mixdog 0.7.1

package/src/shared/llm/http-agent.mjs

@@ -0,0 +1,123 @@
+/**
+ * Shared HTTP connection pool for outbound LLM provider API calls.
+ *
+ * The provider modules (anthropic-oauth, openai-oauth, grok-oauth, gemini)
+ * call the global `fetch()` with no dispatcher, so they ride Node's default
+ * undici agent. That agent keeps connections alive only briefly, so after an
+ * idle gap the first request to a provider pays a fresh TLS handshake — a
+ * 100-300ms first-byte penalty observed on cold calls.
+ *
+ * This module exports ONE lazily-created singleton undici `Agent` with a long
+ * keep-alive window and a sane connection cap, passed as the `dispatcher`
+ * option on those providers' `fetch()` calls so warm sockets survive idle
+ * gaps. `preconnect(origin)` opens a socket ahead of the first real request
+ * (best-effort, errors swallowed) and is called once at provider construction.
+ *
+ * Scope note: this is deliberately NOT used by src/search/lib/web-tools.mjs,
+ * whose per-request Agent pins a pre-validated DNS address for SSRF safety and
+ * must own its own short-lived pool. LLM API origins are fixed, trusted hosts,
+ * so a shared long-lived pool is appropriate here.
+ */
+
+import { Agent, getGlobalDispatcher, request as undiciRequest } from 'undici'
+
+let _agent = null
+
+function envInt(name, fallback) {
+  const raw = process.env[name]
+  if (!raw) return fallback
+  const n = Number(raw)
+  return Number.isFinite(n) && n > 0 ? Math.trunc(n) : fallback
+}
+
+/**
+ * Detect whether outbound HTTP is meant to flow through a proxy or any custom
+ * global dispatcher. When so, pinning our own bare keep-alive `Agent` as the
+ * per-request `dispatcher` would silently bypass `setGlobalDispatcher(...)` and
+ * env-proxy wiring — so callers must fall back to the global dispatcher.
+ *
+ * What is preserved (we step aside): explicit proxy env vars, undici's built-in
+ * `ProxyAgent`, and ANY non-default global dispatcher — i.e. any installed
+ * global whose constructor name is not `Agent` (undici's default global is a
+ * plain `Agent`). Our own singleton is never installed via
+ * `setGlobalDispatcher`, so this never self-detects.
+ *
+ * Accepted gap: a custom dispatcher deliberately constructed AS a plain undici
+ * `Agent` and set as the global is indistinguishable from the default here, so
+ * we'd keep using our shared pool. That's tolerable — such a dispatcher is
+ * itself a direct-connection pool (no proxy hop), so the bypass risk is minimal.
+ */
+function proxyConfigured() {
+  const env = process.env
+  if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) return true
+  if (env.NODE_USE_ENV_PROXY) return true
+  try {
+    const g = getGlobalDispatcher?.()
+    // Any non-default global dispatcher (constructor name other than the plain
+    // `Agent` undici installs by default) is treated as custom — ProxyAgent,
+    // EnvHttpProxyAgent, MockAgent, or a user subclass — and we step aside.
+    if (g && g.constructor && g.constructor.name !== 'Agent') return true
+  } catch { /* getGlobalDispatcher unavailable — treat as no proxy */ }
+  return false
+}
+
+/**
+ * The shared singleton dispatcher for LLM API requests. Created on first use.
+ *
+ * keepAliveTimeout (~60s) keeps a socket warm across the typical idle gap
+ * between bridge turns; connections caps concurrent sockets per origin so a
+ * burst of parallel calls can't open an unbounded number of handshakes.
+ *
+ * Returns `undefined` when a proxy / any custom (non-default) global dispatcher
+ * is configured, so `fetch({ dispatcher: undefined })` falls back to that
+ * global dispatcher instead of bypassing it. `dispatcher: undefined` is a
+ * harmless fetch option, so call sites need no change.
+ */
+export function getLlmDispatcher() {
+  if (proxyConfigured()) return undefined
+  if (_agent) return _agent
+  _agent = new Agent({
+    keepAliveTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MS', 60_000),
+    // Cap the idle keep-alive bump the server may request, so a generous
+    // upstream Keep-Alive header can't pin sockets open far longer than us.
+    keepAliveMaxTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MAX_MS', 90_000),
+    connections: envInt('MIXDOG_LLM_CONNECTIONS', 16),
+  })
+  return _agent
+}
+
+// Origins already warmed (or warming) this process, so repeated provider
+// construction or multiple providers on the same host don't spam handshakes.
+const _preconnected = new Set()
+
+/**
+ * Best-effort warm a kept-alive socket to `origin` so the first real request
+ * skips the TLS handshake. Fire-and-forget: never throws, never returns a
+ * pending promise the caller must await.
+ *
+ * @param {string} origin e.g. 'https://api.anthropic.com'
+ */
+export function preconnect(origin) {
+  try {
+    // With a proxy / custom global dispatcher in play we deliberately don't own
+    // the connection pool, so there's no warm socket to seed — no-op.
+    if (proxyConfigured()) return
+    if (!origin || typeof origin !== 'string') return
+    let url
+    try { url = new URL(origin) } catch { return }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') return
+    const key = url.origin
+    if (_preconnected.has(key)) return
+    _preconnected.add(key)
+    // A throwaway HEAD lands a pooled socket without fetching a body. Any
+    // failure (offline, DNS, 4xx/5xx) is irrelevant — the handshake is the
+    // point, and the real request will surface genuine errors.
+    undiciRequest(key, {
+      method: 'HEAD',
+      dispatcher: getLlmDispatcher(),
+      signal: AbortSignal.timeout(10_000),
+    })
+      .then((res) => res.body?.dump?.())
+      .catch(() => { /* best-effort warmup; ignore */ })
+  } catch { /* never let warmup break construction */ }
+}

package/src/shared/llm/index.mjs

@@ -0,0 +1,41 @@
+/**
+ * Shared LLM helpers (post v0.6.46).
+ *
+ * The legacy `callLLM` dispatcher and direct CLI/HTTP runners have been
+ * removed — every LLM call now flows through `bridge-llm.mjs`
+ * (`makeBridgeLlm({ taskType })`) and, for memory maintenance specifically,
+ * through `maintenance-llm.mjs`'s thin wrapper.
+ *
+ * Only preset resolution remains here: memory-cycle and future backend
+ * callers still need a consistent way to map `(task, agent-config)` to a
+ * preset id.
+ */
+
+import { DEFAULT_MAINTENANCE } from '../../agent/orchestrator/config.mjs'
+import { readSection } from '../config.mjs'
+
+function loadAgentConfig() {
+  try {
+    return readSection('agent')
+  } catch (e) {
+    console.error(`[llm] agent-config load error: ${e.message}`)
+    return {}
+  }
+}
+
+/**
+ * Resolve maintenance preset ID for a given task from agent-config.
+ * Falls back to canonical defaults (DEFAULT_MAINTENANCE from config.mjs).
+ * Returns null if no matching preset is registered (lets callers skip the call).
+ */
+export function resolveMaintenancePreset(task, agentConfig) {
+  const cfg = agentConfig || loadAgentConfig()
+  const maint = cfg?.maintenance || {}
+  const presetId = maint[task] || DEFAULT_MAINTENANCE[task]
+  const presets = cfg?.presets || []
+  if (presets.some(p => p.id === presetId || p.name === presetId)) return presetId
+  // No registered preset found — return the first available preset id so callers
+  // always receive a real id, or null if the presets list is empty.
+  const first = presets.find(p => p?.id || p?.name)
+  return first ? (first.id || first.name) : null
+}

package/src/shared/llm/pid-cleanup.mjs

@@ -0,0 +1,27 @@
+/**
+ * pid-cleanup.mjs — Orphaned bridge CLI process cleanup.
+ * Used by server.mjs on startup and shutdown.
+ */
+import fs from 'fs'
+import path from 'path'
+import os from 'os'
+
+const PID_DIR = path.join(os.tmpdir(), 'mixdog-bridge')
+const PID_FILE = path.join(PID_DIR, 'bridge-pids.json')
+
+export function cleanupOrphanedPids() {
+  let killed = 0
+  try {
+    const pids = JSON.parse(fs.readFileSync(PID_FILE, 'utf8'))
+    for (const pid of pids) {
+      try {
+        process.kill(pid, 0)
+        process.kill(pid, 'SIGTERM')
+        process.stderr.write(`[bridge-cleanup] killed orphaned PID ${pid}\n`)
+        killed++
+      } catch {}
+    }
+    fs.writeFileSync(PID_FILE, JSON.stringify([]))
+  } catch {}
+  return killed
+}

package/src/shared/llm/usage-log.mjs

@@ -0,0 +1,47 @@
+/**
+ * Unified LLM usage logger.
+ *
+ * Phase 2: Routes via appendBridgeTrace (HTTP buffer to memory-service)
+ * instead of writing directly to bridge-trace.jsonl.
+ *
+ * Signature unchanged — callers are unaffected.
+ */
+
+import { appendBridgeTrace } from '../../agent/orchestrator/bridge-trace.mjs';
+
+/**
+ * Append a usage entry to the trace store.
+ *
+ * @param {object} entry — usage record
+ * @param {object} opts
+ * @param {boolean} [opts.maintenance=false] — flag record as maintenance-origin
+ *
+ * Entry schema:
+ *   ts, preset, model, provider, mode, duration,
+ *   profileId, sessionId,
+ *   inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens,
+ *   prefixHash, costUsd
+ */
+const _missingProviderWarned = new Set();
+function warnMissingProviderOnce(key) {
+    if (_missingProviderWarned.has(key)) return;
+    _missingProviderWarned.add(key);
+    try {
+        process.stderr.write(`[usage-log] provider missing on usage entry (model=${key}). audit the caller.\n`);
+    } catch { /* logging only */ }
+}
+
+export function logLlmCall(entry, opts = {}) {
+    try {
+        if (!entry.provider) warnMissingProviderOnce(entry.model || '?');
+        appendBridgeTrace({
+            ts: entry.ts || Date.now(),
+            kind: 'usage',
+            ...entry,
+            payload: entry.payload ?? {},
+            maintenanceLog: opts.maintenance === true ? true : undefined,
+        });
+    } catch {
+        // Never let logging break the caller.
+    }
+}

package/src/shared/plugin-paths.mjs

@@ -0,0 +1,58 @@
+/**
+ * Canonical resolver for CLAUDE_PLUGIN_DATA (plugin data dir).
+ *
+ * Resolution order:
+ *   1. process.env.CLAUDE_PLUGIN_DATA  — set by Claude Code when spawning
+ *                                        the MCP server or a hook.
+ *   2. Derive from CLAUDE_PLUGIN_ROOT  — supports two real layouts:
+ *        cache:        .../cache/{marketplace}/{plugin}/{version}/
+ *        marketplace:  .../marketplaces/{marketplace}/   (root *is* the
+ *                      marketplace dir; plugin name comes from
+ *                      .claude-plugin/plugin.json or DEFAULT_PLUGIN)
+ *
+ * Throws if neither env var is present — the plugin always runs under
+ * Claude Code, which sets one of them. Callers must not silently fall
+ * back to a hardcoded path.
+ *
+ * DEFAULT_PLUGIN / DEFAULT_MARKETPLACE are exported so a handful of
+ * callers (MCP client spawning sibling plugins, session-manager building
+ * PLUGIN_ROOT for rule injection) can reference the canonical names
+ * without re-hardcoding the strings. Update both in lockstep with
+ * `.claude-plugin/marketplace.json` if the marketplace is ever renamed.
+ */
+
+import { homedir } from 'os';
+import { join, basename } from 'path';
+import { readFileSync } from 'fs';
+
+export const DEFAULT_PLUGIN = 'mixdog';
+export const DEFAULT_MARKETPLACE = 'trib-plugin';
+
+function readPluginManifestName(root) {
+  try {
+    const manifest = JSON.parse(readFileSync(join(root, '.claude-plugin', 'plugin.json'), 'utf8'));
+    if (manifest && typeof manifest.name === 'string' && manifest.name.trim()) return manifest.name.trim();
+  } catch { /* fall through to default */ }
+  return DEFAULT_PLUGIN;
+}
+
+export function resolvePluginData() {
+  if (process.env.CLAUDE_PLUGIN_DATA) return process.env.CLAUDE_PLUGIN_DATA;
+  const root = process.env.CLAUDE_PLUGIN_ROOT;
+  if (root) {
+    const dirName = basename(root);
+    // Cache layout: .../cache/{marketplace}/{plugin}/{version}/
+    if (/^\d+\.\d+\.\d+/.test(dirName)) {
+      const pluginName = basename(join(root, '..'));
+      const marketplace = basename(join(root, '..', '..'));
+      return join(homedir(), '.claude', 'plugins', 'data', `${pluginName}-${marketplace}`);
+    }
+    // Marketplace layout: .../marketplaces/{marketplace}/
+    // The root dir itself is the marketplace. Plugin name lives in the
+    // manifest; fall back to DEFAULT_PLUGIN when it's unreadable.
+    const marketplace = dirName;
+    const pluginName = readPluginManifestName(root);
+    return join(homedir(), '.claude', 'plugins', 'data', `${pluginName}-${marketplace}`);
+  }
+  throw new Error('[plugin-paths] CLAUDE_PLUGIN_DATA and CLAUDE_PLUGIN_ROOT are both unset — cannot resolve plugin data dir outside of Claude Code.');
+}

package/src/shared/schedules-store.mjs

@@ -0,0 +1,70 @@
+/**
+ * Canonical reader for registered schedules.
+ *
+ * `${CLAUDE_PLUGIN_DATA}/schedules/<name>/` is the single source of truth.
+ * Each schedule directory contains `config.json` (metadata) and
+ * `instructions.md` (prompt body). Both the setup UI (POST /schedules)
+ * and the `schedule-add` skill write the same two files; every reader —
+ * setup-server (GET /schedules), channels/lib/config.mjs (loadConfig),
+ * status/aggregator.mjs — must go through listSchedules() so a single
+ * entry shape is presented everywhere.
+ *
+ * The legacy `mixdog-config.json` `channels.schedules.items` /
+ * `channels.nonInteractive` / `channels.interactive` arrays are no longer
+ * consulted. Migration: rename any legacy `prompt.md` to `instructions.md`
+ * — no in-code fallback.
+ */
+
+import { readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+import { resolvePluginData } from './plugin-paths.mjs';
+
+function schedulesDir() {
+  return join(resolvePluginData(), 'schedules');
+}
+
+function readJsonFile(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); }
+  catch { return null; }
+}
+
+function readTextFile(path) {
+  try { return readFileSync(path, 'utf8'); }
+  catch { return ''; }
+}
+
+/**
+ * List every registered schedule.
+ *
+ * Return shape per entry: `{ name, ...config, prompt }`.
+ * - `name` is the directory name (slug).
+ * - Spread of `config.json` keys (time/days/type/channel/model/enabled
+ *   when written by the setup UI; cron/timezone/mode/role when written
+ *   by the schedule-add skill).
+ * - `prompt` carries `instructions.md` content (empty string when the
+ *   file is missing — caller decides whether that is a hard error).
+ *
+ * Returns an empty array when the directory does not exist (fresh
+ * install with no schedules registered yet).
+ */
+export function listSchedules() {
+  const dir = schedulesDir();
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    // ENOENT (fresh install, no schedules/ yet) / EACCES -> empty list.
+    // Replaces the previous existsSync check, which was racy: the dir
+    // could disappear between existsSync and readdirSync.
+    return out;
+  }
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const name = ent.name;
+    const cfg = readJsonFile(join(dir, name, 'config.json')) || {};
+    const prompt = readTextFile(join(dir, name, 'instructions.md'));
+    out.push({ name, ...cfg, prompt });
+  }
+  return out;
+}

package/src/shared/seed.mjs

@@ -0,0 +1,119 @@
+import { existsSync, mkdirSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import { DEFAULT_PRESETS, DEFAULT_MAINTENANCE } from '../agent/orchestrator/config.mjs';
+import { writeFileAtomicSync, withFileLockSync } from './atomic-file.mjs';
+import { backupUserData, markUserDataInitialized, shouldSeedMissingUserData } from './user-data-guard.mjs';
+import { disableClaudeBuiltinsOnFirstInstall } from './disable-claude-builtins.mjs';
+
+const DEFAULTS_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'defaults');
+
+// Idempotent seed of the unified mixdog-config.json so first-time installs
+// land with the Config UI already populated with defaults (presets, search
+// scaffold, memory config) instead of presenting empty lists.
+//
+// Only plugin-owned paths under `<plugin-data>/` are seeded. User-owned
+// surfaces — global CLAUDE.md files, project repo files, etc. — are not
+// touched by seeding. `existsSync()` gates every write so a second boot
+// never overwrites user edits.
+
+//
+// Seed bodies are thunks so dynamic content (DEFAULT_PRESETS pulling
+// ANTHROPIC_DEFAULT_*_MODEL overrides at load time) resolves at seed time,
+// not at module-import time.
+const SEEDS = {
+    // Single unified config file — all sections in one JSON.
+    // Prompt injection is seeded under `channels`. New installs default to
+    // CLAUDE.md mode so the managed global rule block is authoritative from
+    // the next Claude Code session.
+    // providers/mcpServers intentionally omitted from `agent` so runtime
+    // auto-detect (buildDefaultConfig) decides based on env keys / OAuth.
+    'mixdog-config.json': () => {
+        // Template carries the static channels/memory/search defaults; agent
+        // section is composed at seed time so DEFAULT_PRESETS picks up the
+        // ANTHROPIC_DEFAULT_*_MODEL env overrides resolved at boot. Top-level
+        // key order is rebuilt explicitly so seed output stays
+        // channels/memory/agent/search regardless of template author.
+        const template = JSON.parse(
+            readFileSync(join(DEFAULTS_DIR, 'mixdog-config.template.json'), 'utf8'),
+        );
+        const composed = {
+            channels: template.channels,
+            memory: template.memory,
+            agent: {
+                presets: DEFAULT_PRESETS.map((p) => ({ ...p })),
+                maintenance: { ...DEFAULT_MAINTENANCE },
+                default: 'opus-high',
+            },
+            search: template.search,
+        };
+        return JSON.stringify(composed, null, 2) + '\n';
+    },
+};
+
+export function ensureDataSeeds(dataDir) {
+    if (!dataDir) return { created: [], skipped: [] };
+    const created = [];
+    const skipped = [];
+    for (const [rel, bodyFn] of Object.entries(SEEDS)) {
+        const full = join(dataDir, rel);
+        if (existsSync(full)) {
+            markUserDataInitialized(dataDir);
+            skipped.push(rel);
+            continue;
+        }
+        if (!shouldSeedMissingUserData(dataDir, rel)) {
+            skipped.push(rel);
+            continue;
+        }
+        // Body composition (template read / config build) errors are fatal —
+        // a missing defaults/ file means the plugin install itself is
+        // incomplete, and silently skipping the seed would leave the user
+        // with an empty Config UI. Filesystem errors during the actual write
+        // are non-fatal and only logged so a transient mkdir/write failure
+        // does not block boot.
+        const body = bodyFn();
+        try {
+            mkdirSync(dirname(full), { recursive: true });
+            // Re-check existence under a file lock to serialize cooperating
+            // seed writers, then use createOnly:true so the final commit
+            // step (linkSync with O_EXCL semantics) refuses to overwrite a
+            // file that a non-locking external writer (user/editor)
+            // created in between. linkSync→EEXIST is caught inside
+            // writeFileAtomicSync and reported as `false`; we treat that
+            // as a clean skip rather than an overwrite, preserving the
+            // "never overwrites user edits" invariant in the header.
+            withFileLockSync(`${full}.lock`, () => {
+                if (existsSync(full)) {
+                    markUserDataInitialized(dataDir);
+                    skipped.push(rel);
+                    return;
+                }
+                const wrote = writeFileAtomicSync(full, body, {
+                    fsyncDir: true,
+                    createOnly: true,
+                });
+                if (wrote) {
+                    markUserDataInitialized(dataDir);
+                    created.push(rel);
+                    // Fresh creation of mixdog-config.json is the first-install
+                    // signal: disable Claude Code's built-in memory/recap once
+                    // (restore snapshot captured first). Best-effort; never
+                    // breaks seeding.
+                    if (rel === 'mixdog-config.json') {
+                        disableClaudeBuiltinsOnFirstInstall();
+                    }
+                } else {
+                    skipped.push(rel);
+                }
+            });
+        } catch (e) {
+            process.stderr.write(`[seed] ${rel} create failed: ${e.message}\n`);
+        }
+    }
+    if (created.length > 0) {
+        process.stderr.write(`[seed] created ${created.length} file(s): ${created.join(', ')}\n`);
+        try { backupUserData(dataDir, 'post-seed'); } catch {}
+    }
+    return { created, skipped };
+}