
         if (cost !== undefined && cost > budget) {
-          budgetExceeded = true;
-          const msg = `Budget exceeded ($${cost.toFixed(2)} of $${budget.toFixed(2)}) - stopping`;
-          emitJsonLine({ type: "budget-exceeded", spent: cost, budget });
-          writeHumanLineClosed(`\n${chalk.yellow(msg)}`);
+          reportBudgetExceeded(cost, budget);
           void session.interruptStream({ abandonPartial: false });
         }
       }

From 8d802e735142071cb8c7bc8410a8ccf3881b4f77 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 00:31:17 +0000
Subject: [PATCH 67/94] refactor: dedupe the oversized pass-through gate in
 transformMCPResult

---
 src/node/services/mcpResultTransform.ts | 34 ++++++++++++++++---------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/src/node/services/mcpResultTransform.ts b/src/node/services/mcpResultTransform.ts
index 0ac3fcc45d..045bd1810e 100644
--- a/src/node/services/mcpResultTransform.ts
+++ b/src/node/services/mcpResultTransform.ts
@@ -182,6 +182,24 @@ function jsonByteLength(value: unknown): number {
   }
 }
 
+/**
+ * Oversize gate shared by the pass-through result shapes (non-standard
+ * `toolResult`, content-less objects). Returns the serialized size when the
+ * whole result exceeds the text cap and must be replaced by a bounded notice,
+ * or null when it fits and can pass through untouched.
+ */
+function oversizedPassthroughBytes(result: unknown, logMessage: string): number | null {
+  const size = jsonByteLength(result);
+  if (size <= MCP_TOOL_RESULT_MAX_TEXT_BYTES) {
+    return null;
+  }
+  log.warn(logMessage, {
+    size,
+    cap: MCP_TOOL_RESULT_MAX_TEXT_BYTES,
+  });
+  return size;
+}
+
 /** Binary media guard shared by image/audio content and blob resources. */
 function toGuardedMediaPart(
   kind: string,
@@ -234,28 +252,20 @@ export function transformMCPResult(result: unknown): unknown {
   // If it has toolResult (non-standard result shape), pass through as-is when
   // it fits the cap; otherwise replace it with a bounded notice.
   if (typed.toolResult !== undefined) {
-    const size = jsonByteLength(result);
-    if (size <= MCP_TOOL_RESULT_MAX_TEXT_BYTES) {
+    const size = oversizedPassthroughBytes(result, "[MCP] toolResult too large, omitting");
+    if (size === null) {
       return result;
     }
-    log.warn("[MCP] toolResult too large, omitting", {
-      size,
-      cap: MCP_TOOL_RESULT_MAX_TEXT_BYTES,
-    });
     return { toolResult: omittedValueNotice("toolResult", size) };
   }
 
   // If no content array, pass through when it fits the cap; otherwise replace
   // with a bounded notice in MCP text shape so toModelOutput surfaces it.
   if (!typed.content || !Array.isArray(typed.content)) {
-    const size = jsonByteLength(result);
-    if (size <= MCP_TOOL_RESULT_MAX_TEXT_BYTES) {
+    const size = oversizedPassthroughBytes(result, "[MCP] tool result too large, omitting");
+    if (size === null) {
       return result;
     }
-    log.warn("[MCP] tool result too large, omitting", {
-      size,
-      cap: MCP_TOOL_RESULT_MAX_TEXT_BYTES,
-    });
     return { content: [{ type: "text", text: omittedValueNotice("tool result", size) }] };
   }
 

From 33feab5f41df3451b3ac9b066d9551f39c961175 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 12:21:31 +0000
Subject: [PATCH 68/94] refactor: use centralized isErrnoWithCode in
 agentSession

agentSession.ts open-coded the same errno narrow-and-compare three times:

    const errno =
      typeof error === "object" && error !== null && "code" in error
        ? (error as { code?: unknown }).code
        : undefined;

joining the two in loadAutoRetryEnabledPreference and persistAutoRetryState.

src/node/utils/fs.ts already exports isErrnoWithCode for exactly this
pattern ("Centralised because fs / runtime callers across the node layer
need this exact narrow-and-compare pattern and previously each open-coded
it"), and it is used at ~20 other node-layer call sites. agentSession was
the remaining outlier.

Behavior-preserving: isErrnoWithCode(error, "ENOENT") is equivalent to
errno === "ENOENT" (the extra `error &&` truthiness guard only excludes
null, which the original ruled out via `error !== null`), and
!isErrnoWithCode(...) is equivalent to errno !== "ENOENT". The three-way
branch in loadAutoRetryEnabledPreference keeps a single local
(isMissingPreferenceFile) so the check is still evaluated once.
---
 src/node/services/agentSession.ts | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/src/node/services/agentSession.ts b/src/node/services/agentSession.ts
index cb3202d755..635ded587a 100644
--- a/src/node/services/agentSession.ts
+++ b/src/node/services/agentSession.ts
@@ -188,6 +188,7 @@ import {
 } from "@/node/services/branchSummary";
 import type { Runtime } from "@/node/runtime/Runtime";
 import type { XumToolScope } from "@/common/types/toolScope";
+import { isErrnoWithCode } from "@/node/utils/fs";
 import { execBuffered } from "@/node/utils/runtime/helpers";
 import { renderAgentSkillSnapshotText } from "@/common/utils/agentSkills/skillSnapshot";
 import type { MemorySessionContext } from "@/node/services/memoryService";
@@ -459,11 +460,7 @@ export async function clearProviderConfigFixableAbandonMarkers(
   try {
     entries = await readdir(sessionsDir, { withFileTypes: true });
   } catch (error) {
-    const errno =
-      typeof error === "object" && error !== null && "code" in error
-        ? (error as { code?: unknown }).code
-        : undefined;
-    if (errno === "ENOENT") {
+    if (isErrnoWithCode(error, "ENOENT")) {
       return;
     }
     throw error;
@@ -1412,23 +1409,20 @@ export class AgentSession {
     } catch (error) {
       // Missing preference file is the default path. Use any legacy frontend hint
       // (captured at onChat subscribe time) before falling back to enabled.
-      const errno =
-        typeof error === "object" && error !== null && "code" in error
-          ? (error as { code?: unknown }).code
-          : undefined;
+      const isMissingPreferenceFile = isErrnoWithCode(error, "ENOENT");
       const defaultEnabled =
-        errno === "ENOENT" && this.legacyAutoRetryEnabledHint === false ? false : true;
+        isMissingPreferenceFile && this.legacyAutoRetryEnabledHint === false ? false : true;
 
       this.autoRetryEnabledPreference = defaultEnabled;
       this.legacyAutoRetryEnabledHint = null;
       this.startupAutoRetryAbandon = null;
       this.retryManager.setEnabled(defaultEnabled);
 
-      if (errno === "ENOENT" && defaultEnabled === false) {
+      if (isMissingPreferenceFile && defaultEnabled === false) {
         // Persist migrated legacy opt-out so restart behavior no longer depends
         // on renderer localStorage keys.
         await this.persistAutoRetryState();
-      } else if (errno !== "ENOENT") {
+      } else if (!isMissingPreferenceFile) {
         log.warn("Failed to load auto-retry preference; defaulting to enabled", {
           workspaceId: this.workspaceId,
           error: getErrorMessage(error),
@@ -1448,11 +1442,7 @@ export class AgentSession {
       try {
         await unlink(preferencePath);
       } catch (error) {
-        const errno =
-          typeof error === "object" && error !== null && "code" in error
-            ? (error as { code?: unknown }).code
-            : undefined;
-        if (errno !== "ENOENT") {
+        if (!isErrnoWithCode(error, "ENOENT")) {
           log.debug("Failed to clear auto-retry preference file", {
             workspaceId: this.workspaceId,
             error: getErrorMessage(error),

From 6a96d319a6979356f1e3242df6acde1336d8014e Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:11:18 +0000
Subject: [PATCH 69/94] refactor: dedupe canonical/legacy plan path resolution

---
 src/node/utils/runtime/helpers.ts | 35 +++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/src/node/utils/runtime/helpers.ts b/src/node/utils/runtime/helpers.ts
index 985fc71811..f31134a28c 100644
--- a/src/node/utils/runtime/helpers.ts
+++ b/src/node/utils/runtime/helpers.ts
@@ -122,6 +122,23 @@ export interface ReadPlanResult {
   path: string;
 }
 
+/**
+ * Canonical (per-project) and legacy (by workspaceId) plan paths for a workspace.
+ * Both readers must agree on these locations, so resolve them in one place.
+ */
+function getPlanFilePaths(
+  runtime: Runtime,
+  workspaceName: string,
+  projectName: string,
+  workspaceId: string
+): { planPath: string; legacyPath: string } {
+  const xumHome = runtime.getXumHome();
+  return {
+    planPath: getPlanFilePath(workspaceName, projectName, xumHome),
+    legacyPath: getLegacyPlanFilePath(workspaceId, xumHome),
+  };
+}
+
 /**
  * Read plan file content, checking new path first then legacy, migrating if needed.
  * This handles the transparent migration from {runtimeHome}/plans/{id}.md to
@@ -133,9 +150,12 @@ export async function readPlanFile(
   projectName: string,
   workspaceId: string
 ): Promise<ReadPlanResult> {
-  const xumHome = runtime.getXumHome();
-  const planPath = getPlanFilePath(workspaceName, projectName, xumHome);
-  const legacyPath = getLegacyPlanFilePath(workspaceId, xumHome);
+  const { planPath, legacyPath } = getPlanFilePaths(
+    runtime,
+    workspaceName,
+    projectName,
+    workspaceId
+  );
 
   // Resolve tilde to absolute path for client use (editor deep links, etc.)
   // For local runtimes this expands ~ to /home/user; for SSH it resolves remotely
@@ -191,9 +211,12 @@ export async function hasNonEmptyPlanFile(
     return false;
   }
 
-  const xumHome = runtime.getXumHome();
-  const planPath = getPlanFilePath(workspaceName, projectName, xumHome);
-  const legacyPath = getLegacyPlanFilePath(workspaceId, xumHome);
+  const { planPath, legacyPath } = getPlanFilePaths(
+    runtime,
+    workspaceName,
+    projectName,
+    workspaceId
+  );
 
   for (const candidatePath of [planPath, legacyPath]) {
     try {

From cce024163cbfb781886e8a0ddcf3cff4ce75c155 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 22 Aug 2026 00:12:29 +0000
Subject: [PATCH 70/94] refactor: name the instruction-file read flags

readSingleFile took four trailing positional args (scope, isLocal,
projectName, xumOnly), producing call sites like `false, undefined,
false` that gave no hint which flag is which. Group them into a named
InstructionFileTags object. Behavior-preserving; all call sites are
module-private.
---
 src/node/utils/main/instructionFiles.ts | 86 ++++++++++++-------------
 1 file changed, 43 insertions(+), 43 deletions(-)

diff --git a/src/node/utils/main/instructionFiles.ts b/src/node/utils/main/instructionFiles.ts
index d8ba9cd902..a03bb1b8b6 100644
--- a/src/node/utils/main/instructionFiles.ts
+++ b/src/node/utils/main/instructionFiles.ts
@@ -66,15 +66,27 @@ function createRuntimeFileReader(runtime: Runtime): FileReader {
 
 type ReadInstructionFileResult = { exists: false } | { exists: true; file: InstructionFile | null };
 
+/**
+ * Metadata stamped onto a file read by {@link readSingleFile}. Named fields keep
+ * call sites readable: the flags are otherwise indistinguishable positional
+ * booleans.
+ */
+interface InstructionFileTags {
+  scope: InstructionScope;
+  /** True for `.local.md` companions that layer on top of a base file. */
+  isLocal: boolean;
+  /** Project name (only meaningful for "project" scope). */
+  projectName: string | undefined;
+  /** True when the file is Xum-dedicated, so scoped Model:/Mode: directives apply. */
+  xumOnly: boolean;
+}
+
 /** Read a single instruction file via the given reader, returning structured info. */
 async function readSingleFile(
   reader: FileReader,
   directory: string,
   filename: string,
-  scope: InstructionScope,
-  isLocal: boolean,
-  projectName: string | undefined,
-  xumOnly: boolean
+  tags: InstructionFileTags
 ): Promise<ReadInstructionFileResult> {
   let raw: string;
   try {
@@ -89,10 +101,10 @@ async function readSingleFile(
     file: {
       path: path.join(directory, filename),
       filename,
-      isLocal,
-      xumOnly,
-      scope,
-      projectName: projectName ?? null,
+      isLocal: tags.isLocal,
+      xumOnly: tags.xumOnly,
+      scope: tags.scope,
+      projectName: tags.projectName ?? null,
       content: sanitized,
       bytes: Buffer.byteLength(sanitized, "utf-8"),
       tokens: null,
@@ -104,20 +116,10 @@ async function readSingleFile(
 async function readBaseInstructionFile(
   reader: FileReader,
   directory: string,
-  scope: InstructionScope,
-  projectName: string | undefined,
-  xumOnly: boolean
+  tags: Omit<InstructionFileTags, "isLocal">
 ): Promise<ReadInstructionFileResult> {
   for (const filename of INSTRUCTION_FILE_NAMES) {
-    const result = await readSingleFile(
-      reader,
-      directory,
-      filename,
-      scope,
-      false,
-      projectName,
-      xumOnly
-    );
+    const result = await readSingleFile(reader, directory, filename, { ...tags, isLocal: false });
     // Existence, not post-comment content, decides base-file priority. This
     // preserves the historical behavior where an AGENTS.md containing only
     // comments still enables AGENTS.local.md and prevents lower-priority
@@ -146,18 +148,19 @@ async function readInstructionSetWith(
   // are honored there and we must not look for a nested ~/.xum/.xum/AGENTS.md.
   const isGlobalScope = scope === INSTRUCTION_SCOPE.GLOBAL;
 
-  const base = await readBaseInstructionFile(reader, directory, scope, projectName, isGlobalScope);
+  const base = await readBaseInstructionFile(reader, directory, {
+    scope,
+    projectName,
+    xumOnly: isGlobalScope,
+  });
 
   const local = base.exists
-    ? await readSingleFile(
-        reader,
-        directory,
-        LOCAL_INSTRUCTION_FILENAME,
+    ? await readSingleFile(reader, directory, LOCAL_INSTRUCTION_FILENAME, {
         scope,
-        true,
+        isLocal: true,
         projectName,
-        isGlobalScope
-      )
+        xumOnly: isGlobalScope,
+      })
     : ({ exists: false } satisfies ReadInstructionFileResult);
 
   // Read one Xum-dedicated companion tree, preferring .xum and falling back
@@ -167,24 +170,18 @@ async function readInstructionSetWith(
   if (!isGlobalScope) {
     for (const relativeDirectory of listProjectMetadataRelativePaths("")) {
       const dedicatedDirectory = path.join(directory, relativeDirectory);
-      dedicatedBase = await readSingleFile(
-        reader,
-        dedicatedDirectory,
-        XUM_INSTRUCTION_FILENAME,
+      dedicatedBase = await readSingleFile(reader, dedicatedDirectory, XUM_INSTRUCTION_FILENAME, {
         scope,
-        false,
+        isLocal: false,
         projectName,
-        true
-      );
+        xumOnly: true,
+      });
       if (!dedicatedBase.exists) continue;
       dedicatedLocal = await readSingleFile(
         reader,
         dedicatedDirectory,
         LOCAL_INSTRUCTION_FILENAME,
-        scope,
-        true,
-        projectName,
-        true
+        { scope, isLocal: true, projectName, xumOnly: true }
       );
       break;
     }
@@ -253,10 +250,13 @@ export async function readClaudeCompatGlobalInstructionSet(
     createLocalFileReader(),
     resolvedDirectory,
     CLAUDE_COMPAT_GLOBAL_INSTRUCTION_FILENAME,
-    INSTRUCTION_SCOPE.GLOBAL,
-    false,
-    undefined,
-    false
+    {
+      scope: INSTRUCTION_SCOPE.GLOBAL,
+      isLocal: false,
+      projectName: undefined,
+      // Shared with Claude Code, so scoped Model:/Mode: headings stay plain markdown.
+      xumOnly: false,
+    }
   );
   if (!result.exists || !result.file) return null;
 

From 69969ce8f322555c484c7b2b33226abfd21cd826 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 22 Aug 2026 04:16:40 +0000
Subject: [PATCH 71/94] refactor: extract configContentSignature helper for
 corrupt-config backup gate

---
 src/node/config/index.ts | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/node/config/index.ts b/src/node/config/index.ts
index c44bb04cb8..07d7f976cd 100644
--- a/src/node/config/index.ts
+++ b/src/node/config/index.ts
@@ -863,6 +863,18 @@ interface ConfigLoadFailureState {
   backupSignature: string | null;
 }
 
+/**
+ * Hash config bytes for `ConfigLoadFailureState.backupSignature`.
+ *
+ * Both producers of that signature must hash identically: the failed load records the
+ * corrupt bytes it backed up, and the edit gate re-hashes the file on disk and compares
+ * the two. Sharing one helper keeps that comparison meaningful, since any drift between
+ * two inlined hashes would silently make every signature mismatch and block edits.
+ */
+function configContentSignature(bytes: Buffer): string {
+  return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+
 // Process-scoped, keyed by config file path: production creates short-lived Config
 // instances (e.g. runtimeFactory per runtime check), so instance-local dedupe would
 // re-log the same corrupt-config error once per instance.
@@ -1011,8 +1023,7 @@ export class Config {
     const errorMessage = error instanceof Error ? error.message : String(error);
     // Backup confirmation is keyed on content alone: the same corrupt bytes need only one
     // sidecar regardless of which error message they produced.
-    const contentSignature =
-      rawBytes !== undefined ? crypto.createHash("sha256").update(rawBytes).digest("hex") : null;
+    const contentSignature = rawBytes !== undefined ? configContentSignature(rawBytes) : null;
 
     // Re-verify preservation against the disk on every failed load rather than trusting a
     // cached confirmation: a sidecar deleted or truncated since the last load must re-block
@@ -2444,7 +2455,7 @@ export class Config {
         let currentSignature: string | null = null;
         try {
           const currentBytes = fs.readFileSync(this.configFile);
-          currentSignature = crypto.createHash("sha256").update(currentBytes).digest("hex");
+          currentSignature = configContentSignature(currentBytes);
         } catch (readError) {
           if ((readError as NodeJS.ErrnoException).code !== "ENOENT") {
             rejectEdit(

From a342741ec5aae1487e86f22fec50396e8538f898 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 22 Aug 2026 08:11:33 +0000
Subject: [PATCH 72/94] refactor: extract rollBackInitializedGitDir helper for
 git-init rollback

---
 src/node/services/projectService.ts | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/src/node/services/projectService.ts b/src/node/services/projectService.ts
index 4830dd54ec..df8596d7b5 100644
--- a/src/node/services/projectService.ts
+++ b/src/node/services/projectService.ts
@@ -340,6 +340,21 @@ function friendlyFsError(error: unknown, action: string, targetPath: string): st
   }
 }
 
+/**
+ * Best-effort rollback of a `.git` directory this process just created. Every
+ * git-init failure path must restore the directory to its prior state (so a retry
+ * is not rejected as non-empty, and a concurrent winner does not inherit a
+ * repository it never asked for), but the caller is already returning the real
+ * error, so a cleanup failure is only logged.
+ */
+async function rollBackInitializedGitDir(normalizedPath: string): Promise<void> {
+  await fsPromises
+    .rm(path.join(normalizedPath, ".git"), { recursive: true, force: true })
+    .catch((cleanupError: unknown) => {
+      log.error(`Failed to roll back git init in ${normalizedPath}:`, cleanupError);
+    });
+}
+
 async function resolveRealProjectPath(projectPath: string): Promise<string> {
   return stripTrailingSlashes(await fsPromises.realpath(projectPath));
 }
@@ -727,11 +742,7 @@ export class ProjectService {
         // .git this losing request created would silently turn the winner's project
         // into a repository it never asked for, or wrap its checkout in an
         // unregistered outer repository that changes git discovery.
-        await fsPromises
-          .rm(path.join(normalizedPath, ".git"), { recursive: true, force: true })
-          .catch((cleanupError: unknown) => {
-            log.error(`Failed to roll back git init in ${normalizedPath}:`, cleanupError);
-          });
+        await rollBackInitializedGitDir(normalizedPath);
       }
       if (createResult.success && !this.config.loadConfigOrDefault().projects.has(normalizedPath)) {
         // Config persistence (editConfig → private saveConfig) logs-and-continues on
@@ -1598,11 +1609,7 @@ export class ProjectService {
       // the directory returns to its prior state and a retry is not rejected as
       // non-empty (e.g. when the initial commit fails).
       if (initializedGitDir) {
-        await fsPromises
-          .rm(path.join(normalizedPath, ".git"), { recursive: true, force: true })
-          .catch((cleanupError: unknown) => {
-            log.error(`Failed to roll back git init in ${normalizedPath}:`, cleanupError);
-          });
+        await rollBackInitializedGitDir(normalizedPath);
       }
       const message = getErrorMessage(error);
       log.error("Failed to initialize git repository:", error);

From 5c9bde9aa164dbb8c98162ba18aace97d7a59122 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 16:11:46 +0000
Subject: [PATCH 73/94] refactor: dedupe the magnitude-shift bound check in
 update-models validation

---
 src/common/utils/tokens/updateModelsData.ts | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/common/utils/tokens/updateModelsData.ts b/src/common/utils/tokens/updateModelsData.ts
index ac2bcd275c..48a288282c 100644
--- a/src/common/utils/tokens/updateModelsData.ts
+++ b/src/common/utils/tokens/updateModelsData.ts
@@ -287,6 +287,16 @@ function belowBaseline(count: number, baseline: number): boolean {
   );
 }
 
+/**
+ * Whether a candidate value drifted beyond MAX_MAGNITUDE_SHIFT_FACTOR from a
+ * positive `baseline` in either direction. A missing candidate (`null`) reads
+ * as 0, which always trips the lower bound. Callers must pass a baseline > 0.
+ */
+function exceedsMagnitudeShift(candidate: number | null, baseline: number): boolean {
+  const ratio = candidate === null ? 0 : candidate / baseline;
+  return ratio > MAX_MAGNITUDE_SHIFT_FACTOR || ratio < 1 / MAX_MAGNITUDE_SHIFT_FACTOR;
+}
+
 /**
  * Throws when the sanitized upstream data is unfit to replace the vendored
  * models.json. `baselineCatalog` is the currently vendored catalog (defaults
@@ -336,7 +346,7 @@ export function validateModelData(
   // catalog could retain every field while rescaling values (prices toward
   // zero or absurdly high, token limits toward 1). A collapsed sample count
   // (e.g. every price zeroed) fails both the sample shrink and the median
-  // check, since a zero median is more than MAX_MEDIAN_SHIFT_FACTOR below any
+  // check, since a zero median is more than MAX_MAGNITUDE_SHIFT_FACTOR below any
   // positive baseline.
   for (const [field, baselineStats] of Object.entries(baseline.numericFields)) {
     if (baselineStats.samples < MIN_BASELINE_FOR_SHRINK_CHECK || baselineStats.median <= 0) {
@@ -344,8 +354,7 @@ export function validateModelData(
     }
     const candidate = summary.numericFields[field] ?? { samples: 0, median: 0 };
     shrinkChecks.push([`${field} positive-value count`, candidate.samples, baselineStats.samples]);
-    const ratio = candidate.median / baselineStats.median;
-    if (ratio > MAX_MAGNITUDE_SHIFT_FACTOR || ratio < 1 / MAX_MAGNITUDE_SHIFT_FACTOR) {
+    if (exceedsMagnitudeShift(candidate.median, baselineStats.median)) {
       errors.push(
         `${field} median shifted from ${baselineStats.median} to ${candidate.median} ` +
           `(more than ${MAX_MAGNITUDE_SHIFT_FACTOR}x from the vendored baseline; possible corruption)`
@@ -403,8 +412,7 @@ export function validateModelData(
         continue;
       }
       const candidateNum = parseNum(entry[field]);
-      const ratio = candidateNum === null ? 0 : candidateNum / baselineNum;
-      if (ratio > MAX_MAGNITUDE_SHIFT_FACTOR || ratio < 1 / MAX_MAGNITUDE_SHIFT_FACTOR) {
+      if (exceedsMagnitudeShift(candidateNum, baselineNum)) {
         entryShifts.push(`${id} ${field}: ${baselineNum} -> ${candidateNum ?? "absent"}`);
       }
     }

From 23033740b4e1074b885e0276a66e236133e4a8d0 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 20:10:10 +0000
Subject: [PATCH 74/94] refactor: dedupe app-bundle discovery in mac
 attach-file smoke check

---
 scripts/checkMacAttachFileRuntime.ts | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/scripts/checkMacAttachFileRuntime.ts b/scripts/checkMacAttachFileRuntime.ts
index 1d9649f6f8..1d83af2897 100644
--- a/scripts/checkMacAttachFileRuntime.ts
+++ b/scripts/checkMacAttachFileRuntime.ts
@@ -64,15 +64,9 @@ async function findAppBundles(rootDir: string): Promise<{ matches: string[]; see
   return { matches, seen };
 }
 
-async function chooseDefaultAppBundle(): Promise<string> {
-  const { matches: appBundles, seen } = await findAppBundles(RELEASE_DIR);
-  assert(
-    appBundles.length > 0,
-    `No ${APP_NAME} found under ${RELEASE_DIR}. Run make dist-mac first. Stored .app names: ${
-      seen.length > 0 ? seen.join(", ") : "(none)"
-    }`
-  );
-
+// Takes the already-discovered bundles so callers do not re-walk the release
+// tree (and re-run the identical "no bundle found" assert) just to pick one.
+function chooseDefaultAppBundle(appBundles: readonly string[]): string {
   const preferredSuffixes =
     process.arch === "arm64"
       ? [
@@ -94,7 +88,7 @@ async function chooseDefaultAppBundle(): Promise<string> {
     }
   }
 
-  return appBundles.sort()[0]!;
+  return [...appBundles].sort()[0]!;
 }
 
 async function findFileMatching(rootDir: string, pattern: RegExp): Promise<string | null> {
@@ -304,7 +298,7 @@ async function main(): Promise<void> {
       }`
     );
     appBundles = matches;
-    smokeAppBundle = await chooseDefaultAppBundle();
+    smokeAppBundle = chooseDefaultAppBundle(matches);
   }
 
   const verifiedArchitectures = new Set<MacAppArchitecture>();

From dbab3c72280f1ac4dd4d96713e4da3de5d037d4c Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 16:22:16 +0000
Subject: [PATCH 75/94] refactor: dedupe terminal badge config patching in
 GeneralSection

The five terminal-badge handlers added by #3937 each repeated the same
`setTerminalBadgeConfig((prev) => ({ ...normalizeTerminalBadgeConfig(prev), <field> }))`
dance. Funnel them through one patchTerminalBadgeConfig helper so the
normalize-then-spread step is stated once and cannot drift between fields.
---
 .../Settings/Sections/GeneralSection.tsx      | 22 ++++++++++++-------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/browser/features/Settings/Sections/GeneralSection.tsx b/src/browser/features/Settings/Sections/GeneralSection.tsx
index 5eaf67cb33..8929d380f4 100644
--- a/src/browser/features/Settings/Sections/GeneralSection.tsx
+++ b/src/browser/features/Settings/Sections/GeneralSection.tsx
@@ -480,16 +480,25 @@ export function GeneralSection() {
     setEditorConfig((prev) => ({ ...normalizeEditorConfig(prev), customCommand }));
   };
 
+  // Every badge edit patches a single field onto the normalized previous
+  // config. Funnel them through one helper so the normalize-then-spread step
+  // is stated once and cannot drift between fields — persisted configs may
+  // predate a field, so normalizing before the patch is what keeps the stored
+  // value whole.
+  const patchTerminalBadgeConfig = (patch: Partial<TerminalBadgeConfig>) => {
+    setTerminalBadgeConfig((prev) => ({ ...normalizeTerminalBadgeConfig(prev), ...patch }));
+  };
+
   const handleTerminalBadgeEnabledChange = (enabled: boolean) => {
-    setTerminalBadgeConfig((prev) => ({ ...normalizeTerminalBadgeConfig(prev), enabled }));
+    patchTerminalBadgeConfig({ enabled });
   };
 
   const handleTerminalBadgeTemplateChange = (template: string) => {
-    setTerminalBadgeConfig((prev) => ({ ...normalizeTerminalBadgeConfig(prev), template }));
+    patchTerminalBadgeConfig({ template });
   };
 
   const handleTerminalBadgePositionChange = (position: TerminalBadgePosition) => {
-    setTerminalBadgeConfig((prev) => ({ ...normalizeTerminalBadgeConfig(prev), position }));
+    patchTerminalBadgeConfig({ position });
   };
 
   const handleTerminalBadgeOpacityChange = (rawValue: string) => {
@@ -498,10 +507,7 @@ export function GeneralSection() {
       return;
     }
 
-    setTerminalBadgeConfig((prev) => ({
-      ...normalizeTerminalBadgeConfig(prev),
-      opacity: parsed / 100,
-    }));
+    patchTerminalBadgeConfig({ opacity: parsed / 100 });
   };
 
   const handleTerminalBadgeFontSizeChange = (rawValue: string) => {
@@ -510,7 +516,7 @@ export function GeneralSection() {
       return;
     }
 
-    setTerminalBadgeConfig((prev) => ({ ...normalizeTerminalBadgeConfig(prev), fontSize: parsed }));
+    patchTerminalBadgeConfig({ fontSize: parsed });
   };
 
   const handleSshHostChange = useCallback(

From b23485ea0a7f4b43910af4a0bf344ffaf5b5c277 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:13:55 +0000
Subject: [PATCH 76/94] refactor: drop vestigial handleJumpToBottom alias in
 ChatPane

#3795 removed the wrapper's only body statement (clearActiveSideQuestionScrollHold), leaving `const handleJumpToBottom = jumpToBottom` as a pure identity alias. #3948 then added a cancel-edit call that used jumpToBottom() directly, so the file mixed both spellings of the same reference. Use jumpToBottom everywhere and delete the alias.
---
 src/browser/components/ChatPane/ChatPane.tsx | 26 +++++++++-----------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/browser/components/ChatPane/ChatPane.tsx b/src/browser/components/ChatPane/ChatPane.tsx
index 508c714b89..495af9787f 100644
--- a/src/browser/components/ChatPane/ChatPane.tsx
+++ b/src/browser/components/ChatPane/ChatPane.tsx
@@ -740,8 +740,6 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
     [handleScrollContainerKeyDown, isComposerDockEvent]
   );
 
-  const handleJumpToBottom = jumpToBottom;
-
   // Handler to navigate (scroll) to a specific message by historyId
   const handleNavigateToMessage = useCallback(
     (historyId: string) => {
@@ -1013,8 +1011,8 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
     // send success can be too late because the backend may not resolve until the
     // stream has already produced rows, leaving the first deltas offscreen when the
     // user had previously scrolled up.
-    handleJumpToBottom();
-  }, [handleJumpToBottom]);
+    jumpToBottom();
+  }, [jumpToBottom]);
 
   const handleMessageSent = useCallback(
     (dispatchMode: QueueDispatchMode = "tool-end") => {
@@ -1027,15 +1025,15 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
 
       // Slash-command send paths still report after backend success; keep this
       // harmless duplicate pin so those paths also re-arm auto-scroll.
-      handleJumpToBottom();
+      jumpToBottom();
     },
-    [autoBackgroundOnSend, handleJumpToBottom]
+    [autoBackgroundOnSend, jumpToBottom]
   );
 
   const handleClearHistory = useCallback(
     async (percentage = 1.0) => {
       // Re-arm the tail before clearing so the empty/starting state owns the bottom.
-      handleJumpToBottom();
+      jumpToBottom();
 
       // Truncate history in backend
       const result = await api?.workspace.truncateHistory({ workspaceId, percentage });
@@ -1047,18 +1045,18 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
         throw new Error(result.error);
       }
     },
-    [workspaceId, handleJumpToBottom, api]
+    [workspaceId, jumpToBottom, api]
   );
 
   const handleResetContext = useCallback(async (): Promise<"reset" | "noop"> => {
-    handleJumpToBottom();
+    jumpToBottom();
 
     const result = await api?.workspace.resetContext({ workspaceId });
     if (!result?.success) {
       throw new Error(result?.error ?? "Failed to reset context");
     }
     return result.data;
-  }, [workspaceId, handleJumpToBottom, api]);
+  }, [workspaceId, jumpToBottom, api]);
 
   const openInEditor = useOpenInEditor();
   const handleOpenInEditor = useCallback(() => {
@@ -1077,8 +1075,8 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
   // the ref-backed auto-scroll flag and pins any cached rows before paint; if rows are still
   // hydrating, the next content resize owns the tail instead of showing the prior workspace's state.
   useLayoutEffect(() => {
-    handleJumpToBottom();
-  }, [hasLoadedTranscriptRows, handleJumpToBottom, workspaceId]);
+    jumpToBottom();
+  }, [hasLoadedTranscriptRows, jumpToBottom, workspaceId]);
 
   // Compute showRetryBarrier once for both keybinds and UI.
   // Track if last message was interrupted or errored (for RetryBarrier).
@@ -1233,7 +1231,7 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
       (workspaceState?.canInterrupt ?? false) || (workspaceState?.isStreamStarting ?? false),
     showRetryBarrier,
     chatInputAPI,
-    jumpToBottom: handleJumpToBottom,
+    jumpToBottom,
     loadOlderHistory: shouldRenderLoadOlderMessagesButton ? handleLoadOlderHistory : null,
     handleOpenTerminal: onOpenTerminal,
     handleOpenInEditor,
@@ -1678,7 +1676,7 @@ const ChatPaneContent: React.FC<ChatPaneContentProps> = (props) => {
                 >
                   {!autoScroll && (
                     <button
-                      onClick={handleJumpToBottom}
+                      onClick={jumpToBottom}
                       type="button"
                       // Sit just above the composer dock (8px gap), tracking its live
                       // height through normal layout instead of a measured offset.

From 7f9927a64aa4d37e8beb2cf06cba2049f6614ae2 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:17:50 +0000
Subject: [PATCH 77/94] refactor: share the narrow-viewport media query
 constant

#3956 added the timeline dialog's responsive gate, which builds `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)` inline for both the render-time read and the matchMedia listener. Its tests and the phone-viewport stories then had to hand-build a byte-identical string to stub matchMedia, since the stubs match the argument by equality. That put ten copies of one template across four files.

Derive it once as MOBILE_TOUCH_MEDIA_QUERY's neighbour in constants/layout.ts. Behavior-preserving: the constant is defined as the same template expression, so every callsite receives the identical string it built before.
---
 .../WorkspaceMenuBar/WorkspaceMenuBar.test.tsx   | 16 +++++++---------
 .../WorkspaceMenuBar/WorkspaceMenuBar.tsx        |  6 +++---
 .../stories/App.phoneViewports.stories.tsx       |  6 +++---
 src/constants/layout.ts                          |  5 +++++
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.test.tsx b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.test.tsx
index bf5317fdf7..56fe28a167 100644
--- a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.test.tsx
+++ b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.test.tsx
@@ -34,7 +34,7 @@ import type { FrontendWorkspaceMetadata } from "@/common/types/workspace";
 import type * as ExperimentsModuleType from "@/browser/hooks/useExperiments";
 import { EXPERIMENT_IDS } from "@/common/constants/experiments";
 import {
-  NARROW_VIEWPORT_MAX_WIDTH_PX,
+  NARROW_VIEWPORT_MEDIA_QUERY,
   WORKSPACE_MENU_BAR_LEFT_SIDEBAR_COLLAPSED_PADDING_PX,
 } from "@/constants/layout";
 
@@ -429,7 +429,7 @@ describe("WorkspaceMenuBar archive confirmations", () => {
 
   it("offers the Timeline action on narrow viewports and opens the dialog", () => {
     mockTimelineExperimentEnabled = true;
-    stubMatchMedia((query) => query === `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`);
+    stubMatchMedia((query) => query === NARROW_VIEWPORT_MEDIA_QUERY);
 
     render(<WorkspaceMenuBar {...defaultProps} />);
 
@@ -455,7 +455,7 @@ describe("WorkspaceMenuBar archive confirmations", () => {
   });
 
   it("hides the Timeline action when the timeline experiment is disabled", () => {
-    stubMatchMedia((query) => query === `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`);
+    stubMatchMedia((query) => query === NARROW_VIEWPORT_MEDIA_QUERY);
 
     render(<WorkspaceMenuBar {...defaultProps} />);
 
@@ -487,9 +487,7 @@ describe("WorkspaceMenuBar archive confirmations", () => {
   it("re-gates the Timeline action when the viewport crosses the narrow breakpoint", () => {
     mockTimelineExperimentEnabled = true;
     let narrow = false;
-    const media = stubMatchMedia(
-      (query) => narrow && query === `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`
-    );
+    const media = stubMatchMedia((query) => narrow && query === NARROW_VIEWPORT_MEDIA_QUERY);
 
     render(<WorkspaceMenuBar {...defaultProps} />);
     expect(getLastMenuContentProps()?.onOpenTimeline).toBeNull();
@@ -504,7 +502,7 @@ describe("WorkspaceMenuBar archive confirmations", () => {
 
   it("opens the timeline dialog with the keyboard shortcut on narrow viewports", () => {
     mockTimelineExperimentEnabled = true;
-    stubMatchMedia((query) => query === `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`);
+    stubMatchMedia((query) => query === NARROW_VIEWPORT_MEDIA_QUERY);
 
     render(<WorkspaceMenuBar {...defaultProps} />);
 
@@ -531,7 +529,7 @@ describe("WorkspaceMenuBar archive confirmations", () => {
 
   it("ignores the timeline shortcut while another modal is open", () => {
     mockTimelineExperimentEnabled = true;
-    stubMatchMedia((query) => query === `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`);
+    stubMatchMedia((query) => query === NARROW_VIEWPORT_MEDIA_QUERY);
 
     const modal = document.createElement("div");
     modal.setAttribute("role", "dialog");
@@ -550,7 +548,7 @@ describe("WorkspaceMenuBar archive confirmations", () => {
 
   it("closes the timeline dialog when switching workspaces", () => {
     mockTimelineExperimentEnabled = true;
-    stubMatchMedia((query) => query === `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`);
+    stubMatchMedia((query) => query === NARROW_VIEWPORT_MEDIA_QUERY);
 
     const view = render(<WorkspaceMenuBar {...defaultProps} />);
 
diff --git a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
index 201d313568..f05fc2ecd9 100644
--- a/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
+++ b/src/browser/components/WorkspaceMenuBar/WorkspaceMenuBar.tsx
@@ -56,7 +56,7 @@ import { hasWorkspaceRepository } from "@/browser/utils/workspaceCapabilities";
 import { stopKeyboardPropagation } from "@/browser/utils/events";
 import {
   MOBILE_TOUCH_MEDIA_QUERY,
-  NARROW_VIEWPORT_MAX_WIDTH_PX,
+  NARROW_VIEWPORT_MEDIA_QUERY,
   WORKSPACE_MENU_BAR_LEFT_SIDEBAR_COLLAPSED_PADDING_PX,
 } from "@/constants/layout";
 import { TimelineDialog } from "@/browser/features/RightSidebar/Timeline/TimelineDialog";
@@ -218,7 +218,7 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
       }
       return window.getComputedStyle(sidebar).display === "none";
     }
-    return window.matchMedia(`(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`).matches;
+    return window.matchMedia(NARROW_VIEWPORT_MEDIA_QUERY).matches;
   }, []);
 
   // Keep the gate reactive: resizing re-evaluates CSS instantly, but a render-time read
@@ -229,7 +229,7 @@ export const WorkspaceMenuBar: React.FC<WorkspaceMenuBarProps> = ({
   useEffect(() => {
     const compute = () => setTimelineSidebarHidden(isTimelineSidebarHidden());
     compute();
-    const mql = window.matchMedia(`(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`);
+    const mql = window.matchMedia(NARROW_VIEWPORT_MEDIA_QUERY);
     mql.addEventListener("change", compute);
     const shell = menuBarRef.current?.closest("[data-workspace-shell]");
     let resizeObserver: ResizeObserver | undefined;
diff --git a/src/browser/stories/App.phoneViewports.stories.tsx b/src/browser/stories/App.phoneViewports.stories.tsx
index 55afaf4b5a..647c56d8da 100644
--- a/src/browser/stories/App.phoneViewports.stories.tsx
+++ b/src/browser/stories/App.phoneViewports.stories.tsx
@@ -14,7 +14,7 @@ import type { TimelineEvent } from "@/common/orpc/schemas/timeline";
 
 import { updatePersistedState } from "@/browser/hooks/usePersistedState";
 import { LEFT_SIDEBAR_COLLAPSED_KEY } from "@/common/constants/storage";
-import { MOBILE_TOUCH_TARGET_PX, NARROW_VIEWPORT_MAX_WIDTH_PX } from "@/constants/layout";
+import { MOBILE_TOUCH_TARGET_PX, NARROW_VIEWPORT_MEDIA_QUERY } from "@/constants/layout";
 
 import { appMeta, AppWithMocks, PIXEL_DISABLED, type AppStory } from "./meta.js";
 import { createAssistantMessage, createUserMessage } from "./mocks/messages";
@@ -205,7 +205,7 @@ export const IPhone16ePRLinkPlacement: AppStory = {
   play: async ({ canvasElement }) => {
     await stabilizePhoneViewportStory(canvasElement);
 
-    const narrow = window.matchMedia(`(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`).matches;
+    const narrow = window.matchMedia(NARROW_VIEWPORT_MEDIA_QUERY).matches;
     await waitFor(
       () => {
         const inHeader = countVisiblePRLinks("workspace-menu-bar");
@@ -499,7 +499,7 @@ export const IPhone16eTimelineDialog: AppStory = {
     // The Timeline menu action is gated on `window.matchMedia`, which the fixed-width
     // decorator cannot move; only assert where the viewport is genuinely narrow (Pixel's
     // phone viewport). The test-runner executes at desktop window size and skips here.
-    if (!window.matchMedia(`(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`).matches) {
+    if (!window.matchMedia(NARROW_VIEWPORT_MEDIA_QUERY).matches) {
       return;
     }
 
diff --git a/src/constants/layout.ts b/src/constants/layout.ts
index a55401cc04..3ee3f703f4 100644
--- a/src/constants/layout.ts
+++ b/src/constants/layout.ts
@@ -34,6 +34,11 @@ export const MOBILE_TOUCH_TARGET_PX = 44;
 // constant, so `[@media(max-width:768px)]` class strings repeat this literal.
 export const NARROW_VIEWPORT_MAX_WIDTH_PX = 768;
 
+// `matchMedia` form of the breakpoint above. Renderer code and its tests have to agree on a
+// byte-identical query string — stubs match the argument by equality — so a per-callsite copy of
+// this template can desync a caller into a query that silently never matches.
+export const NARROW_VIEWPORT_MEDIA_QUERY = `(max-width: ${NARROW_VIEWPORT_MAX_WIDTH_PX}px)`;
+
 // Keep composer controls aligned without relying on individual component defaults. This is a floor,
 // not a fixed height: mobile raises touch targets to MOBILE_TOUCH_TARGET_PX, and a pill that caps
 // its height would clip the controls inside it instead of growing with them.

From 7430270891218caa6590a169736c519417f349eb Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:24:21 +0000
Subject: [PATCH 78/94] refactor: share the agent-envelope lookalike pre-check

The "does this text mention the envelope tag" fast path was re-derived as an
inline includes("mux_agent_message") at three sites across two files: the
guard inside neutralizeAgentEnvelopeLookalikes, the text-part skip in
neutralizeAgentEnvelopeLookalikesForProvider, and the reference-preserving
check in its neutralizeStringsDeep helper.

All three must test exactly what neutralizeAgentEnvelopeLookalikes rewrites --
a pre-check that drifted from the tag would silently skip neutralization -- so
extract containsAgentEnvelopeLookalike and single-source the tag name that
ROOT_OPEN/ROOT_CLOSE are also built from.

Behavior-preserving: the predicate is the same includes() on the same literal,
and the derived tag constants are byte-identical to the strings they replace.
---
 src/common/utils/agentMessageEnvelope.ts      | 22 ++++++++++++++++---
 ...alizeAgentEnvelopeLookalikesForProvider.ts |  5 +++--
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/src/common/utils/agentMessageEnvelope.ts b/src/common/utils/agentMessageEnvelope.ts
index b3d5b420cc..28ee6ebdcd 100644
--- a/src/common/utils/agentMessageEnvelope.ts
+++ b/src/common/utils/agentMessageEnvelope.ts
@@ -16,8 +16,24 @@ export interface AgentMessageEnvelope {
   message: string;
 }
 
-const ROOT_OPEN = "<mux_agent_message>";
-const ROOT_CLOSE = "</mux_agent_message>";
+/**
+ * Tag name every envelope spelling is built from. Single-sourced because the open tag, the close
+ * tag, and the cheap "might contain an envelope" pre-check must all agree: a pre-check that missed
+ * a spelling would silently skip neutralization and let unauthored text keep the exact wrapper.
+ */
+const ENVELOPE_TAG = "mux_agent_message";
+const ROOT_OPEN = `<${ENVELOPE_TAG}>`;
+const ROOT_CLOSE = `</${ENVELOPE_TAG}>`;
+
+/**
+ * Cheap pre-check shared by every neutralization site: true when `text` mentions the envelope tag
+ * at all (either spelling, or a lookalike). Callers use it to skip work and, where it matters, to
+ * preserve the input reference when nothing needs rewriting — so they must test exactly what
+ * `neutralizeAgentEnvelopeLookalikes` rewrites rather than re-deriving the literal per call site.
+ */
+export function containsAgentEnvelopeLookalike(text: string): boolean {
+  return text.includes(ENVELOPE_TAG);
+}
 
 function isNonEmptyString(value: unknown): value is string {
   return typeof value === "string" && value.length > 0;
@@ -88,7 +104,7 @@ export function getValidAgentPeerTriggerMeta(value: unknown): AgentPeerMessageMe
  * sees what the user pasted.
  */
 export function neutralizeAgentEnvelopeLookalikes(text: string): string {
-  if (!text.includes("mux_agent_message")) return text;
+  if (!containsAgentEnvelopeLookalike(text)) return text;
   return text
     .replaceAll(ROOT_OPEN, "<user_pasted_mux_agent_message>")
     .replaceAll(ROOT_CLOSE, "</user_pasted_mux_agent_message>");
diff --git a/src/node/utils/messages/neutralizeAgentEnvelopeLookalikesForProvider.ts b/src/node/utils/messages/neutralizeAgentEnvelopeLookalikesForProvider.ts
index f909b6a03f..fcd2a10263 100644
--- a/src/node/utils/messages/neutralizeAgentEnvelopeLookalikesForProvider.ts
+++ b/src/node/utils/messages/neutralizeAgentEnvelopeLookalikesForProvider.ts
@@ -1,4 +1,5 @@
 import {
+  containsAgentEnvelopeLookalike,
   getValidAgentPeerMessageMeta,
   neutralizeAgentEnvelopeLookalikes,
   parseAgentMessageEnvelope,
@@ -57,7 +58,7 @@ export function neutralizeAgentEnvelopeLookalikesForProvider(messages: MuxMessag
     let msgChanged = false;
     const nextParts = msg.parts.map((part) => {
       if (part.type === "text") {
-        if (isAuthenticPeerRow || !part.text.includes("mux_agent_message")) {
+        if (isAuthenticPeerRow || !containsAgentEnvelopeLookalike(part.text)) {
           return part;
         }
         msgChanged = true;
@@ -110,7 +111,7 @@ function toRecord(value: unknown): Record<string, unknown> {
  */
 function neutralizeStringsDeep(value: unknown): unknown {
   if (typeof value === "string") {
-    return value.includes("mux_agent_message") ? neutralizeAgentEnvelopeLookalikes(value) : value;
+    return containsAgentEnvelopeLookalike(value) ? neutralizeAgentEnvelopeLookalikes(value) : value;
   }
   if (Array.isArray(value)) {
     let changed = false;

From f69eec6f457377ef80834ceae4bfbf1550ee3ce4 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 20:15:34 +0000
Subject: [PATCH 79/94] refactor: dedupe the git-query boilerplate in taskUtils

The four tryReadGit* helpers each inlined the same execBuffered call with a
literal timeout: 10, an exitCode gate, a stdout trim, and a catch-all that
degrades to undefined. Extract tryRunGitQuery + GIT_QUERY_TIMEOUT_SECONDS so
the timeout and the 'could not run' contract live in one place.
---
 src/node/services/taskUtils.ts | 117 ++++++++++++++++++---------------
 1 file changed, 65 insertions(+), 52 deletions(-)

diff --git a/src/node/services/taskUtils.ts b/src/node/services/taskUtils.ts
index e6d53f9ed9..939a672caa 100644
--- a/src/node/services/taskUtils.ts
+++ b/src/node/services/taskUtils.ts
@@ -15,26 +15,49 @@ export function coerceNonEmptyString(value: unknown): string | undefined {
   return trimmed.length > 0 ? trimmed : undefined;
 }
 
+/**
+ * Upper bound for the short read-only git queries below. They are all
+ * single-shot metadata reads, so an unresponsive runtime should degrade to
+ * "unknown" quickly instead of stalling task bookkeeping.
+ */
+const GIT_QUERY_TIMEOUT_SECONDS = 10;
+
+/**
+ * Run a short read-only git query in a workspace checkout and return its exit
+ * code plus trimmed stdout.
+ *
+ * Returns undefined only when the command could not be run at all (no git,
+ * unreachable runtime). A non-zero exit is reported via `exitCode` rather than
+ * folded into undefined, because the callers below build base-commit proofs
+ * where "git answered no" and "we could not ask" must stay distinguishable.
+ */
+async function tryRunGitQuery(
+  runtime: Runtime,
+  workspacePath: string,
+  command: string
+): Promise<{ exitCode: number; stdout: string } | undefined> {
+  try {
+    const result = await execBuffered(runtime, command, {
+      cwd: workspacePath,
+      timeout: GIT_QUERY_TIMEOUT_SECONDS,
+    });
+    return { exitCode: result.exitCode, stdout: result.stdout.trim() };
+  } catch {
+    return undefined;
+  }
+}
+
 export async function tryReadGitHeadCommitSha(
   runtime: Runtime,
   workspacePath: string
 ): Promise<string | undefined> {
   assert(workspacePath.length > 0, "tryReadGitHeadCommitSha: workspacePath must be non-empty");
 
-  try {
-    const result = await execBuffered(runtime, "git rev-parse HEAD", {
-      cwd: workspacePath,
-      timeout: 10,
-    });
-    if (result.exitCode !== 0) {
-      return undefined;
-    }
-
-    const sha = result.stdout.trim();
-    return sha.length > 0 ? sha : undefined;
-  } catch {
+  const result = await tryRunGitQuery(runtime, workspacePath, "git rev-parse HEAD");
+  if (result?.exitCode !== 0) {
     return undefined;
   }
+  return result.stdout.length > 0 ? result.stdout : undefined;
 }
 
 /**
@@ -49,24 +72,17 @@ export async function tryReadGitCurrentBranch(
 ): Promise<string | undefined> {
   assert(workspacePath.length > 0, "tryReadGitCurrentBranch: workspacePath must be non-empty");
 
-  try {
-    const result = await execBuffered(runtime, "git rev-parse --abbrev-ref HEAD", {
-      cwd: workspacePath,
-      timeout: 10,
-    });
-    if (result.exitCode !== 0) {
-      return undefined;
-    }
+  const result = await tryRunGitQuery(runtime, workspacePath, "git rev-parse --abbrev-ref HEAD");
+  if (result?.exitCode !== 0) {
+    return undefined;
+  }
 
-    const branch = result.stdout.trim();
-    // Detached HEAD reports the literal string "HEAD" — not a branch identity.
-    if (branch.length === 0 || branch === "HEAD") {
-      return undefined;
-    }
-    return branch;
-  } catch {
+  const branch = result.stdout;
+  // Detached HEAD reports the literal string "HEAD" — not a branch identity.
+  if (branch.length === 0 || branch === "HEAD") {
     return undefined;
   }
+  return branch;
 }
 
 /**
@@ -92,22 +108,22 @@ export async function tryReadGitBranchMatchesOrigin(
   if (headSha == null) {
     return undefined;
   }
-  try {
-    // SECURITY: branch names are repo-controlled input (a git-valid branch can contain
-    // quotes); the full revision argument must be shell-quoted before interpolation.
-    const revision = shellQuote(`origin/${branch}^{commit}`);
-    const result = await execBuffered(runtime, `git rev-parse --verify --quiet ${revision}`, {
-      cwd: workspacePath,
-      timeout: 10,
-    });
-    if (result.exitCode !== 0) {
-      // No origin ref for this branch: the local commit is the only candidate base.
-      return true;
-    }
-    return result.stdout.trim() === headSha;
-  } catch {
+  // SECURITY: branch names are repo-controlled input (a git-valid branch can contain
+  // quotes); the full revision argument must be shell-quoted before interpolation.
+  const revision = shellQuote(`origin/${branch}^{commit}`);
+  const result = await tryRunGitQuery(
+    runtime,
+    workspacePath,
+    `git rev-parse --verify --quiet ${revision}`
+  );
+  if (result == null) {
     return undefined;
   }
+  if (result.exitCode !== 0) {
+    // No origin ref for this branch: the local commit is the only candidate base.
+    return true;
+  }
+  return result.stdout === headSha;
 }
 
 /**
@@ -126,19 +142,16 @@ export async function tryReadGitPathsClean(
   assert(workspacePath.length > 0, "tryReadGitPathsClean: workspacePath must be non-empty");
   assert(pathspecs.length > 0, "tryReadGitPathsClean: pathspecs must be non-empty");
 
-  try {
-    const quoted = pathspecs.map((pathspec) => shellQuote(pathspec)).join(" ");
-    const result = await execBuffered(runtime, `git status --porcelain --ignored -- ${quoted}`, {
-      cwd: workspacePath,
-      timeout: 10,
-    });
-    if (result.exitCode !== 0) {
-      return undefined;
-    }
-    return result.stdout.trim().length === 0;
-  } catch {
+  const quoted = pathspecs.map((pathspec) => shellQuote(pathspec)).join(" ");
+  const result = await tryRunGitQuery(
+    runtime,
+    workspacePath,
+    `git status --porcelain --ignored -- ${quoted}`
+  );
+  if (result?.exitCode !== 0) {
     return undefined;
   }
+  return result.stdout.length === 0;
 }
 
 /**

From 8678e1ccfbd23ed2446543ec69ea09b935f50d58 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 26 Aug 2026 00:12:53 +0000
Subject: [PATCH 80/94] refactor: share one newest-first history tail in
 startup auto-retry

deriveStartupAutoRetryRequest built [...historyTail].reverse() twice to
find the last user and last assistant message. Both scans want the most
recent match, so hoist a single reversed copy and reuse it. .find() does
not mutate, so sharing the array is behavior-preserving.
---
 src/node/services/agentSession.ts | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/src/node/services/agentSession.ts b/src/node/services/agentSession.ts
index 635ded587a..6a0cff1afa 100644
--- a/src/node/services/agentSession.ts
+++ b/src/node/services/agentSession.ts
@@ -1905,21 +1905,22 @@ export class AgentSession {
     partial: MuxMessage | null;
     historyTail: MuxMessage[];
   }): Promise<StartupRetrySendOptions | undefined> {
-    const lastUserMessage = [...params.historyTail]
-      .reverse()
-      .find((message): message is MuxMessage & { role: "user" } =>
+    // Both lookups want the most recent match, so they share one newest-first copy.
+    // The spread is required because `.reverse()` mutates in place; `.find()` does not
+    // mutate, so reusing the same reversed array for both scans is safe.
+    const newestFirstHistoryTail = [...params.historyTail].reverse();
+
+    const lastUserMessage = newestFirstHistoryTail.find(
+      (message): message is MuxMessage & { role: "user" } =>
         this.shouldUseUserMessageForRetry(message)
-      );
+    );
 
     const lastAssistantMessage =
       params.partial?.role === "assistant"
         ? params.partial
-        : [...params.historyTail]
-            .reverse()
-            .find(
-              (message): message is MuxMessage & { role: "assistant" } =>
-                message.role === "assistant"
-            );
+        : newestFirstHistoryTail.find(
+            (message): message is MuxMessage & { role: "assistant" } => message.role === "assistant"
+          );
 
     const workspaceMetadata = await this.getWorkspaceMetadataForRetry();
 

From 582993523fe2fb110eefee3963f8ac73c84cdc30 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 26 Aug 2026 04:28:42 +0000
Subject: [PATCH 81/94] refactor: share the stop-veto restore in
 persistGoalMutationLocked

The eight stop-veto rechecks in persistGoalMutationLocked each unwound the
durable goal record by hand: six repeated the writeGoal+pushSnapshot pair and
two repeated the full restore-or-remove block verbatim. Extract a single
restorePriorRecord() closure over the already-read `current`.

Behavior-preserving: writeGoal takes a non-nullable GoalRecordV1, so the six
two-line sites only compiled because `current` was already narrowed non-null
there, making the closure's else-branch unreachable at those callers.
---
 src/node/services/workspaceGoalService.ts | 48 +++++++++++------------
 1 file changed, 22 insertions(+), 26 deletions(-)

diff --git a/src/node/services/workspaceGoalService.ts b/src/node/services/workspaceGoalService.ts
index 8bff915a8f..4fdeb0ba6b 100644
--- a/src/node/services/workspaceGoalService.ts
+++ b/src/node/services/workspaceGoalService.ts
@@ -3086,6 +3086,20 @@ export class WorkspaceGoalService {
         return stoppedBeforeRead;
       }
       const current = await this.readGoalFile(input.workspaceId);
+      // Unwind for every stop-veto recheck below: restore the durable record to
+      // its pre-mutation state so an aborted turn's write never survives, and
+      // republish so any transiently published snapshot is superseded. When no
+      // goal existed before, the restore is a removal instead of a rewrite.
+      // Shared here because all eight recheck branches unwind identically.
+      const restorePriorRecord = async (): Promise<void> => {
+        if (current) {
+          await this.writeGoal(input.workspaceId, current);
+          await this.pushSnapshot(input.workspaceId, current);
+        } else {
+          await fs.rm(this.getFilePath(input.workspaceId), { force: true });
+          await this.pushSnapshot(input.workspaceId, null);
+        }
+      };
       const conflict =
         this.conflictForExpectedGoalId(current, input.expectedGoalId) ??
         this.conflictForReplacementGuard(current, input.replacementGuard);
@@ -3167,8 +3181,7 @@ export class WorkspaceGoalService {
         // never survives.
         const stoppedDuringEditWrite = discardIfUserStopLanded();
         if (stoppedDuringEditWrite) {
-          await this.writeGoal(input.workspaceId, current);
-          await this.pushSnapshot(input.workspaceId, current);
+          await restorePriorRecord();
           return stoppedDuringEditWrite;
         }
         await this.pushSnapshot(input.workspaceId, withEdits);
@@ -3178,8 +3191,7 @@ export class WorkspaceGoalService {
         // awaited publication step.
         const stoppedDuringEditPublication = discardIfUserStopLanded();
         if (stoppedDuringEditPublication) {
-          await this.writeGoal(input.workspaceId, current);
-          await this.pushSnapshot(input.workspaceId, current);
+          await restorePriorRecord();
           return stoppedDuringEditPublication;
         }
         this.emitBudgetChanged(current, withEdits, input);
@@ -3206,8 +3218,7 @@ export class WorkspaceGoalService {
         if (stoppedDuringEditPromotion) {
           const durableNow = await this.readGoalFile(input.workspaceId);
           if (durableNow?.goalId === withEdits.goalId) {
-            await this.writeGoal(input.workspaceId, current);
-            await this.pushSnapshot(input.workspaceId, current);
+            await restorePriorRecord();
             return stoppedDuringEditPromotion;
           }
         }
@@ -3265,8 +3276,7 @@ export class WorkspaceGoalService {
           // restored record normally).
           const stoppedDuringMutableWrite = discardIfUserStopLanded();
           if (stoppedDuringMutableWrite) {
-            await this.writeGoal(input.workspaceId, current);
-            await this.pushSnapshot(input.workspaceId, current);
+            await restorePriorRecord();
             return stoppedDuringMutableWrite;
           }
           await this.pushSnapshot(input.workspaceId, updated);
@@ -3280,8 +3290,7 @@ export class WorkspaceGoalService {
           // transiently published mutation.
           const stoppedDuringPublication = discardIfUserStopLanded();
           if (stoppedDuringPublication) {
-            await this.writeGoal(input.workspaceId, current);
-            await this.pushSnapshot(input.workspaceId, current);
+            await restorePriorRecord();
             return stoppedDuringPublication;
           }
           this.emitBudgetChanged(current, updated, input);
@@ -3301,8 +3310,7 @@ export class WorkspaceGoalService {
           if (stoppedDuringPromotion) {
             const durableNow = await this.readGoalFile(input.workspaceId);
             if (durableNow?.goalId === updated.goalId) {
-              await this.writeGoal(input.workspaceId, current);
-              await this.pushSnapshot(input.workspaceId, current);
+              await restorePriorRecord();
               return stoppedDuringPromotion;
             }
           }
@@ -3400,13 +3408,7 @@ export class WorkspaceGoalService {
       // record is restored — or removed when no goal existed before.
       const stoppedDuringCreateWrite = discardIfUserStopLanded();
       if (stoppedDuringCreateWrite) {
-        if (current) {
-          await this.writeGoal(input.workspaceId, current);
-          await this.pushSnapshot(input.workspaceId, current);
-        } else {
-          await fs.rm(this.getFilePath(input.workspaceId), { force: true });
-          await this.pushSnapshot(input.workspaceId, null);
-        }
+        await restorePriorRecord();
         return stoppedDuringCreateWrite;
       }
       await this.pushSnapshot(input.workspaceId, next);
@@ -3415,13 +3417,7 @@ export class WorkspaceGoalService {
       // through it (same restore as the post-write branch above).
       const stoppedDuringCreatePublication = discardIfUserStopLanded();
       if (stoppedDuringCreatePublication) {
-        if (current) {
-          await this.writeGoal(input.workspaceId, current);
-          await this.pushSnapshot(input.workspaceId, current);
-        } else {
-          await fs.rm(this.getFilePath(input.workspaceId), { force: true });
-          await this.pushSnapshot(input.workspaceId, null);
-        }
+        await restorePriorRecord();
         return stoppedDuringCreatePublication;
       }
       this.emitBudgetChanged(current, next, input);

From 88aef9cd021e0974a850327bc75c7f4c1dab611d Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 26 Aug 2026 08:20:04 +0000
Subject: [PATCH 82/94] refactor: route the new project-removal preflight
 anchor through resolvePopoverErrorAnchor

#3969 (exclude archived workspaces from projects.list) reworked
handleRequestProjectRemoval to capture the popover anchor up front, since the
context menu now unmounts its button while the new getRemovalBlockers preflight
is awaited. That capture re-inlined the same IIFE anchor math this branch had
already centralized: getBoundingClientRect, plus window.scrollY to convert the
viewport rect into document space, plus a bare 10px gutter past the right edge.

Call the existing resolvePopoverErrorAnchor helper instead, so the arithmetic
and the gutter constant stay defined in exactly one place.

Behavior-preserving: the helper computes the byte-identical expression and
returns undefined for a null/absent element, which is what the removed ternary
produced. The comment explaining *why* the anchor is captured before the await
is retained, because the helper cannot convey that ordering constraint.
---
 src/browser/components/ProjectSidebar/ProjectSidebar.tsx | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/src/browser/components/ProjectSidebar/ProjectSidebar.tsx b/src/browser/components/ProjectSidebar/ProjectSidebar.tsx
index cbbe5a2567..fdbec91dbf 100644
--- a/src/browser/components/ProjectSidebar/ProjectSidebar.tsx
+++ b/src/browser/components/ProjectSidebar/ProjectSidebar.tsx
@@ -1472,13 +1472,7 @@ const ProjectSidebarInner: React.FC<ProjectSidebarProps> = ({
       // Capture the anchor up front: the context menu closes (unmounting the
       // button) while the preflight below is awaited, and a disconnected
       // element would resolve to zero coordinates.
-      const anchor =
-        buttonElement != null
-          ? (() => {
-              const rect = buttonElement.getBoundingClientRect();
-              return { top: rect.top + window.scrollY, left: rect.right + 10 };
-            })()
-          : undefined;
+      const anchor = resolvePopoverErrorAnchor(buttonElement);
       // projects.list excludes archived workspaces (read-side projection), so
       // blocker counts come from a read-only backend preflight instead of the
       // embedded workspace arrays. remove() is deliberately NOT used as the

From a6fcd144f33e57b53176ede3f6a4d9ae650a3681 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Wed, 26 Aug 2026 17:09:05 +0000
Subject: [PATCH 83/94] refactor: share the diff size bound across combineDiffs
 exits

---
 .../utils/messages/extractEditedFiles.ts      | 43 +++++++++----------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/src/common/utils/messages/extractEditedFiles.ts b/src/common/utils/messages/extractEditedFiles.ts
index 1cfea90abd..4f7aa28dfe 100644
--- a/src/common/utils/messages/extractEditedFiles.ts
+++ b/src/common/utils/messages/extractEditedFiles.ts
@@ -367,6 +367,21 @@ export function extractEditedFileDiffs(messages: MuxMessage[]): FileEditDiff[] {
   return results;
 }
 
+/**
+ * Bound one diff to MAX_FILE_CONTENT_SIZE and report whether it was cut.
+ * Every combineDiffs exit (single diff, apply-failure fallback, and the
+ * generated combined diff) applies the identical cap, so the slice and the
+ * truncated flag stay derived from one place and cannot drift apart.
+ */
+function boundedFileEditDiff(filePath: string, diff: string): FileEditDiff {
+  const truncated = diff.length > MAX_FILE_CONTENT_SIZE;
+  return {
+    path: filePath,
+    diff: truncated ? diff.slice(0, MAX_FILE_CONTENT_SIZE) : diff,
+    truncated,
+  };
+}
+
 /**
  * Combine multiple diffs for the same file into a single unified diff.
  * Applies diffs sequentially to reconstruct original→final transformation.
@@ -376,13 +391,7 @@ function combineDiffs(filePath: string, diffs: string[]): FileEditDiff | null {
 
   // Single diff - no combination needed
   if (diffs.length === 1) {
-    const diff = diffs[0];
-    const truncated = diff.length > MAX_FILE_CONTENT_SIZE;
-    return {
-      path: filePath,
-      diff: truncated ? diff.slice(0, MAX_FILE_CONTENT_SIZE) : diff,
-      truncated,
-    };
+    return boundedFileEditDiff(filePath, diffs[0]);
   }
 
   // Multiple diffs - need to combine
@@ -395,24 +404,14 @@ function combineDiffs(filePath: string, diffs: string[]): FileEditDiff | null {
     const result = applyPatch(content, diff);
     if (result === false) {
       // Patch failed to apply - fall back to just using the last diff
-      const lastDiff = diffs[diffs.length - 1];
-      const truncated = lastDiff.length > MAX_FILE_CONTENT_SIZE;
-      return {
-        path: filePath,
-        diff: truncated ? lastDiff.slice(0, MAX_FILE_CONTENT_SIZE) : lastDiff,
-        truncated,
-      };
+      return boundedFileEditDiff(filePath, diffs[diffs.length - 1]);
     }
     content = result;
   }
 
   // Generate combined diff from original to final
-  const combinedDiff = createPatch(filePath, originalContent, content, "", "", { context: 3 });
-  const truncated = combinedDiff.length > MAX_FILE_CONTENT_SIZE;
-
-  return {
-    path: filePath,
-    diff: truncated ? combinedDiff.slice(0, MAX_FILE_CONTENT_SIZE) : combinedDiff,
-    truncated,
-  };
+  return boundedFileEditDiff(
+    filePath,
+    createPatch(filePath, originalContent, content, "", "", { context: 3 })
+  );
 }

From 3023196b1333cf6fe916069abf6f749f28be4115 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Thu, 27 Aug 2026 23:10:04 +0000
Subject: [PATCH 84/94] refactor: extract appendGitConfigOverride for numbered
 git config overrides

The GIT_CONFIG_KEY_<n>/GIT_CONFIG_VALUE_<n>/index++ idiom was inlined at four
sites across appendDisabledRepoAutomationDrivers and
combineGitNoRepoAutomationEnvs. Centralize it so the key/value suffixes cannot
drift apart from each other or from the GIT_CONFIG_COUNT written at the end.
Behavior is unchanged.
---
 src/node/utils/gitNoHooksEnv.ts | 38 ++++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/src/node/utils/gitNoHooksEnv.ts b/src/node/utils/gitNoHooksEnv.ts
index 832122411f..85e03f077e 100644
--- a/src/node/utils/gitNoHooksEnv.ts
+++ b/src/node/utils/gitNoHooksEnv.ts
@@ -148,6 +148,23 @@ const REPO_AUTOMATION_CONFIG_KEY_REGEX =
   /^(filter|diff|merge|remote)[.](.+)[.](clean|smudge|process|required|command|textconv|driver|uploadpack|receivepack|vcs|proxy)$/i;
 const MAX_REPO_AUTOMATION_DRIVERS = 128;
 
+/**
+ * Write one numbered `GIT_CONFIG_KEY_<n>`/`GIT_CONFIG_VALUE_<n>` override pair and return the next
+ * index. Every override append goes through this so the key/value suffixes can never drift apart
+ * from each other or from the `GIT_CONFIG_COUNT` the callers write at the end: a mismatched pair
+ * would silently drop a repo-automation override git is supposed to neutralize.
+ */
+function appendGitConfigOverride(
+  env: Record<string, string>,
+  index: number,
+  key: string,
+  value: string
+): number {
+  env["GIT_CONFIG_KEY_" + index] = key;
+  env["GIT_CONFIG_VALUE_" + index] = value;
+  return index + 1;
+}
+
 function appendDisabledRepoAutomationDrivers(
   env: Record<string, string>,
   configEntries: Iterable<string>
@@ -217,14 +234,10 @@ function appendDisabledRepoAutomationDrivers(
 
   let configIndex = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10);
   for (const key of [...exactKeys].sort()) {
-    env["GIT_CONFIG_KEY_" + configIndex] = key;
-    env["GIT_CONFIG_VALUE_" + configIndex] = "";
-    configIndex += 1;
+    configIndex = appendGitConfigOverride(env, configIndex, key, "");
   }
   if (hasDiffExternal) {
-    env["GIT_CONFIG_KEY_" + configIndex] = "diff.external";
-    env["GIT_CONFIG_VALUE_" + configIndex] = "";
-    configIndex += 1;
+    configIndex = appendGitConfigOverride(env, configIndex, "diff.external", "");
   }
   for (const { kind, name } of [...drivers.values()].sort((a, b) =>
     (a.kind + "\0" + a.name).localeCompare(b.kind + "\0" + b.name)
@@ -251,9 +264,12 @@ function appendDisabledRepoAutomationDrivers(
                 ["proxy", ""],
               ] as const);
     for (const [field, value] of fields) {
-      env["GIT_CONFIG_KEY_" + configIndex] = kind + "." + name + "." + field;
-      env["GIT_CONFIG_VALUE_" + configIndex] = value;
-      configIndex += 1;
+      configIndex = appendGitConfigOverride(
+        env,
+        configIndex,
+        kind + "." + name + "." + field,
+        value
+      );
     }
   }
   env.GIT_CONFIG_COUNT = String(configIndex);
@@ -295,9 +311,7 @@ export function combineGitNoRepoAutomationEnvs(
   }
   let index = baseCount;
   for (const [key, value] of [...overrides].sort(([a], [b]) => a.localeCompare(b))) {
-    env["GIT_CONFIG_KEY_" + index] = key;
-    env["GIT_CONFIG_VALUE_" + index] = value;
-    index += 1;
+    index = appendGitConfigOverride(env, index, key, value);
   }
   env.GIT_CONFIG_COUNT = String(index);
   return env;

From 848f943eb4f15a8b6e072312ea3363859e5055d5 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:53:00 +0000
Subject: [PATCH 85/94] refactor: use isEnoentError helper for remaining inline
 ENOENT check

The editConfig re-read guard was the last ENOENT check in config.ts still
written as an inline `as NodeJS.ErrnoException` cast. Every other site
already routes through the module-private `isEnoentError` type guard, so
this finishes the deduplication and drops the type assertion in line with
the repo's preference for type guards over casts.

Behavior-preserving: fs.readFileSync only ever throws errno Error objects,
for which the guard and the cast agree exactly.
---
 src/node/config/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/node/config/index.ts b/src/node/config/index.ts
index 07d7f976cd..8d5b5d1bbd 100644
--- a/src/node/config/index.ts
+++ b/src/node/config/index.ts
@@ -2457,7 +2457,7 @@ export class Config {
           const currentBytes = fs.readFileSync(this.configFile);
           currentSignature = configContentSignature(currentBytes);
         } catch (readError) {
-          if ((readError as NodeJS.ErrnoException).code !== "ENOENT") {
+          if (!isEnoentError(readError)) {
             rejectEdit(
               `the file could not be re-read before writing (${readError instanceof Error ? readError.message : String(readError)}). Retry the settings change.`
             );

From 971a6e6788abcee17ced80a2958da9bb3fd80025 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:16:17 +0000
Subject: [PATCH 86/94] refactor: dedupe the queue-cut takeover-stream check

Both attribution readers added in #4000 (getQueueCutSupersedeEvidence and
findSameOwnerFollowUpForDisposableTransfer) inlined the same
"snapshot's active stream is a different message than the ended one"
test. Extract findQueueCutTakeoverStream so cut attribution and
disposable-ownership forwarding cannot drift on what counts as already
streaming at the cut.
---
 src/node/services/taskService.ts | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index b8a9422e14..888c92920a 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -1052,6 +1052,23 @@ interface QueueCutAttributionSnapshot {
   hasPendingQueuedOrPreparingTurn: boolean;
 }
 
+/**
+ * The snapshot's active stream when it is a DIFFERENT (uncorrelated) message
+ * than the ended one: input that had already taken over the session at this
+ * cut, so its metadata — not the queue's — attributes the cut. Shared by cut
+ * attribution and disposable-ownership forwarding so the two cannot drift on
+ * what counts as "already streaming at the cut".
+ */
+function findQueueCutTakeoverStream(
+  event: StreamEndEvent,
+  snapshot: QueueCutAttributionSnapshot
+): { messageId: string; muxMetadata: unknown } | undefined {
+  const { activeStream } = snapshot;
+  return activeStream != null && activeStream.messageId !== event.messageId
+    ? activeStream
+    : undefined;
+}
+
 /**
  * Settled workspace-turn records eligible for self-heal correction (resettle from a
  * correlated stream-end, or read-time repair/revive): transient stream-error settlements
@@ -15035,10 +15052,11 @@ export class TaskService implements AgentTaskIntegration {
     };
     // Already streaming at the cut: the uncorrelated active stream is the
     // engaged cutter.
-    const { activeStream, cutter } = snapshot;
-    if (activeStream != null && activeStream.messageId !== event.messageId) {
-      return classifyMetadata(activeStream.muxMetadata);
+    const takeoverStream = findQueueCutTakeoverStream(event, snapshot);
+    if (takeoverStream != null) {
+      return classifyMetadata(takeoverStream.muxMetadata);
     }
+    const { cutter } = snapshot;
     if (cutter?.stage === "preparing" || cutter?.stage === "dispatching") {
       // Engaged stages report even with undefined metadata (manual message) so
       // a same-owner follow-up queued BEHIND the engaged cutter cannot be
@@ -15083,10 +15101,11 @@ export class TaskService implements AgentTaskIntegration {
     record: WorkspaceTurnTaskHandleRecord,
     snapshot: QueueCutAttributionSnapshot
   ): string | undefined {
-    const { activeStream, cutter } = snapshot;
-    if (activeStream != null && activeStream.messageId !== event.messageId) {
-      return this.sameOwnerFollowUpHandleIdFromMetadata(record, activeStream.muxMetadata);
+    const takeoverStream = findQueueCutTakeoverStream(event, snapshot);
+    if (takeoverStream != null) {
+      return this.sameOwnerFollowUpHandleIdFromMetadata(record, takeoverStream.muxMetadata);
     }
+    const { cutter } = snapshot;
     return cutter != null
       ? this.sameOwnerFollowUpHandleIdFromMetadata(record, cutter.muxMetadata)
       : undefined;

From c6858f5e7ee9267e8d6355da455b554f389443b6 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 29 Aug 2026 04:12:11 +0000
Subject: [PATCH 87/94] refactor: dedupe the abort-forwarding wiring in
 execFileIO

readFileViaExec and writeFileViaExec each built an internal AbortController
that mirrors the caller's optional signal, using identical logic that differed
only in local identifier names: construct a controller, abort it synchronously
when the caller's signal is already aborted, otherwise register a once-only
forwarder, and expose a cleanup closure that unregisters it.

Extract forkAbortSignal so both sites share one implementation. The two
easy-to-miss details -- honoring an already-aborted signal synchronously
(its "abort" event will never fire again) and keeping cleanup reachable from
every terminal path -- now live in one place. Call sites keep their existing
local names, so the rest of both function bodies are unchanged.

Behavior-preserving: same construction order, same { once: true } option, and
removeEventListener still receives the same function identity that was
registered.
---
 src/node/runtime/execFileIO.ts | 53 +++++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 20 deletions(-)

diff --git a/src/node/runtime/execFileIO.ts b/src/node/runtime/execFileIO.ts
index 9a7d5afaa8..d2204edb88 100644
--- a/src/node/runtime/execFileIO.ts
+++ b/src/node/runtime/execFileIO.ts
@@ -14,6 +14,36 @@ import { streamToString } from "./streamUtils";
 /** Starts the exec for one file operation; must honor the given signal. */
 type StartExec = (abortSignal: AbortSignal) => Promise<ExecStream>;
 
+/**
+ * Fork an internal AbortController that also aborts when `abortSignal` does.
+ *
+ * Both streaming helpers below need a controller they can abort themselves (on
+ * stream cancel/abort) while still following the caller's signal, so each had
+ * its own copy of this wiring. Sharing one keeps the two easy-to-miss details
+ * identical at both sites: an already-aborted caller signal must be honored
+ * synchronously, because the "abort" event has already fired and will never
+ * fire again; and `cleanup` must be reachable from every terminal path so a
+ * long-lived caller signal does not accumulate forwarders.
+ */
+function forkAbortSignal(abortSignal?: AbortSignal): {
+  controller: AbortController;
+  cleanup: () => void;
+} {
+  const controller = new AbortController();
+  const forwardAbort = () => controller.abort();
+  if (abortSignal?.aborted) {
+    controller.abort();
+  } else {
+    abortSignal?.addEventListener("abort", forwardAbort, { once: true });
+  }
+  return {
+    controller,
+    cleanup: () => {
+      abortSignal?.removeEventListener("abort", forwardAbort);
+    },
+  };
+}
+
 /**
  * Read file contents as a stream via exec.
  */
@@ -27,16 +57,7 @@ export function readFileViaExec(
   // it a cancelled wrapper (e.g. mux.load's byte ceiling) left cat blocked
   // until its 300s timeout, accumulating remote processes (r18). The
   // caller's abortSignal forwards into the same controller.
-  const readAbort = new AbortController();
-  const forwardAbort = () => readAbort.abort();
-  if (abortSignal?.aborted) {
-    readAbort.abort();
-  } else {
-    abortSignal?.addEventListener("abort", forwardAbort, { once: true });
-  }
-  const cleanupAbortForwarder = () => {
-    abortSignal?.removeEventListener("abort", forwardAbort);
-  };
+  const { controller: readAbort, cleanup: cleanupAbortForwarder } = forkAbortSignal(abortSignal);
 
   return new ReadableStream<Uint8Array>({
     cancel: () => {
@@ -93,16 +114,8 @@ export function writeFileViaExec(
   abortSignal?: AbortSignal
 ): WritableStream<Uint8Array> {
   let execPromise: Promise<ExecStream> | null = null;
-  const writeAbortController = new AbortController();
-  const abortWrite = () => writeAbortController.abort();
-  if (abortSignal?.aborted) {
-    writeAbortController.abort();
-  } else {
-    abortSignal?.addEventListener("abort", abortWrite, { once: true });
-  }
-  const cleanupAbortForwarder = () => {
-    abortSignal?.removeEventListener("abort", abortWrite);
-  };
+  const { controller: writeAbortController, cleanup: cleanupAbortForwarder } =
+    forkAbortSignal(abortSignal);
 
   const getExecStream = () => {
     execPromise ??= startExec(writeAbortController.signal);

From 5b84376a9ee4e07a660598227d2def9c81a7380f Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 29 Aug 2026 12:37:46 +0000
Subject: [PATCH 88/94] refactor: drop the orphaned BridgeableToolName type

#4003 (derive tool dispatch tables from the TOOL_DEFINITIONS catalog)
replaced the RESULT_SCHEMAS lookup in ptc/typeGenerator.ts with the
getToolResultSchema() helper, removing the only consumer of the
BridgeableToolName type. The same commit also rewrote the tools.ts
comment that pointed readers at it, so nothing references the type
anymore.

Type-only and erased at compile time, so this is behavior-preserving.
---
 src/common/utils/tools/toolDefinitions.ts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/common/utils/tools/toolDefinitions.ts b/src/common/utils/tools/toolDefinitions.ts
index 6a6f89ff5f..01e52db32f 100644
--- a/src/common/utils/tools/toolDefinitions.ts
+++ b/src/common/utils/tools/toolDefinitions.ts
@@ -3412,10 +3412,6 @@ CREATE TABLE IF NOT EXISTS delegation_rollups (
 
 export type ToolName = keyof typeof TOOL_DEFINITIONS;
 
-export type BridgeableToolName = {
-  [K in ToolName]: (typeof TOOL_DEFINITIONS)[K] extends { resultSchema: z.ZodType } ? K : never;
-}[ToolName];
-
 export function getToolResultSchema(toolName: string): z.ZodType | undefined {
   if (!Object.hasOwn(TOOL_DEFINITIONS, toolName)) return undefined;
   const definition = TOOL_DEFINITIONS[toolName as ToolName];

From 0712255122e79a47b5a736304147e554d45075b3 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sat, 29 Aug 2026 20:11:47 +0000
Subject: [PATCH 89/94] refactor: route quickjsRuntime marker tests through
 isKernelBoundedMarker

#4001 added a shared isKernelBoundedMarker type guard in
src/common/utils/tools/kernelBoundedMarker.ts and wired it into the
renderer, but left the producer side spelling the same predicate by
hand: applyRetainedResultFields (added in that same commit) and the
pre-existing preserveSuccessBit each re-inlined the typeof/null/
__kernelBounded === true chain with its own cast. Both now call the
guard, making it the single definition of the marker test in
quickjsRuntime.ts and removing the file's last two marker casts.
---
 src/node/services/ptc/quickjsRuntime.ts | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/src/node/services/ptc/quickjsRuntime.ts b/src/node/services/ptc/quickjsRuntime.ts
index e002306d4a..b41242a89e 100644
--- a/src/node/services/ptc/quickjsRuntime.ts
+++ b/src/node/services/ptc/quickjsRuntime.ts
@@ -21,6 +21,7 @@ import {
   KERNEL_RETAINED_EXECUTION_BUDGET_BYTES,
 } from "@/constants/kernelOutput";
 import { sliceUtf8Bytes } from "@/common/utils/sliceUtf8Bytes";
+import { isKernelBoundedMarker } from "@/common/utils/tools/kernelBoundedMarker";
 
 /** Capture-time console retention accounting for one eval (see setupConsole). */
 interface ConsoleCaptureBudget {
@@ -776,11 +777,7 @@ export class QuickJSRuntime implements IJSRuntime {
    * captureArgsRetained merge in boundCaptureArgs). No-op for results that
    * survived bounding inline. */
   private applyRetainedResultFields(bounded: unknown, toolName: string, source: unknown): unknown {
-    if (
-      typeof bounded !== "object" ||
-      bounded === null ||
-      (bounded as { __kernelBounded?: boolean }).__kernelBounded !== true
-    ) {
+    if (!isKernelBoundedMarker(bounded)) {
       return bounded;
     }
     const retained = this.kernelRecordBounds?.captureResultRetained?.(toolName, source);
@@ -796,12 +793,7 @@ export class QuickJSRuntime implements IJSRuntime {
   private static preserveSuccessBit(bounded: unknown, source: unknown): unknown {
     if (typeof source !== "object" || source === null) return bounded;
     const success = (source as { success?: unknown }).success;
-    if (
-      typeof success === "boolean" &&
-      typeof bounded === "object" &&
-      bounded !== null &&
-      (bounded as { __kernelBounded?: boolean }).__kernelBounded === true
-    ) {
+    if (typeof success === "boolean" && isKernelBoundedMarker(bounded)) {
       return { ...bounded, success };
     }
     return bounded;

From 94841ea5168a3a7c5259f45e9842a7cd7f8cb0aa Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 20:09:50 +0000
Subject: [PATCH 90/94] refactor: extract reuseCachedMethodHandle for
 registerObject handle cache

The async and sync method loops in registerObject each inlined the same
cache lookup: reuse the cached guest function when its kind matches, else
dispose the stale handle and fall through to mint a replacement. Extracted
into a private helper and named the cache entry types so the field
declaration and helper signature share one definition.

Behavior-preserving: the helper returns true only in the same case the
loops previously used to skip minting.
---
 src/node/services/ptc/quickjsRuntime.ts | 58 +++++++++++++++----------
 1 file changed, 36 insertions(+), 22 deletions(-)

diff --git a/src/node/services/ptc/quickjsRuntime.ts b/src/node/services/ptc/quickjsRuntime.ts
index b41242a89e..9fb3c9b88d 100644
--- a/src/node/services/ptc/quickjsRuntime.ts
+++ b/src/node/services/ptc/quickjsRuntime.ts
@@ -46,6 +46,17 @@ const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
  * dispatch corrupt. */
 const HOST_FN_ID_LIMIT = 60_000;
 
+/** A guest function minted for one registerObject method, tagged with the
+ * wrapper kind it was created through so a later registration can tell a
+ * reusable handle from one that must be replaced. */
+interface CachedMethodHandle {
+  kind: "async" | "sync";
+  handle: QuickJSHandle;
+}
+
+/** Cached guest functions for one registerObject name, keyed by method name. */
+type MethodHandleCache = Map<string, CachedMethodHandle>;
+
 /** Generate a short random ID for PTC nested tool calls (10 hex chars). */
 function generateCallId(): string {
   return crypto.randomBytes(5).toString("hex");
@@ -275,10 +286,7 @@ export class QuickJSRuntime implements IJSRuntime {
    * and misrouted every later xum.* call to an unrelated tool. Dispatch is
    * late-bound through the maps above, so a cached guest function stays
    * correct across re-registrations; only never-seen method names allocate. */
-  private readonly registeredObjectFnHandles = new Map<
-    string,
-    Map<string, { kind: "async" | "sync"; handle: QuickJSHandle }>
-  >();
+  private readonly registeredObjectFnHandles = new Map<string, MethodHandleCache>();
   /** Host-function ids minted on this context; see HOST_FN_ID_LIMIT. */
   private hostFnAllocations = 0;
 
@@ -977,16 +985,7 @@ export class QuickJSRuntime implements IJSRuntime {
     const objHandle = this.ctx.newObject();
 
     for (const methodName of Object.keys(obj)) {
-      const cachedAsync = fnCache.get(methodName);
-      if (cachedAsync?.kind === "async") {
-        this.ctx.setProp(objHandle, methodName, cachedAsync.handle);
-        continue;
-      }
-      if (cachedAsync !== undefined) {
-        // The method flipped kinds since the last registration; the cached
-        // guest function would route through the wrong wrapper. Replace it.
-        cachedAsync.handle.dispose();
-      }
+      if (this.reuseCachedMethodHandle(fnCache, objHandle, methodName, "async")) continue;
       const fnHandle = this.newAsyncifiedHostFunction(methodName, async (...argHandles) => {
         if (this.abortController?.signal.aborted) {
           throw new Error("Execution aborted");
@@ -1080,14 +1079,7 @@ export class QuickJSRuntime implements IJSRuntime {
     // call them — asyncify replays the call and returns garbage. Sync methods
     // never suspend, so they stay safe post-await (see registerSyncFunction).
     for (const methodName of Object.keys(syncMethods ?? {})) {
-      const cachedSync = fnCache.get(methodName);
-      if (cachedSync?.kind === "sync") {
-        this.ctx.setProp(objHandle, methodName, cachedSync.handle);
-        continue;
-      }
-      if (cachedSync !== undefined) {
-        cachedSync.handle.dispose();
-      }
+      if (this.reuseCachedMethodHandle(fnCache, objHandle, methodName, "sync")) continue;
       const fnHandle = this.newHostFunction(methodName, (...argHandles) => {
         // Late-bound dispatch (see registeredObjects note above).
         const fn = this.registeredObjectSyncMethods.get(name)?.[methodName];
@@ -1343,6 +1335,28 @@ export class QuickJSRuntime implements IJSRuntime {
     return this.ctx.newAsyncifiedFunction(name, fn);
   }
 
+  /** Bind the cached guest function for `methodName` onto `objHandle` when it
+   * was minted through the same wrapper, returning true so the caller skips
+   * minting a fresh host-function id (see HOST_FN_ID_LIMIT). A handle of the
+   * other kind would route through the wrong wrapper, so it is disposed and
+   * the caller mints a replacement. */
+  private reuseCachedMethodHandle(
+    fnCache: MethodHandleCache,
+    objHandle: QuickJSHandle,
+    methodName: string,
+    kind: CachedMethodHandle["kind"]
+  ): boolean {
+    const cached = fnCache.get(methodName);
+    if (cached === undefined) return false;
+    if (cached.kind === kind) {
+      this.ctx.setProp(objHandle, methodName, cached.handle);
+      return true;
+    }
+    // The method flipped kinds since the last registration.
+    cached.handle.dispose();
+    return false;
+  }
+
   private trackHostFnAllocation(name: string): void {
     this.hostFnAllocations += 1;
     if (this.hostFnAllocations > HOST_FN_ID_LIMIT) {

From 8d4aa23f59b208c13ce0dd8eee183ad26f53fb9f Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 04:11:10 +0000
Subject: [PATCH 91/94] refactor: dedupe failed project-result construction in
 applyProjectPatch

`applyProjectPatch` has ten failure exits that each rebuilt the same
`{ success: false, projectResult: { projectPath, projectName, status:
"failed", ... } }` shape, so every branch repeated three lines of project
identity before getting to the error/conflict/note details that actually
differ. A local `failed()` helper builds that shared shape once and each
branch now passes only its own details.

Behavior-preserving: the emitted project results are identical.

Co-authored-by: mux-bot[bot] <264182336+mux-bot[bot]@users.noreply.github.com>
---
 src/node/services/taskGitPatchEngine.ts | 189 +++++++++---------------
 1 file changed, 72 insertions(+), 117 deletions(-)

diff --git a/src/node/services/taskGitPatchEngine.ts b/src/node/services/taskGitPatchEngine.ts
index fa0bb28d7b..02a5622268 100644
--- a/src/node/services/taskGitPatchEngine.ts
+++ b/src/node/services/taskGitPatchEngine.ts
@@ -1245,21 +1245,30 @@ async function applyProjectPatch(params: {
   isReplay: boolean;
   abortSignal?: AbortSignal;
 }): Promise<{ success: boolean; projectResult: TaskApplyGitPatchProjectResult }> {
+  // Every failure path below reports the same project identity with status
+  // "failed"; only the error/conflict/note details differ. Building that shared
+  // shape once keeps each branch focused on what actually varies.
+  const failed = (
+    details: Omit<TaskApplyGitPatchProjectResult, "projectPath" | "projectName" | "status">
+  ): { success: false; projectResult: TaskApplyGitPatchProjectResult } => ({
+    success: false,
+    projectResult: {
+      projectPath: params.projectArtifact.projectPath,
+      projectName: params.projectArtifact.projectName,
+      status: "failed",
+      ...details,
+    },
+  });
+
   const taskIdError = validatePatchRuntimePathComponent(params.taskId, "task_id");
   const storageKeyError = validatePatchRuntimePathComponent(
     params.projectArtifact.storageKey,
     "storageKey"
   );
   if (taskIdError != null || storageKeyError != null) {
-    return {
-      success: false,
-      projectResult: {
-        projectPath: params.projectArtifact.projectPath,
-        projectName: params.projectArtifact.projectName,
-        status: "failed",
-        error: taskIdError ?? storageKeyError,
-      },
-    };
+    return failed({
+      error: taskIdError ?? storageKeyError,
+    });
   }
 
   const remotePatchPath = buildRuntimeTempPath({
@@ -1283,16 +1292,10 @@ async function applyProjectPatch(params: {
     artifactLookupNote: params.artifactLookupNote,
   });
   if ("error" in patchResolution) {
-    return {
-      success: false,
-      projectResult: {
-        projectPath: params.projectArtifact.projectPath,
-        projectName: params.projectArtifact.projectName,
-        status: "failed",
-        error: patchResolution.error,
-        note: patchResolution.note,
-      },
-    };
+    return failed({
+      error: patchResolution.error,
+      note: patchResolution.note,
+    });
   }
 
   const gitPrefix = await gitNoRepoAutomationPrefixForRuntime({
@@ -1307,16 +1310,10 @@ async function applyProjectPatch(params: {
     gitPrefix,
   });
   if (expectedHeadError != null) {
-    return {
-      success: false,
-      projectResult: {
-        projectPath: params.projectArtifact.projectPath,
-        projectName: params.projectArtifact.projectName,
-        status: "failed",
-        error: expectedHeadError,
-        note: patchResolution.note,
-      },
-    };
+    return failed({
+      error: expectedHeadError,
+      note: patchResolution.note,
+    });
   }
 
   try {
@@ -1340,20 +1337,14 @@ async function applyProjectPatch(params: {
         gitPrefix,
       });
       if (dryRunDirtyOverlap != null) {
-        return {
-          success: false,
-          projectResult: {
-            projectPath: params.projectArtifact.projectPath,
-            projectName: params.projectArtifact.projectName,
-            status: "failed",
-            error: dryRunDirtyOverlap.error,
-            conflictPaths: dryRunDirtyOverlap.conflictPaths,
-            note: mergeNotes(
-              patchResolution.note,
-              "Commit or stash local changes on overlapping patch paths before applying. Unrelated dirty files can remain in place."
-            ),
-          },
-        };
+        return failed({
+          error: dryRunDirtyOverlap.error,
+          conflictPaths: dryRunDirtyOverlap.conflictPaths,
+          note: mergeNotes(
+            patchResolution.note,
+            "Commit or stash local changes on overlapping patch paths before applying. Unrelated dirty files can remain in place."
+          ),
+        });
       }
 
       const dryRunHeadError = await checkExpectedHead({
@@ -1363,16 +1354,10 @@ async function applyProjectPatch(params: {
         gitPrefix,
       });
       if (dryRunHeadError != null) {
-        return {
-          success: false,
-          projectResult: {
-            projectPath: params.projectArtifact.projectPath,
-            projectName: params.projectArtifact.projectName,
-            status: "failed",
-            error: dryRunHeadError,
-            note: patchResolution.note,
-          },
-        };
+        return failed({
+          error: dryRunHeadError,
+          note: patchResolution.note,
+        });
       }
       const dryRunId = `${Date.now().toString(16)}-${Math.random().toString(16).slice(2, 8)}`;
       const dryRunWorktreePath = buildRuntimeTempPath({
@@ -1387,15 +1372,9 @@ async function applyProjectPatch(params: {
         { cwd: params.repoCwd, timeout: 60 }
       );
       if (addResult.exitCode !== 0) {
-        return {
-          success: false,
-          projectResult: {
-            projectPath: params.projectArtifact.projectPath,
-            projectName: params.projectArtifact.projectName,
-            status: "failed",
-            error: addResult.stderr.trim() || addResult.stdout.trim() || "git worktree add failed",
-          },
-        };
+        return failed({
+          error: addResult.stderr.trim() || addResult.stdout.trim() || "git worktree add failed",
+        });
       }
 
       try {
@@ -1426,24 +1405,18 @@ async function applyProjectPatch(params: {
           });
           const failedPatchSubject = parseFailedPatchSubjectFromGitAmOutput(errorOutput);
 
-          return {
-            success: false,
-            projectResult: {
-              projectPath: params.projectArtifact.projectPath,
-              projectName: params.projectArtifact.projectName,
-              status: "failed",
-              conflictPaths,
-              failedPatchSubject,
-              error:
-                errorOutput.length > 0
-                  ? errorOutput
-                  : `git am failed (exitCode=${amResult.exitCode})`,
-              note: mergeNotes(
-                patchResolution.note,
-                "Dry run failed; the patch does not apply cleanly against the current HEAD. If this is a parent integration workspace, do not attempt a real apply here; delegate conflict resolution to a sub-agent that can replay and resolve the patch. Dedicated reconciliation workspaces can proceed with real apply plus manual conflict resolution (`git am --continue` / `git am --abort`)."
-              ),
-            },
-          };
+          return failed({
+            conflictPaths,
+            failedPatchSubject,
+            error:
+              errorOutput.length > 0
+                ? errorOutput
+                : `git am failed (exitCode=${amResult.exitCode})`,
+            note: mergeNotes(
+              patchResolution.note,
+              "Dry run failed; the patch does not apply cleanly against the current HEAD. If this is a parent integration workspace, do not attempt a real apply here; delegate conflict resolution to a sub-agent that can replay and resolve the patch. Dedicated reconciliation workspaces can proceed with real apply plus manual conflict resolution (`git am --continue` / `git am --abort`)."
+            ),
+          });
         }
 
         const appliedCommits = await getAppliedCommits({
@@ -1556,20 +1529,14 @@ async function applyProjectPatch(params: {
       gitPrefix,
     });
     if (dirtyOverlap != null) {
-      return {
-        success: false,
-        projectResult: {
-          projectPath: params.projectArtifact.projectPath,
-          projectName: params.projectArtifact.projectName,
-          status: "failed",
-          error: dirtyOverlap.error,
-          conflictPaths: dirtyOverlap.conflictPaths,
-          note: mergeNotes(
-            patchResolution.note,
-            "Commit or stash local changes on overlapping patch paths before applying. Unrelated dirty files can remain in place."
-          ),
-        },
-      };
+      return failed({
+        error: dirtyOverlap.error,
+        conflictPaths: dirtyOverlap.conflictPaths,
+        note: mergeNotes(
+          patchResolution.note,
+          "Commit or stash local changes on overlapping patch paths before applying. Unrelated dirty files can remain in place."
+        ),
+      });
     }
 
     const applyHeadError = await checkExpectedHead({
@@ -1579,16 +1546,10 @@ async function applyProjectPatch(params: {
       gitPrefix,
     });
     if (applyHeadError != null) {
-      return {
-        success: false,
-        projectResult: {
-          projectPath: params.projectArtifact.projectPath,
-          projectName: params.projectArtifact.projectName,
-          status: "failed",
-          error: applyHeadError,
-          note: patchResolution.note,
-        },
-      };
+      return failed({
+        error: applyHeadError,
+        note: patchResolution.note,
+      });
     }
 
     const beforeHeadSha = await tryRevParseHead({
@@ -1627,19 +1588,13 @@ async function applyProjectPatch(params: {
           ? "git am stopped in conflict-recovery state. Resolve conflicts/issues and run `git am --continue`, or run `git am --abort` to restore a clean working tree and delegate resolution to a sub-agent."
           : "git am failed before entering conflict-recovery state. Review the error output above and fix the patch/input before retrying.";
 
-      return {
-        success: false,
-        projectResult: {
-          projectPath: params.projectArtifact.projectPath,
-          projectName: params.projectArtifact.projectName,
-          status: "failed",
-          conflictPaths,
-          failedPatchSubject,
-          error:
-            errorOutput.length > 0 ? errorOutput : `git am failed (exitCode=${amResult.exitCode})`,
-          note: mergeNotes(patchResolution.note, conflictRecoveryNote),
-        },
-      };
+      return failed({
+        conflictPaths,
+        failedPatchSubject,
+        error:
+          errorOutput.length > 0 ? errorOutput : `git am failed (exitCode=${amResult.exitCode})`,
+        note: mergeNotes(patchResolution.note, conflictRecoveryNote),
+      });
     }
 
     const headCommitSha = await tryRevParseHead({

From d4d962a1b76765f035e49605d8da2c1f01bdddee Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 08:11:13 +0000
Subject: [PATCH 92/94] refactor: extract prepareLockDir for the shared
 lock-install prelude

---
 src/node/config/fileLeaseManager.ts | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/node/config/fileLeaseManager.ts b/src/node/config/fileLeaseManager.ts
index 9a52bd05cb..aeefbd6531 100644
--- a/src/node/config/fileLeaseManager.ts
+++ b/src/node/config/fileLeaseManager.ts
@@ -98,6 +98,22 @@ export class FileLeaseManager {
     }
   }
 
+  /**
+   * Prepares the filesystem for a lock install: the xum home directory may not
+   * exist yet on a fresh install, and crash-abandoned stages from a previous run
+   * must be swept before we start racing for the lock itself.
+   *
+   * The existsSync guard is deliberate rather than redundant: ensurePrivateDirSync
+   * also chmods an already-existing directory, and callers only want to create a
+   * missing one.
+   */
+  private prepareLockDir(lockPath: string, staleMs: number): void {
+    if (!fs.existsSync(this.rootDir)) {
+      ensurePrivateDirSync(this.rootDir);
+    }
+    this.cleanupAbandonedStageDirs(lockPath, staleMs);
+  }
+
   /** Acquires a bounded lock without deleting a live or successor generation. */
   private async withDirLock<T>(
     lockPath: string,
@@ -108,10 +124,7 @@ export class FileLeaseManager {
     const RETRY_DELAY_MS = 25;
     const deadline = Date.now() + acquireTimeoutMs;
 
-    if (!fs.existsSync(this.rootDir)) {
-      ensurePrivateDirSync(this.rootDir);
-    }
-    this.cleanupAbandonedStageDirs(lockPath, staleLockMs);
+    this.prepareLockDir(lockPath, staleLockMs);
 
     let ownerFile: string;
     for (;;) {
@@ -161,11 +174,7 @@ export class FileLeaseManager {
   tryAcquireCoderOauthClientLease(ttlMs: number): (() => void) | null {
     const leasePath = `${this.providersFile}.coder-client.lock`;
 
-    if (!fs.existsSync(this.rootDir)) {
-      ensurePrivateDirSync(this.rootDir);
-    }
-
-    this.cleanupAbandonedStageDirs(leasePath, ttlMs);
+    this.prepareLockDir(leasePath, ttlMs);
 
     for (let attempt = 0; attempt < 2; attempt++) {
       let ownerFile: string;

From 83fc6fc57305ccc4014b460fb67d6ff5080f5d08 Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 12:13:23 +0000
Subject: [PATCH 93/94] refactor: extract workflowRunStoreFor for per-workspace
 run stores

---
 src/node/services/taskService.ts | 52 ++++++++++++++------------------
 1 file changed, 22 insertions(+), 30 deletions(-)

diff --git a/src/node/services/taskService.ts b/src/node/services/taskService.ts
index 888c92920a..873fc721e6 100644
--- a/src/node/services/taskService.ts
+++ b/src/node/services/taskService.ts
@@ -1922,6 +1922,18 @@ export class TaskService implements AgentTaskIntegration {
     return Array.from(runIds);
   }
 
+  /**
+   * Workflow-run reads here all open a per-workspace store over that workspace's session
+   * directory, so the sessionDir join lives in exactly one place. The store constructor is
+   * pure bookkeeping (no I/O), so a fresh instance per call matches the previous inline
+   * construction exactly.
+   */
+  private workflowRunStoreFor(workspaceId: string): WorkflowRunStore {
+    return new WorkflowRunStore({
+      sessionDir: path.join(this.config.sessionsDir, workspaceId),
+    });
+  }
+
   private async listActiveBackgroundWorkflowRunIds(
     workspaceId: string,
     referencedWorkflowRunIds: readonly string[]
@@ -1933,9 +1945,7 @@ export class TaskService implements AgentTaskIntegration {
 
     try {
       const referencedRunIdSet = new Set(referencedWorkflowRunIds);
-      const runStore = new WorkflowRunStore({
-        sessionDir: path.join(this.config.sessionsDir, workspaceId),
-      });
+      const runStore = this.workflowRunStoreFor(workspaceId);
       const runs = await runStore.listRuns();
       return runs
         .filter(
@@ -1968,9 +1978,7 @@ export class TaskService implements AgentTaskIntegration {
 
     try {
       const referencedRunIdSet = new Set(referencedWorkflowRunIds);
-      const runStore = new WorkflowRunStore({
-        sessionDir: path.join(this.config.sessionsDir, workspaceId),
-      });
+      const runStore = this.workflowRunStoreFor(workspaceId);
       const runs = await runStore.listRuns();
       const blockingRunIds: string[] = [];
       for (const run of runs) {
@@ -2064,9 +2072,7 @@ export class TaskService implements AgentTaskIntegration {
     }
 
     try {
-      const runStore = new WorkflowRunStore({
-        sessionDir: path.join(this.config.sessionsDir, parentWorkspaceId),
-      });
+      const runStore = this.workflowRunStoreFor(parentWorkspaceId);
       const run = await runStore.getRun(workflowTask.runId);
       if (run.workspaceId !== parentWorkspaceId) {
         return {
@@ -7733,9 +7739,7 @@ export class TaskService implements AgentTaskIntegration {
         ) {
           continue;
         }
-        const runStore = new WorkflowRunStore({
-          sessionDir: path.join(this.config.sessionsDir, workspace.id),
-        });
+        const runStore = this.workflowRunStoreFor(workspace.id);
         let runs: Awaited<ReturnType<WorkflowRunStore["listRuns"]>>;
         try {
           runs = await runStore.listRuns();
@@ -8112,9 +8116,7 @@ export class TaskService implements AgentTaskIntegration {
     // its terminal callback re-queues behind this deletion.
     let currentRunUpdatedAt: string | null;
     try {
-      const runStore = new WorkflowRunStore({
-        sessionDir: path.join(this.config.sessionsDir, params.ownerWorkspaceId),
-      });
+      const runStore = this.workflowRunStoreFor(params.ownerWorkspaceId);
       currentRunUpdatedAt = (await runStore.getRun(params.runId)).updatedAt;
     } catch {
       currentRunUpdatedAt = null;
@@ -8417,9 +8419,7 @@ export class TaskService implements AgentTaskIntegration {
     candidate: { runId: string; run: WorkflowRunRecord }
   ): Promise<"deliverable" | "superseded" | "defer"> {
     try {
-      const runStore = new WorkflowRunStore({
-        sessionDir: path.join(this.config.sessionsDir, ownerWorkspaceId),
-      });
+      const runStore = this.workflowRunStoreFor(ownerWorkspaceId);
       const currentRun = await runStore.getRun(candidate.runId);
       if (
         currentRun.status !== candidate.run.status ||
@@ -8469,9 +8469,7 @@ export class TaskService implements AgentTaskIntegration {
   > {
     assert(ownerWorkspaceId.length > 0, "buildWorkflowTerminalPrompt requires ownerWorkspaceId");
     assert(runId.length > 0, "buildWorkflowTerminalPrompt requires runId");
-    const runStore = new WorkflowRunStore({
-      sessionDir: path.join(this.config.sessionsDir, ownerWorkspaceId),
-    });
+    const runStore = this.workflowRunStoreFor(ownerWorkspaceId);
     let run: Awaited<ReturnType<WorkflowRunStore["getRun"]>>;
     try {
       run = await runStore.getRun(runId);
@@ -13687,9 +13685,7 @@ export class TaskService implements AgentTaskIntegration {
     if (runIds.length === 0) {
       return [];
     }
-    const runStore = new WorkflowRunStore({
-      sessionDir: path.join(this.config.sessionsDir, workspaceId),
-    });
+    const runStore = this.workflowRunStoreFor(workspaceId);
     const blocking: string[] = [];
     for (const runId of runIds) {
       const run = await runStore.getRun(runId).catch(() => null);
@@ -13739,9 +13735,7 @@ export class TaskService implements AgentTaskIntegration {
       workspaceId.length > 0,
       "listActiveWorkflowRunIdsForWorkspaceStrict requires workspaceId"
     );
-    const runStore = new WorkflowRunStore({
-      sessionDir: path.join(this.config.sessionsDir, workspaceId),
-    });
+    const runStore = this.workflowRunStoreFor(workspaceId);
     const runs = await runStore.listRunsForActivityScan();
     return runs
       .filter(
@@ -16873,9 +16867,7 @@ export class TaskService implements AgentTaskIntegration {
     }
 
     try {
-      const runStore = new WorkflowRunStore({
-        sessionDir: path.join(this.config.sessionsDir, parentWorkspaceId),
-      });
+      const runStore = this.workflowRunStoreFor(parentWorkspaceId);
       const run = await runStore.getRun(workflowTask.runId);
       return run.agentOutputSchemaRequired !== true;
     } catch (error) {

From 79a02087df31a9eba0a2ae96d47fe36e0d99271f Mon Sep 17 00:00:00 2001
From: "mux-bot[bot]" <264182336+mux-bot[bot]@users.noreply.github.com>
Date: Tue, 1 Sep 2026 08:14:17 +0000
Subject: [PATCH 94/94] refactor: extract throwIfAborted for the repeated SSH
 abort guard

---
 src/node/runtime/SSHRuntime.ts | 63 +++++++++++++++-------------------
 1 file changed, 27 insertions(+), 36 deletions(-)

diff --git a/src/node/runtime/SSHRuntime.ts b/src/node/runtime/SSHRuntime.ts
index cd966b32fd..e3d944a74a 100644
--- a/src/node/runtime/SSHRuntime.ts
+++ b/src/node/runtime/SSHRuntime.ts
@@ -147,6 +147,21 @@ const UNRESOLVED_DELTA_PUSH_PATTERNS = [
   "remote unpack failed",
 ] as const;
 
+/**
+ * Shared "caller already gave up" guard for the long-running SSH maintenance and
+ * project-sync steps, each of which repeated this same precondition check.
+ *
+ * Deliberately throws a plain `Error(OPERATION_ABORTED_ERROR)` instead of
+ * delegating to `AbortSignal.prototype.throwIfAborted()`: call sites compare the
+ * message against that exact string (see OPERATION_ABORTED_ERROR above), whereas
+ * `throwIfAborted()` surfaces the signal's `reason` — a `DOMException` by default.
+ */
+function throwIfAborted(abortSignal?: AbortSignal): void {
+  if (abortSignal?.aborted) {
+    throw new Error(OPERATION_ABORTED_ERROR);
+  }
+}
+
 function isUnresolvedDeltaPushFailure(errorMsg: string): boolean {
   return UNRESOLVED_DELTA_PUSH_PATTERNS.some((pattern) => errorMsg.includes(pattern));
 }
@@ -198,9 +213,7 @@ async function enqueueProjectSync(
 
   try {
     await waitForTurn;
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
     await fn();
   } finally {
     if (onAbort) {
@@ -665,9 +678,7 @@ export class SSHRuntime extends RemoteRuntime {
     baseRepoPathArg: string,
     abortSignal?: AbortSignal
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     // `git config --unset-all` exits 0 (removed) or 5 (key/section absent);
     // both are idempotent successes. Anything else is a real failure we
@@ -706,9 +717,7 @@ export class SSHRuntime extends RemoteRuntime {
     abortSignal?: AbortSignal,
     options: { waitForGc?: boolean } = {}
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     log.info(repairContext);
 
@@ -827,9 +836,7 @@ export class SSHRuntime extends RemoteRuntime {
     initLogger: InitLogger,
     abortSignal?: AbortSignal
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     try {
       const { packCount } = await this.probeBaseRepoHealth(baseRepoPathArg, abortSignal);
@@ -916,18 +923,14 @@ export class SSHRuntime extends RemoteRuntime {
     initLogger: InitLogger,
     abortSignal?: AbortSignal
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     await this.transport.acquireConnection({
       abortSignal,
       onWait: (waitMs) => logSSHBackoffWait(initLogger, waitMs),
     });
 
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     initLogger.logStep("Repairing shared base repository object cache...");
     const remoteAbortController = createAbortController(
@@ -982,9 +985,7 @@ export class SSHRuntime extends RemoteRuntime {
         );
       }
 
-      if (abortSignal?.aborted) {
-        throw new Error(OPERATION_ABORTED_ERROR);
-      }
+      throwIfAborted(abortSignal);
 
       if (gitExitCode !== 0) {
         throw new Error(
@@ -1060,9 +1061,7 @@ export class SSHRuntime extends RemoteRuntime {
     maxAttempts: number,
     abortSignal?: AbortSignal
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     try {
       await this.repairBaseRepoForSync(
@@ -2254,9 +2253,7 @@ export class SSHRuntime extends RemoteRuntime {
     initLogger: InitLogger,
     abortSignal?: AbortSignal
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     const layout = this.getProjectLayout(projectPath);
     const projectKey = this.getProjectSyncKey(layout.projectId);
@@ -2271,9 +2268,7 @@ export class SSHRuntime extends RemoteRuntime {
       // those don't benefit from forcing a larger pack.
       let forceNoThinNextAttempt = false;
       for (let attempt = 1; attempt <= PROJECT_SYNC_MAX_ATTEMPTS; attempt++) {
-        if (abortSignal?.aborted) {
-          throw new Error(OPERATION_ABORTED_ERROR);
-        }
+        throwIfAborted(abortSignal);
 
         try {
           await this.syncProjectToRemoteOnce(projectPath, layout, initLogger, abortSignal, {
@@ -2305,9 +2300,7 @@ export class SSHRuntime extends RemoteRuntime {
             PROJECT_SYNC_MAX_ATTEMPTS,
             abortSignal
           );
-          if (abortSignal?.aborted) {
-            throw new Error(OPERATION_ABORTED_ERROR);
-          }
+          throwIfAborted(abortSignal);
           initLogger.logStep(
             `Sync failed, retrying (attempt ${attempt + 1}/${PROJECT_SYNC_MAX_ATTEMPTS})...`
           );
@@ -2324,9 +2317,7 @@ export class SSHRuntime extends RemoteRuntime {
     abortSignal?: AbortSignal,
     options: { forceNoThin?: boolean } = {}
   ): Promise<void> {
-    if (abortSignal?.aborted) {
-      throw new Error(OPERATION_ABORTED_ERROR);
-    }
+    throwIfAborted(abortSignal);
 
     const currentSnapshotPath = layout.currentSnapshotPath;
     const useNativeGitPush = this.transport instanceof OpenSSHTransport;