mixdog 0.7.1

package/scripts/guard-smoke.mjs

@@ -0,0 +1,66 @@
+import { tmpdir } from 'os';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(__dirname, '..');
+
+process.env.CLAUDE_PLUGIN_ROOT ||= ROOT;
+process.env.CLAUDE_PLUGIN_DATA ||= join(tmpdir(), 'mixdog-guard-smoke-data');
+
+const { classifyBashFileLookupCommand, stripSoftWarns } = await import('../src/agent/orchestrator/tool-loop-guard.mjs');
+
+// Case A: bash file-lookup classifier catches direct + common wrapper forms.
+{
+    const cases = [
+        ['sed -n "1,40p" rules/bridge/40-cycle1-agent.md', 'sed'],
+        ['bash -lc "cat rules/shared/01-tool.md"', 'bash-wrapped'],
+        ['powershell.exe -NoProfile -Command "Get-Content rules/shared/01-tool.md"', 'pwsh-wrapped'],
+        ['cmd /c type rules\\shared\\01-tool.md', 'cmd-wrapped'],
+        ['node -e "const fs=require(\'fs\'); console.log(fs.readFileSync(\'rules/x.md\', \'utf8\'))"', 'node-fs-eval'],
+        ['python -c "from pathlib import Path; print(Path(\'rules/x.md\').read_text())"', 'python-open-eval'],
+        ['git grep "Bridge Worker" rules', 'git grep'],
+    ];
+    const failed = cases.filter(([cmd, expected]) => classifyBashFileLookupCommand(cmd) !== expected);
+    const pass = failed.length === 0;
+    process.stdout.write(`Case A: ${pass ? 'PASS' : 'FAIL'}\n`);
+    if (!pass) {
+        for (const [cmd, expected] of failed) {
+            process.stdout.write(`  expected ${expected}, got ${classifyBashFileLookupCommand(cmd)} for ${cmd}\n`);
+        }
+        process.exitCode = 1;
+    }
+}
+
+// Case B: a genuine build/test/run/git command is NOT classified as a file lookup.
+{
+    const cases = ['npm test', 'git commit -m "x"', 'node build.mjs', 'docker build .'];
+    const failed = cases.filter((cmd) => classifyBashFileLookupCommand(cmd) !== null);
+    const pass = failed.length === 0;
+    process.stdout.write(`Case B: ${pass ? 'PASS' : 'FAIL'}\n`);
+    if (!pass) {
+        for (const cmd of failed) {
+            process.stdout.write(`  expected null, got ${classifyBashFileLookupCommand(cmd)} for ${cmd}\n`);
+        }
+        process.exitCode = 1;
+    }
+}
+
+// Case C: stripSoftWarns removes a legacy compact marker line and leaves body intact.
+{
+    const body = 'real tool output line 1\nreal tool output line 2';
+    const withWarn = `⚠ Same-slice reads(src/x.mjs x2): identical params, body cached.\n${body}`;
+    const stripped = stripSoftWarns(withWarn);
+    const pass = stripped === body && stripSoftWarns(body) === body;
+    process.stdout.write(`Case C: ${pass ? 'PASS' : 'FAIL'}\n`);
+    if (!pass) {
+        process.stdout.write(`  stripped=${JSON.stringify(stripped)}\n`);
+        process.exitCode = 1;
+    }
+}
+
+if (!process.exitCode) {
+    process.exit(0);
+} else {
+    process.exit(1);
+}

package/scripts/hidden-role-schema-smoke.mjs

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import { tmpdir } from 'os';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+process.env.CLAUDE_PLUGIN_ROOT = ROOT;
+const SMOKE_DATA_DIR = process.env.MIXDOG_SCHEMA_SMOKE_DATA_DIR
+    || join(tmpdir(), `mixdog-hidden-role-schema-smoke-data-${process.pid}`);
+if (process.env.MIXDOG_SCHEMA_SMOKE_USE_REAL_DATA !== '1') {
+    process.env.CLAUDE_PLUGIN_DATA = SMOKE_DATA_DIR;
+} else {
+    process.env.CLAUDE_PLUGIN_DATA ||= SMOKE_DATA_DIR;
+}
+
+const { loadConfig, resolveRuntimeSpec } = await import('../src/agent/orchestrator/config.mjs');
+const { getHiddenRole, listHiddenRoleNames } = await import('../src/agent/orchestrator/internal-roles.mjs');
+const {
+    resolvePresetName,
+    resolveHiddenRoleSchemaAllowedTools,
+} = await import('../src/agent/orchestrator/smart-bridge/bridge-llm.mjs');
+const { prepareBridgeSession } = await import('../src/agent/orchestrator/smart-bridge/session-builder.mjs');
+const { preDispatchDenyForSession } = await import('../src/agent/orchestrator/session/loop.mjs');
+const { initProviders } = await import('../src/agent/orchestrator/providers/registry.mjs');
+
+const config = loadConfig();
+
+// CI runs in a clean environment with no OAuth credentials, so the default
+// presets' provider (anthropic-oauth) is never registered and createSession
+// would throw `Provider "anthropic-oauth" not found or not enabled`. This
+// smoke only inspects resolved tool schemas — it never issues an LLM call —
+// so register a credential-free provider stub. The provider constructor loads
+// credentials lazily (null when absent); only ensureAuth() touches the network.
+await initProviders({ 'anthropic-oauth': { enabled: true } });
+
+let failed = 0;
+const KNOWN_PROFILES = new Set([
+    'unified',
+    'llm-only',
+    'filesystem-read',
+]);
+
+function fail(message) {
+    failed += 1;
+    process.stderr.write(`FAIL ${message}\n`);
+}
+
+function equalArray(a, b) {
+    return Array.isArray(a)
+        && Array.isArray(b)
+        && a.length === b.length
+        && a.every((v, i) => v === b[i]);
+}
+
+function buildSession(role, presetOverride = null) {
+    const hidden = getHiddenRole(role);
+    if (!hidden) throw new Error(`hidden role not found: ${role}`);
+    const presetName = presetOverride || resolvePresetName({ role, config });
+    const preset = config.presets?.find((p) => p.id === presetName || p.name === presetName);
+    if (!preset) throw new Error(`preset not found for ${role}: ${presetName}`);
+    const runtimeSpec = resolveRuntimeSpec(preset, { lane: 'bridge', agentId: role });
+    const { session } = prepareBridgeSession({
+        role,
+        presetName,
+        preset,
+        runtimeSpec,
+        permission: hidden.permission || undefined,
+        cwd: null,
+        skipRoleReminder: true,
+        schemaAllowedTools: resolveHiddenRoleSchemaAllowedTools(hidden),
+    });
+    return (session.tools || []).map((t) => t?.name).filter(Boolean);
+}
+
+function buildWorkerToolNames() {
+    // Tool surface parity: compare explorer against bridge `worker` on the
+    // same resolved preset (CI has no user-workflow.json worker entry).
+    const presetName = resolvePresetName({ role: 'worker', config })
+        || resolvePresetName({ role: 'explorer', config })
+        || null;
+    if (!presetName) throw new Error('preset not found for worker baseline');
+    const preset = config.presets?.find((p) => p.id === presetName || p.name === presetName);
+    if (!preset) throw new Error(`preset not found for worker: ${presetName}`);
+    const runtimeSpec = resolveRuntimeSpec(preset, { lane: 'bridge', agentId: 'worker' });
+    const { session } = prepareBridgeSession({
+        role: 'worker',
+        presetName,
+        preset,
+        runtimeSpec,
+        permission: 'read',
+        cwd: null,
+    });
+    return (session.tools || []).map((t) => t?.name).filter(Boolean);
+}
+
+let workerTools = [];
+try {
+    workerTools = buildWorkerToolNames();
+} catch (err) {
+    fail(`worker baseline: ${err?.message || err}`);
+}
+
+const cases = [
+    ['explorer', null, workerTools],
+    ['cycle1-agent', null, []],
+    ['cycle2-agent', null, []],
+];
+
+for (const role of listHiddenRoleNames().sort()) {
+    const hidden = getHiddenRole(role);
+    const profile = String(hidden?.toolSchemaProfile || '').trim();
+    if (!profile) {
+        fail(`${role}: missing toolSchemaProfile`);
+    } else if (!KNOWN_PROFILES.has(profile)) {
+        fail(`${role}: unknown toolSchemaProfile ${profile}`);
+    }
+}
+
+for (const [role, preset, expected] of cases) {
+    let actual = [];
+    try {
+        actual = buildSession(role, preset);
+    } catch (err) {
+        fail(`${role}: ${err?.message || err}`);
+        continue;
+    }
+    const pass = equalArray(actual, expected);
+    process.stdout.write(`${role}: ${pass ? 'PASS' : 'FAIL'} tools=${actual.join(',') || '(none)'}\n`);
+    if (!pass) fail(`${role}: expected ${expected.join(',') || '(none)'}, got ${actual.join(',') || '(none)'}`);
+}
+
+// Read-locked hidden roles: caller cannot upgrade permission to read-write.
+{
+    const presetName = resolvePresetName({ role: 'explorer', config });
+    const preset = config.presets?.find((p) => p.id === presetName || p.name === presetName);
+    const runtimeSpec = resolveRuntimeSpec(preset, { lane: 'bridge', agentId: 'explorer' });
+    const { session } = prepareBridgeSession({
+        role: 'explorer',
+        presetName,
+        preset,
+        runtimeSpec,
+        permission: 'read-write',
+        cwd: null,
+        owner: 'bridge',
+        skipRoleReminder: true,
+        schemaAllowedTools: resolveHiddenRoleSchemaAllowedTools(getHiddenRole('explorer')),
+    });
+    const permOk = session.permission === 'read' && session.toolPermission === 'read';
+    const writeDeny = preDispatchDenyForSession(session, { name: 'write' }, 'builtin');
+    const pass = permOk && typeof writeDeny === 'string' && writeDeny.includes('permission=read');
+    process.stdout.write(`explorer-read-lock: ${pass ? 'PASS' : 'FAIL'}\n`);
+    if (!pass) {
+        failed += 1;
+        process.stderr.write(`FAIL explorer-read-lock: perm=${session.permission}/${session.toolPermission} deny=${writeDeny}\n`);
+    }
+}
+
+if (failed) process.exit(1);
+// Explicit exit: the imported bridge/provider graph opens keep-alive HTTP
+// agent handles (src/shared/llm/http-agent.mjs) that block natural exit —
+// in CI this kept the process alive until the 6h job timeout.
+process.stdout.write('hidden-role-schema-smoke: pass\n', () => process.exit(0));

package/scripts/hook-routing-smoke.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import assert from 'assert';
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const hooks = JSON.parse(readFileSync(join(ROOT, 'hooks', 'hooks.json'), 'utf8'));
+const preToolUse = hooks?.hooks?.PreToolUse || [];
+
+function matched(toolName) {
+  return preToolUse
+    .filter((entry) => new RegExp(entry.matcher).test(toolName))
+    .map((entry) => entry.matcher);
+}
+
+for (const toolName of ['Read', 'Grep', 'Glob']) {
+  assert.deepStrictEqual(matched(toolName), ['^(Read|Grep|Glob)$'], `${toolName} native mirror must be blocked`);
+}
+
+for (const toolName of ['mcp__plugin_mixdog_mixdog__edit', 'mcp__plugin_mixdog_trib-plugin__edit']) {
+  assert.strictEqual(matched(toolName).length, 1, `${toolName} must enter MCP sandbox hook`);
+}
+
+for (const toolName of ['mcp__plugin_mixdog_mixdog__read', 'mcp__plugin_mixdog_trib-plugin__read']) {
+  assert.deepStrictEqual(matched(toolName), [], `${toolName} read-only MCP tool must stay fast-path`);
+}
+
+console.log('hook-routing-smoke passed');

package/scripts/inject-input.ps1

@@ -0,0 +1,204 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+  Inject keystrokes into another console process via AttachConsole + WriteConsoleInputW.
+
+.DESCRIPTION
+  Detaches from current console, attaches to target PID's console, writes a sequence of
+  KEY_EVENT INPUT_RECORDs (one keydown + one keyup per char), then detaches.
+
+  No focus dependency, no SendInput, no UI. Works only when the target owns a real
+  console (conhost/Windows Terminal). May not work for ConPTY-only hosted children.
+
+.PARAMETER TargetPid
+  PID of the target console process.
+
+.PARAMETER Text
+  Text to inject. Literal "\r" or actual CR (0x0D) is treated as Enter.
+
+.PARAMETER UseVk
+  Diagnostic: also fill VirtualKeyCode/ScanCode via VkKeyScan + MapVirtualKey.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][int]$TargetPid,
+    [Parameter(Mandatory=$true)][string]$Text,
+    [switch]$UseVk
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Normalize: literal "\r" -> CR. Also collapse \r\n / lone \n to CR (Windows console Enter).
+$normalized = $Text -replace '\\r', "`r"
+$normalized = $normalized -replace "`r`n", "`r"
+$normalized = $normalized -replace "`n", "`r"
+
+$typeDef = @'
+using System;
+using System.Runtime.InteropServices;
+
+public static class ConIO {
+    [DllImport("kernel32.dll", SetLastError=true)]
+    public static extern bool AttachConsole(uint dwProcessId);
+
+    [DllImport("kernel32.dll", SetLastError=true)]
+    public static extern bool FreeConsole();
+
+    [DllImport("kernel32.dll", SetLastError=true)]
+    public static extern IntPtr GetConsoleWindow();
+
+    [DllImport("kernel32.dll", SetLastError=true)]
+    public static extern IntPtr GetStdHandle(int nStdHandle);
+
+    [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode, EntryPoint="CreateFileW")]
+    public static extern IntPtr CreateFileW(
+        [MarshalAs(UnmanagedType.LPWStr)] string lpFileName,
+        uint dwDesiredAccess,
+        uint dwShareMode,
+        IntPtr lpSecurityAttributes,
+        uint dwCreationDisposition,
+        uint dwFlagsAndAttributes,
+        IntPtr hTemplateFile);
+
+    [DllImport("kernel32.dll", SetLastError=true)]
+    public static extern bool CloseHandle(IntPtr hObject);
+
+    [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode, EntryPoint="WriteConsoleInputW")]
+    public static extern bool WriteConsoleInputW(
+        IntPtr hConsoleInput,
+        [MarshalAs(UnmanagedType.LPArray), In] INPUT_RECORD[] lpBuffer,
+        uint nLength,
+        out uint lpNumberOfEventsWritten);
+
+    [DllImport("user32.dll", SetLastError=true)]
+    public static extern short VkKeyScanW(char ch);
+
+    [DllImport("user32.dll", SetLastError=true)]
+    public static extern uint MapVirtualKeyW(uint uCode, uint uMapType);
+
+    public const int STD_INPUT_HANDLE = -10;
+    public const ushort KEY_EVENT = 0x0001;
+    public const uint MAPVK_VK_TO_VSC = 0;
+    public const uint GENERIC_READ  = 0x80000000;
+    public const uint GENERIC_WRITE = 0x40000000;
+    public const uint FILE_SHARE_READ  = 0x1;
+    public const uint FILE_SHARE_WRITE = 0x2;
+    public const uint OPEN_EXISTING = 3;
+    public static readonly IntPtr INVALID_HANDLE_VALUE = new IntPtr(-1);
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct KEY_EVENT_RECORD {
+        [MarshalAs(UnmanagedType.Bool)] public bool bKeyDown;
+        public ushort wRepeatCount;
+        public ushort wVirtualKeyCode;
+        public ushort wVirtualScanCode;
+        public ushort UnicodeChar;
+        public uint dwControlKeyState;
+    }
+
+    [StructLayout(LayoutKind.Explicit)]
+    public struct INPUT_RECORD {
+        [FieldOffset(0)] public ushort EventType;
+        [FieldOffset(4)] public KEY_EVENT_RECORD KeyEvent;
+    }
+}
+'@
+
+if (-not ('ConIO' -as [type])) {
+    Add-Type -TypeDefinition $typeDef -Language CSharp
+}
+
+function Write-Err([string]$msg) {
+    [Console]::Error.WriteLine($msg)
+}
+
+# Detach from any current console first (safe even if none attached).
+[void][ConIO]::FreeConsole()
+
+if (-not [ConIO]::AttachConsole([uint32]$TargetPid)) {
+    $err = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
+    Write-Err "AttachConsole($TargetPid) failed. Win32 error=$err"
+    exit 1
+}
+
+$hStdIn = [IntPtr]::Zero
+try {
+    # AttachConsole does NOT refresh the cached std handles. Open CONIN$ explicitly.
+    $access = [uint32]([ConIO]::GENERIC_READ -bor [ConIO]::GENERIC_WRITE)
+    $share  = [uint32]([ConIO]::FILE_SHARE_READ -bor [ConIO]::FILE_SHARE_WRITE)
+    $hStdIn = [ConIO]::CreateFileW('CONIN$', $access, $share, [IntPtr]::Zero, [ConIO]::OPEN_EXISTING, 0, [IntPtr]::Zero)
+    if ($hStdIn -eq [ConIO]::INVALID_HANDLE_VALUE -or $hStdIn -eq [IntPtr]::Zero) {
+        $err = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
+        Write-Err "CreateFileW(CONIN$) returned invalid handle. Win32 error=$err"
+        exit 1
+    }
+
+    $chars = $normalized.ToCharArray()
+    if ($chars.Length -eq 0) {
+        Write-Err "Empty text after normalization."
+        exit 1
+    }
+
+    $records = New-Object 'ConIO+INPUT_RECORD[]' ($chars.Length * 2)
+    for ($i = 0; $i -lt $chars.Length; $i++) {
+        $vk = [uint16]0
+        $sc = [uint16]0
+        if ($UseVk) {
+            $scan = [ConIO]::VkKeyScanW($chars[$i])
+            if ($scan -ne -1) {
+                $vk = [uint16]($scan -band 0xFF)
+                $sc = [uint16]([ConIO]::MapVirtualKeyW([uint32]$vk, [ConIO]::MAPVK_VK_TO_VSC) -band 0xFFFF)
+            }
+            # Special-case CR -> VK_RETURN
+            if ([int]$chars[$i] -eq 0x0D) {
+                $vk = [uint16]0x0D
+                $sc = [uint16]([ConIO]::MapVirtualKeyW([uint32]$vk, [ConIO]::MAPVK_VK_TO_VSC) -band 0xFFFF)
+            }
+        }
+
+        $down = New-Object 'ConIO+INPUT_RECORD'
+        $down.EventType = [ConIO]::KEY_EVENT
+        $kd = New-Object 'ConIO+KEY_EVENT_RECORD'
+        $kd.bKeyDown = $true
+        $kd.wRepeatCount = 1
+        $kd.wVirtualKeyCode = $vk
+        $kd.wVirtualScanCode = $sc
+        $kd.UnicodeChar = [uint16][int]$chars[$i]
+        $kd.dwControlKeyState = 0
+        $down.KeyEvent = $kd
+
+        $up = New-Object 'ConIO+INPUT_RECORD'
+        $up.EventType = [ConIO]::KEY_EVENT
+        $ku = New-Object 'ConIO+KEY_EVENT_RECORD'
+        $ku.bKeyDown = $false
+        $ku.wRepeatCount = 1
+        $ku.wVirtualKeyCode = $vk
+        $ku.wVirtualScanCode = $sc
+        $ku.UnicodeChar = [uint16][int]$chars[$i]
+        $ku.dwControlKeyState = 0
+        $up.KeyEvent = $ku
+
+        $records[$i*2]   = $down
+        $records[$i*2+1] = $up
+    }
+
+    [uint32]$written = 0
+    $ok = [ConIO]::WriteConsoleInputW($hStdIn, $records, [uint32]$records.Length, [ref]$written)
+    if (-not $ok) {
+        $err = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
+        Write-Err "WriteConsoleInputW failed. Win32 error=$err written=$written expected=$($records.Length)"
+        exit 1
+    }
+    if ($written -ne [uint32]$records.Length) {
+        Write-Err "WriteConsoleInputW partial write: written=$written expected=$($records.Length)"
+        exit 1
+    }
+}
+finally {
+    if ($hStdIn -ne [IntPtr]::Zero -and $hStdIn -ne [ConIO]::INVALID_HANDLE_VALUE) {
+        [void][ConIO]::CloseHandle($hStdIn)
+    }
+    [void][ConIO]::FreeConsole()
+}
+
+exit 0