mixdog 0.7.1

package/src/search/tool-defs.mjs

@@ -0,0 +1,83 @@
+import { z } from 'zod'
+import { zodToJsonSchema } from 'zod-to-json-schema'
+
+const crawlArgsSchema = z.object({
+  url: z.string().url().describe('Starting URL to begin crawling from.'),
+  maxPages: z.number().int().min(1).max(200).optional().describe('Maximum number of pages to visit (1-200).'),
+  maxDepth: z.number().int().min(0).max(5).optional().describe('Maximum link depth to follow (0-5).'),
+  sameDomainOnly: z.boolean().optional().describe('If true, only follow links on the same domain.'),
+})
+
+function buildInputSchema(zodSchema) {
+  const jsonSchema = zodToJsonSchema(zodSchema, { target: 'openApi3' })
+  delete jsonSchema.$schema
+  return jsonSchema
+}
+
+export const TOOL_DEFS = [
+  {
+    name: 'search',
+    title: 'Mixdog Web Search',
+    description: 'Web search (SERP) for external/current info. Requires query (string|array). Snippets+URLs; web_fetch for bodies.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }] },
+        site: { type: 'string' },
+        type: { type: 'string', enum: ['web', 'news', 'images'] },
+        maxResults: { type: 'number', minimum: 1, maximum: 20 },
+        locale: {
+          anyOf: [
+            { type: 'string' },
+            {
+              type: 'object',
+              properties: {
+                country: { type: 'string' },
+                language: { type: 'string' },
+                region: { type: 'string' },
+                city: { type: 'string' },
+                timezone: { type: 'string' },
+              },
+              additionalProperties: false,
+            },
+          ],
+        },
+        contextSize: { type: 'string', enum: ['low', 'medium', 'high'] },
+      },
+      required: ['query'],
+      additionalProperties: false,
+    },
+    annotations: { title: 'Mixdog Web Search', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  },
+  {
+    name: 'web_fetch',
+    title: 'Mixdog Web Fetch',
+    description: 'Fetch full page body from a URL (web page, article, docs). Requires url. Use after search to read a result.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        url: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }] },
+        startIndex: { type: 'number', minimum: 0 },
+        maxLength: { type: 'number', minimum: 0 },
+      },
+      required: ['url'],
+      additionalProperties: false,
+    },
+    annotations: { title: 'Mixdog Web Fetch', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  },
+  {
+    name: 'crawl',
+    title: 'Crawl',
+    public: false,
+    description: 'Crawl a website starting from a URL, following links up to a configured depth. Collects page summaries from each visited page.',
+    inputSchema: buildInputSchema(crawlArgsSchema),
+    annotations: { title: 'Crawl', readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  },
+  {
+    name: 'setup',
+    public: false,
+    description: 'Open interactive setup form to configure search providers, API keys, and options.',
+    inputSchema: { type: 'object', properties: {} },
+    annotations: { title: 'Setup' },
+  },
+]

package/src/setup/defender-exclusion.mjs

@@ -0,0 +1,183 @@
+// Windows Defender exclusion auto-registration.
+//
+// On Windows, NTFS file read latency on ~/.claude/plugins (cache + node_modules
+// + 1.5GB ONNX model) and ~/.claude/projects (CC transcript jsonl) is heavily
+// affected by Defender real-time scanning. AV stalls have been observed to
+// produce multi-minute readFileSync hangs in the read tool, blocking mcp
+// dispatch. Adding both directories to the Defender exclusion list removes
+// the scan-on-access cost.
+//
+// Invariant: paths required for hot mcp / memory / transcript IO must be
+// excluded from real-time AV scanning. When not excluded, trigger an
+// elevated PowerShell once per 24h to request the user's UAC approval.
+// The 24h cooldown prevents UAC spam if the user declines.
+//
+// Non-Windows platforms: no-op (other AV solutions handled elsewhere).
+
+import os from 'os'
+import fs from 'fs'
+import path from 'path'
+import { spawn, spawnSync } from 'child_process'
+import { randomBytes } from 'crypto'
+
+const COOLDOWN_MS = 24 * 60 * 60 * 1000
+const TRIGGER_DELAY_MS = 5000  // let boot logs settle before UAC popup
+
+function _wantedPaths() {
+  const home = os.homedir()
+  return [
+    path.join(home, '.claude', 'plugins'),
+    path.join(home, '.claude', 'projects'),
+  ]
+}
+
+function _readFlag(flagPath) {
+  try { return JSON.parse(fs.readFileSync(flagPath, 'utf-8')) }
+  catch { return null }
+}
+
+function _writeFlag(flagPath, payload) {
+  try { fs.writeFileSync(flagPath, JSON.stringify({ ...payload, checkedAt: Date.now() })) }
+  catch { /* best-effort */ }
+}
+
+function _currentExclusions() {
+  // Get-MpPreference reads exclusions without elevation.
+  const r = spawnSync('powershell', [
+    '-NoProfile', '-NonInteractive', '-Command',
+    'Get-MpPreference | Select-Object -ExpandProperty ExclusionPath',
+  ], { encoding: 'utf8', timeout: 5000, windowsHide: true })
+  if (r.status !== 0) return null
+  return (r.stdout || '').split(/\r?\n/).map(s => s.trim()).filter(Boolean)
+}
+
+function _allCovered(existing, want) {
+  const lower = existing.map(s => s.toLowerCase())
+  return want.every(p => {
+    const pl = p.toLowerCase()
+    return lower.some(e => pl === e || pl.startsWith(e + path.sep.toLowerCase()))
+  })
+}
+
+function _triggerElevatedAdd(want) {
+  // Write a temp .ps1 file with the Add-MpPreference commands, then launch it
+  // elevated via Start-Process -Verb RunAs. Using a file avoids the nested
+  // quote-escaping mess of inlining everything on the command line.
+  //
+  // Security:
+  //  - The .ps1 is the body that will run *elevated*, so it's a juicy
+  //    TOCTOU target: a predictable per-pid filename in os.tmpdir() is
+  //    user-writable from any other process running as the same user
+  //    (or under a writable %TEMP% on shared hosts), and the original
+  //    code never deleted it — leaving a tamper window between write
+  //    and UAC-prompted execution.
+  //  - Mitigation: create a fresh randomized subdirectory under tmpdir
+  //    (mkdtempSync gives us an exclusive directory; on POSIX it's
+  //    0o700, on Windows the per-user temp ACL governs), write the
+  //    .ps1 there with 0o600, chain a deletion command into the
+  //    elevated script so the privileged side removes it after use,
+  //    and best-effort rmdir the wrapper dir after the spawn returns.
+  //  - Residual risk (intentionally unmitigated — fundamental OS
+  //    limit, not a defect): a hostile process running as THE SAME
+  //    USER can still race the file between fs.writeFileSync and
+  //    Start-Process consuming it (or replace the dir+file after we
+  //    spawn powershell.exe but before UAC consents). The 0o600 / per-
+  //    user-temp-ACL boundary only protects against OTHER users; the
+  //    same-user attacker already has our token, can read this very
+  //    .mjs, and can directly call Add-MpPreference via their own
+  //    Start-Process -Verb RunAs — exploiting *us* offers no privilege
+  //    they did not already have. No same-user mitigation (chmod
+  //    games, signing the .ps1, hashing-then-verifying in the elevated
+  //    wrapper) actually closes this — the verifier itself runs from
+  //    the same user-writable tree. Adding such a check would be
+  //    security theatre; intentionally not implemented. The TOCTOU
+  //    fixes above target the cross-user / world-writable-tmp class,
+  //    which IS a real and closable gap.
+  const escapePath = p => p.replace(/'/g, "''")
+  let tmpDir
+  try {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mixdog-defender-'))
+  } catch { return false }
+  const tmpPs1 = path.join(tmpDir, `run-${randomBytes(8).toString('hex')}.ps1`)
+  const addLines = want.map(p => `Add-MpPreference -ExclusionPath '${escapePath(p)}'`).join('\n')
+  // Self-delete at the tail of the elevated script so the .ps1 doesn't
+  // outlive its single intended execution. `Remove-Item -Force` runs
+  // inside the same elevated PowerShell that read the file, so even if
+  // the wrapper dir was somehow locked we still get the file cleaned.
+  const script =
+    addLines + '\n' +
+    `try { Remove-Item -LiteralPath '${escapePath(tmpPs1)}' -Force -ErrorAction SilentlyContinue } catch {}\n`
+  try {
+    fs.writeFileSync(tmpPs1, script, { encoding: 'utf-8', mode: 0o600 })
+  } catch {
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }) } catch {}
+    return false
+  }
+  // Spawn detached so the parent process exits cleanly even if the user takes
+  // a while to click through the UAC prompt.
+  const child = spawn('powershell', [
+    '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-Command',
+    `Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-WindowStyle','Hidden','-File','${tmpPs1.replace(/'/g, "''")}'`,
+  ], { detached: true, stdio: 'ignore', windowsHide: true })
+  // Detached + stdio:'ignore' means an ENOENT (powershell missing) or
+  // EPERM would normally surface as an unhandled 'error' event and
+  // crash the process. Swallow it; the manualCmd log line is the
+  // fallback path the user already sees.
+  child.on('error', () => {})
+  child.unref()
+  // Best-effort: schedule a wrapper-dir cleanup after the elevated
+  // script has had a chance to run. We can't synchronously wait for
+  // UAC (could be minutes if the user is AFK), so leave a long delay
+  // and a recursive rmSync; the elevated script already removed the
+  // .ps1 itself by then.
+  setTimeout(() => {
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }) } catch {}
+  }, 10 * 60 * 1000).unref?.()
+  return true
+}
+
+export function maybeRequestDefenderExclusion(pluginDataDir, log = () => {}) {
+  if (process.platform !== 'win32') return
+  if (!pluginDataDir) return
+  const flagPath = path.join(pluginDataDir, 'defender-exclusion-checked.json')
+  const prev = _readFlag(flagPath)
+  if (prev && typeof prev.checkedAt === 'number' && Date.now() - prev.checkedAt < COOLDOWN_MS) {
+    return  // recent attempt; respect cooldown
+  }
+
+  const want = _wantedPaths()
+  const existing = _currentExclusions()
+  // Distinguish "known-missing" from "unknown" (Get-MpPreference timed out,
+  // returned non-zero, or PowerShell was unavailable). An unknown read
+  // result must NOT trigger a UAC elevation — the exclusions might already
+  // be in place, and prompting on every transient read failure is the
+  // exact UAC spam the cooldown was added to avoid. On unknown, skip this
+  // attempt without writing the cooldown flag so the next boot retries.
+  if (existing === null) {
+    log('[defender] could not read current exclusions (Get-MpPreference unavailable/timed out) — skipping UAC prompt; will retry on next boot')
+    return
+  }
+  if (_allCovered(existing, want)) {
+    _writeFlag(flagPath, { status: 'already-excluded', want })
+    log('[defender] paths already excluded from real-time AV scan')
+    return
+  }
+
+  // Surface the missing exclusion BEFORE attempting the UAC prompt so the
+  // user sees both the auto-trigger and a manual fallback even if they
+  // decline UAC or run on a locked-down host. This is the highest-leverage
+  // I/O fix on Windows (multi-minute readFileSync stalls when scanning hot
+  // paths), so make it impossible to miss in supervisor.log.
+  const manualCmd = want.map(p => `Add-MpPreference -ExclusionPath '${p.replace(/'/g, "''")}'`).join('; ')
+  log('[defender] MISSING exclusions for hot IO paths: ' + want.join(', '))
+  log('[defender] manual fallback (elevated PowerShell, copy/paste):')
+  log('[defender]   ' + manualCmd)
+
+  // Delay so boot logs flush before the UAC prompt steals focus.
+  setTimeout(() => {
+    const ok = _triggerElevatedAdd(want)
+    if (ok) log('[defender] UAC requested — if you decline, run the manual command above')
+    else log('[defender] failed to write trigger script — use the manual command above')
+  }, TRIGGER_DELAY_MS)
+  _writeFlag(flagPath, { status: 'triggered', want })
+}

package/src/shared/abort-controller.mjs

@@ -0,0 +1,15 @@
+/**
+ * AbortController helpers — ported from the Claude Code CLI pattern.
+ *
+ * `createAbortController()` raises the signal's max listener cap so long-running
+ * sessions with many per-iteration handlers don't trip Node's default warning.
+ */
+import { setMaxListeners } from 'events';
+
+const DEFAULT_MAX_LISTENERS = 50;
+
+export function createAbortController(maxListeners = DEFAULT_MAX_LISTENERS) {
+  const controller = new AbortController();
+  try { setMaxListeners(maxListeners, controller.signal); } catch { /* node < 19 fallback */ }
+  return controller;
+}