mixdog 0.7.14 → 0.7.15

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/trib-plugin/mixdog.git",
-        "ref": "v0.7.14"
+        "ref": "v0.7.15"
       },
       "strict": false,
       "mcpServers": {

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "description": "Claude Code all-in-one agent plugin — autonomous agents, continuous memory, cost-aware sub-agents, and syntax-aware code editing.",
   "hooks": "./hooks/hooks.json",
   "mcpServers": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "description": "Claude Code all-in-one bridge plugin: role-based bridge workers, continuous memory, and syntax-aware code editing.",
   "author": "mixdog contributors <dev@tribgames.com>",
   "license": "MIT",

package/setup/config-merge.mjs

@@ -12,6 +12,7 @@ import {
   getSearchApiKey,
   getAgentApiKey,
   diagnoseDiscordTokenValue,
+  AGENT_PROVIDER_ENV,
 } from '../src/shared/config.mjs';
 
 const SUPPORTED_PROVIDERS = [
@@ -19,14 +20,6 @@ const SUPPORTED_PROVIDERS = [
   'tavily', 'firecrawl', 'exa',
 ];
 
-const AGENT_PROVIDER_ENV = Object.freeze({
-  openai: 'OPENAI_API_KEY',
-  anthropic: 'ANTHROPIC_API_KEY',
-  gemini: 'GEMINI_API_KEY',
-  deepseek: 'DEEPSEEK_API_KEY',
-  xai: 'XAI_API_KEY',
-});
-
 function envSecretPresent(account) {
   const key = 'MIXDOG_' + String(account || '').replace(/[.\s]+/g, '_').toUpperCase();
   if (process.env[key]) return true;

package/setup/launch-core.mjs

@@ -14,7 +14,7 @@
 // is derived inside launchConfigUi().
 
 import { spawn, execSync } from 'child_process';
-import { openSync, closeSync, readFileSync, writeSync, writeFileSync, appendFileSync } from 'fs';
+import { openSync, closeSync, readFileSync, writeSync, writeFileSync, appendFileSync, statSync, unlinkSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import http from 'http';
@@ -122,6 +122,110 @@ function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+// Cross-process launch mutex. Only ONE launcher runs the version-check →
+// reclaim critical section at a time. Now that prewarm takes over every
+// session, two concurrent session starts can both observe the same stale
+// server; without serialization the slower one kills the faster one's
+// freshly-spawned correct server. Exclusive-create lock file + stale-takeover
+// (a holder that crashed mid-launch leaves a lock no older than STALE_MS).
+// Best-effort: on timeout or an unexpected fs error we proceed lock-free
+// rather than deadlock the launcher.
+const LAUNCH_LOCK_PATH = join(tmpdir(), `mixdog-setup-launch-${PORT}.lock`);
+const LAUNCH_LOCK_STALE_MS = 30000;
+
+async function acquireLaunchLock(trace, timeoutMs = 20000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() <= deadline) {
+    try {
+      const fd = openSync(LAUNCH_LOCK_PATH, 'wx'); // exclusive create — EEXIST if held
+      writeSync(fd, `${process.pid} ${new Date().toISOString()}\n`);
+      closeSync(fd);
+      return true;
+    } catch (e) {
+      if (e?.code !== 'EEXIST') { trace(`launch-lock: unexpected ${e?.code || e} → proceeding lock-free`); return false; }
+      let stale = false;
+      try { stale = (Date.now() - statSync(LAUNCH_LOCK_PATH).mtimeMs) > LAUNCH_LOCK_STALE_MS; } catch {}
+      if (stale) { trace(`launch-lock: stale lock → reclaiming`); try { unlinkSync(LAUNCH_LOCK_PATH); } catch {} continue; }
+      await sleep(200);
+    }
+  }
+  trace(`launch-lock: wait timeout → proceeding lock-free`);
+  return false;
+}
+
+function releaseLaunchLock() {
+  try { unlinkSync(LAUNCH_LOCK_PATH); } catch {}
+}
+
+// Reclaim PORT from a version-mismatched setup-server: resolve the LISTENER
+// pid, kill it (tree on win32, process-group on unix), wait for the port to
+// free, then spawn the current-version server window-free. Throws LaunchError
+// if the port cannot be reclaimed. Caller MUST hold the launch lock so two
+// launchers never race the kill+respawn.
+async function reclaimPort(pluginRoot, pluginData, remoteRoot, trace) {
+  let stalePid = null;
+  let pidResolveError = null;
+  let killError = null;
+  try {
+    if (process.platform === 'win32') {
+      // -State Listen is REQUIRED: Get-NetTCPConnection -LocalPort returns the
+      // LISTENING socket AND every ESTABLISHED/TIME_WAIT connection to it, so a
+      // bare `-First 1` can resolve a client/proxy PID (or 0) instead of the
+      // server — taskkill then misses the real owner and the port never frees.
+      const out = execSync(
+        `powershell -NoProfile -Command "(Get-NetTCPConnection -LocalPort ${PORT} -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1).OwningProcess"`,
+        { encoding: 'utf8', timeout: 3000, windowsHide: true },
+      ).trim();
+      const n = parseInt(out, 10);
+      if (Number.isFinite(n) && n > 0) stalePid = n;
+    } else {
+      const out = execSync(`lsof -ti :${PORT} -sTCP:LISTEN`, { encoding: 'utf8', timeout: 3000 }).trim();
+      const n = parseInt(out.split('\n')[0], 10);
+      if (Number.isFinite(n) && n > 0) stalePid = n;
+    }
+  } catch (e) { pidResolveError = e; }
+  if (stalePid !== null) {
+    try {
+      if (process.platform === 'win32') {
+        // /T kills the whole process tree — the setup-server spawns child
+        // browser/server descendants that survive a PID-only Stop-Process.
+        execSync(`taskkill /T /F /PID ${stalePid}`, { timeout: 3000, windowsHide: true });
+      } else {
+        // Detached setup-server is its own process-group leader; the negative
+        // PID signals the group, reaping descendants a bare kill would orphan.
+        try { execSync(`kill -KILL -${stalePid}`, { timeout: 3000 }); }
+        catch { execSync(`kill -KILL ${stalePid}`, { timeout: 3000 }); }
+      }
+    } catch (e) { killError = e; }
+  }
+  // Poll until the port stops answering (250ms ticks, 5000ms deadline — a hair
+  // longer than the kill's own 3000ms timeout so a slow OS port release is not
+  // misread as a kill failure).
+  const killDeadline = Date.now() + 5000;
+  let portFree = false;
+  while (Date.now() < killDeadline) {
+    await sleep(250);
+    portFree = !(await ping(300));
+    if (portFree) break;
+  }
+  if (!portFree) {
+    const errorDetails = [
+      pidResolveError && `  PID resolution failure: ${pidResolveError?.message || String(pidResolveError)}`,
+      killError && `  kill failure: ${killError?.message || String(killError)}`,
+    ].filter(Boolean).join('\n');
+    throw new LaunchError(
+      `Port ${PORT} is in use by a different mixdog plugin instance and could not be reclaimed (kill of PID ${stalePid ?? 'unknown'} failed or timed out).\n` +
+      `  expected plugin root: ${pluginRoot}\n` +
+      `  actual plugin root:   ${remoteRoot}\n` +
+      (errorDetails ? errorDetails + '\n' : '') +
+      `Stop the other setup-server (or change PORT) and retry.\n`,
+    );
+  }
+  trace(`reclaimPort: killed stalePid=${stalePid}, port freed, spawning current server`);
+  await spawnServerWithLog(pluginRoot, pluginData, { openOnStart: false });
+  trace(`reclaimPort: spawnServerWithLog completed`);
+}
+
 async function waitForServer(timeoutMs = 4000, shouldStop = () => false) {
   const deadline = Date.now() + timeoutMs;
   let ready = false;
@@ -386,22 +490,13 @@ export async function launchConfigUi(options = {}) {
   const alive = await aliveProbe();
   __trace(`aliveProbe result alive=${alive}`);
 
-  // Pre-warm mode: ensure the server is booted window-free, then return.
-  // Already alive → cheap no-op (no requestOpen, no window). Not alive →
-  // spawn with openOnStart:false so setup-server boots without opening a
-  // browser window. No stale-server takeover: pre-warm is best-effort and
-  // must never kill another install's server.
-  if (prewarm) {
-    if (alive) {
-      __trace(`prewarm: server already alive → no-op`);
-      return CONFIG_UI_URL;
-    }
-    __trace(`prewarm: !alive → spawnServerWithLog (window-free)`);
-    await spawnServerWithLog(pluginRoot, pluginData, { openOnStart: false });
-    __trace(`prewarm: spawnServerWithLog completed`);
-    return CONFIG_UI_URL;
-  }
-
+  // Singleton / current-version invariant is enforced below for BOTH prewarm
+  // and interactive launches: prewarm no longer early-returns on a live
+  // server, so a stale old-version setup-server left running across a plugin
+  // update is taken over and replaced window-free at session start — instead
+  // of lingering until a manual /mixdog:config (the recurrence we hit). PORT
+  // is a fixed constant, so exactly one setup-server can own it; reclaiming a
+  // version-mismatched owner is the correct singleton behaviour even here.
   if (!alive) {
     // Boot window-free; the unconditional requestOpen below owns opening the
     // window. Spawning with openOnStart:1 here would double-open and races a
@@ -425,68 +520,40 @@ export async function launchConfigUi(options = {}) {
     const actual = normalize(remoteRoot);
     __trace(`compare expected=${expected} actual=${actual} mismatch=${expected !== actual}`);
     if (expected !== actual) {
-      // Invariant: single live plugin install owns PORT. The occupying server
-      // belongs to a different install — resolve its PID, terminate it, poll
-      // until the port is free, then take ownership via spawnServerWithLog().
-      let stalePid = null;
-      let pidResolveError = null;
-      let killError = null;
+      // Serialize the reclaim across processes: prewarm now takes over every
+      // session, so two concurrent launchers can both observe this stale
+      // server. Under the lock the recheck is authoritative — whoever acquires
+      // first reclaims, and the next acquirer re-reads a now-current server and
+      // skips, so a freshly-spawned correct server is never killed.
+      const locked = await acquireLaunchLock(__trace);
       try {
-        if (process.platform === 'win32') {
-          const out = execSync(
-            `powershell -NoProfile -Command "(Get-NetTCPConnection -LocalPort ${PORT} -ErrorAction SilentlyContinue | Select-Object -First 1).OwningProcess"`,
-            { encoding: 'utf8', timeout: 3000, windowsHide: true },
-          ).trim();
-          const n = parseInt(out, 10);
-          if (Number.isFinite(n) && n > 0) stalePid = n;
+        const recheckRoot = await fetchPluginPath();
+        if (recheckRoot && normalize(recheckRoot) !== expected) {
+          await reclaimPort(pluginRoot, pluginData, recheckRoot, __trace);
         } else {
-          const out = execSync(`lsof -ti :${PORT}`, { encoding: 'utf8', timeout: 3000 }).trim();
-          const n = parseInt(out.split('\n')[0], 10);
-          if (Number.isFinite(n) && n > 0) stalePid = n;
+          __trace(`takeover: server current under lock (recheckRoot=${recheckRoot}) → skip`);
         }
-      } catch (e) { pidResolveError = e; }
-      if (stalePid !== null) {
-        try {
-          if (process.platform === 'win32') {
-            // /T kills the whole process tree — the setup-server spawns child
-            // browser/server descendants that survive a PID-only Stop-Process,
-            // leaking processes and holding the port.
-            execSync(`taskkill /T /F /PID ${stalePid}`, { timeout: 3000, windowsHide: true });
-          } else {
-            // setup-server is launched detached (its own process-group leader),
-            // so the port-owning PID equals the group id. Negative PID signals
-            // the whole group, reaping descendants a bare kill would orphan.
-            try { execSync(`kill -KILL -${stalePid}`, { timeout: 3000 }); }
-            catch { execSync(`kill -KILL ${stalePid}`, { timeout: 3000 }); }
-          }
-        } catch (e) { killError = e; }
+      } finally {
+        if (locked) releaseLaunchLock();
       }
-      // Poll until port is free (250ms ticks, 3000ms deadline).
-      const killDeadline = Date.now() + 3000;
-      let portFree = false;
-      while (Date.now() < killDeadline) {
-        await sleep(250);
-        portFree = !(await ping(300));
-        if (portFree) break;
-      }
-      if (!portFree) {
-        const errorDetails = [
-          pidResolveError && `  PID resolution failure: ${pidResolveError?.message || String(pidResolveError)}`,
-          killError && `  kill failure: ${killError?.message || String(killError)}`,
-        ].filter(Boolean).join('\n');
-        throw new LaunchError(
-          `Port ${PORT} is in use by a different mixdog plugin instance and could not be reclaimed (kill of PID ${stalePid ?? 'unknown'} failed or timed out).\n` +
-          `  expected plugin root: ${pluginRoot}\n` +
-          `  actual plugin root:   ${remoteRoot}\n` +
-          (errorDetails ? errorDetails + '\n' : '') +
-          `Stop the other setup-server (or change PORT) and retry.\n`,
-        );
-      }
-      __trace(`takeover: killed stalePid=${stalePid}, port freed, spawning new server`);
-      await spawnServerWithLog(pluginRoot, pluginData, { openOnStart: false });
-      __trace(`takeover: spawnServerWithLog completed`);
     }
   }
+
+  // Ensure the server (just spawned, taken over, or concurrently swapped by
+  // another launcher) is actually answering before we report success or open a
+  // window — absorbs the brief port-down window during a concurrent reclaim so
+  // requestOpen never hits a refused port and prewarm never returns early.
+  if (!await waitForServer(15000)) {
+    throw new LaunchError(`setup-server did not become ready at ${CONFIG_UI_URL}/ before launch.\n`);
+  }
+
+  // Prewarm stops here: the current-version server is up (spawned or taken
+  // over above) and must NOT open a browser window.
+  if (prewarm) {
+    __trace(`prewarm: current-version server ensured → return`);
+    return CONFIG_UI_URL;
+  }
+
   // Invariant: a non-prewarm launch ALWAYS opens the window through the
   // idempotent /open endpoint once the server is ready — regardless of which
   // process (this launcher, a concurrent every-session prewarm, or a

package/setup/setup-server.mjs

@@ -15,7 +15,7 @@ import { listSchedules } from '../src/shared/schedules-store.mjs';
 import { ensureDataSeeds } from '../src/shared/seed.mjs';
 import { backupUserData, markUserDataInitialized, shouldSeedMissingUserData } from '../src/shared/user-data-guard.mjs';
 import { tmpdir } from 'os';
-import { readSection, writeSection, updateSection, saveSecret, deleteSecret, hasStoredSecret, SECRET_ACCOUNTS, getSearchApiKey, getAgentApiKey, getDiscordToken, getWebhookAuthtoken, diagnoseDiscordTokenValue } from '../src/shared/config.mjs';
+import { readSection, writeSection, updateSection, saveSecret, deleteSecret, hasStoredSecret, SECRET_ACCOUNTS, getSearchApiKey, getAgentApiKey, getDiscordToken, getWebhookAuthtoken, diagnoseDiscordTokenValue, AGENT_PROVIDER_ENV, AGENT_PROVIDER_ENV_ALIASES } from '../src/shared/config.mjs';
 import { applyDefaults as applyChannelsDefaults } from '../src/channels/lib/config.mjs';
 import { validateCronExpression } from '../src/channels/lib/scheduler.mjs';
 import { mergeAgentConfig, mergeMemoryConfig, mergeSearchConfig, mergeConfig, mergeEndpointConfig, mergeWebhookEndpointConfig } from './config-merge.mjs';
@@ -142,15 +142,11 @@ const SUPPORTED_PROVIDERS = [
   'anthropic-oauth', 'openai-oauth', 'openai-api', 'gemini-api', 'xai-api', 'grok-oauth',
   'tavily', 'firecrawl', 'exa',
 ];
-const AGENT_KEY_PROVIDER_IDS = ['openai', 'anthropic', 'gemini', 'deepseek', 'xai'];
+// AGENT_PROVIDER_ENV / AGENT_PROVIDER_ENV_ALIASES are the SSOT (src/shared/config.mjs);
+// derive the id list so a provider added there flows through every detection path
+// (keyStored, envKeys, secret presence) here automatically.
+const AGENT_KEY_PROVIDER_IDS = Object.keys(AGENT_PROVIDER_ENV);
 const SEARCH_KEY_PROVIDER_IDS = ['firecrawl', 'tavily', 'exa'];
-const AGENT_PROVIDER_ENV = Object.freeze({
-  openai: 'OPENAI_API_KEY',
-  anthropic: 'ANTHROPIC_API_KEY',
-  gemini: 'GEMINI_API_KEY',
-  deepseek: 'DEEPSEEK_API_KEY',
-  xai: 'XAI_API_KEY',
-});
 
 function envSecretPresent(account) {
   const key = 'MIXDOG_' + String(account || '').replace(/[.\s]+/g, '_').toUpperCase();
@@ -465,21 +461,19 @@ async function detectAuth(config = {}) {
   result.copilot = existsSync(join(configDir, 'github-copilot', 'hosts.json'))
     || existsSync(join(configDir, 'github-copilot', 'apps.json'));
   result.envKeys = {};
-  for (const [name, envKey] of [
-    ['openai', 'OPENAI_API_KEY'], ['anthropic', 'ANTHROPIC_API_KEY'],
-    ['gemini', 'GEMINI_API_KEY'], ['deepseek', 'DEEPSEEK_API_KEY'],
-    ['xai', 'XAI_API_KEY'],
-  ]) { result.envKeys[name] = !!process.env[envKey]; }
-  // GROK_API_KEY is the last-resort xAI env alias honored by getAgentApiKey('xai')
-  // (shared/config.mjs is the SSOT); mirror it here so a GROK_API_KEY-only env
-  // shows xAI as available. keyStored semantics (keychain-only) stay unchanged.
-  result.envKeys.xai = result.envKeys.xai || !!process.env.GROK_API_KEY;
+  for (const [id, env] of Object.entries(AGENT_PROVIDER_ENV)) result.envKeys[id] = !!process.env[env];
+  // Honor the shared last-resort env aliases (e.g. GROK_API_KEY for xai) so a
+  // GROK_API_KEY-only env still shows xAI as available, matching getAgentApiKey.
+  // keyStored semantics (keychain-only) stay unchanged.
+  for (const [id, aliases] of Object.entries(AGENT_PROVIDER_ENV_ALIASES)) {
+    if (!result.envKeys[id]) result.envKeys[id] = aliases.some((a) => !!process.env[a]);
+  }
   // Keychain-stored provider keys. Only this boolean is sent to the browser —
   // the secret value never leaves the server, so the UI can show "Set" without
   // exposing the key.
   result.keyStored = {};
-  for (const name of ['openai', 'anthropic', 'gemini', 'deepseek', 'xai']) {
-    result.keyStored[name] = hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(name));
+  for (const id of AGENT_KEY_PROVIDER_IDS) {
+    result.keyStored[id] = hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id));
   }
   const ollamaUrl = config?.providers?.ollama?.baseURL || 'http://localhost:11434/v1';
   const lmstudioUrl = config?.providers?.lmstudio?.baseURL || 'http://localhost:1234/v1';
@@ -518,7 +512,7 @@ async function detectAuth(config = {}) {
 // in sync with src/agent/orchestrator/providers/registry.mjs.
 const _RUNTIME_PROVIDER_NAMES = [
   'anthropic', 'anthropic-oauth', 'openai', 'openai-oauth',
-  'gemini', 'deepseek', 'xai', 'grok-oauth',
+  'gemini', 'deepseek', 'xai', 'opencode-go', 'grok-oauth',
   'ollama', 'lmstudio',
 ];
 

package/src/agent/orchestrator/config.mjs

@@ -1,5 +1,5 @@
 import { resolvePluginData } from '../../shared/plugin-paths.mjs';
-import { readSection, updateSection, getAgentApiKey } from '../../shared/config.mjs';
+import { readSection, updateSection, getAgentApiKey, AGENT_PROVIDER_ENV } from '../../shared/config.mjs';
 import { OPENAI_COMPAT_PRESETS } from './providers/openai-compat.mjs';
 import { hasAnthropicOAuthCredentials } from './providers/anthropic-oauth.mjs';
 import { hasOpenAIOAuthCredentials } from './providers/openai-oauth.mjs';
@@ -10,13 +10,9 @@ import { hasGrokOAuthCredentials } from './providers/grok-oauth.mjs';
 export function getPluginData() {
     return resolvePluginData();
 }
-const ENV_KEY_MAP = {
-    openai: 'OPENAI_API_KEY',
-    anthropic: 'ANTHROPIC_API_KEY',
-    gemini: 'GEMINI_API_KEY',
-    deepseek: 'DEEPSEEK_API_KEY',
-    xai: 'XAI_API_KEY',
-};
+// First-class agent API-key providers: imported from the shared SSOT
+// (src/shared/config.mjs) so default-config and overlay paths cannot drift
+// from the env names the runtime key loader (getAgentApiKey) actually uses.
 // Canonical maintenance defaults. Single source of truth — imported by
 // llm/index.mjs and setup-server.mjs so UI/runtime cannot drift from config.
 //
@@ -73,7 +69,7 @@ export const DEFAULT_PRESETS = Object.freeze([
 function buildDefaultConfig() {
     const providers = {};
     // API providers — enabled if env key exists
-    for (const [name, envKey] of Object.entries(ENV_KEY_MAP)) {
+    for (const [name, envKey] of Object.entries(AGENT_PROVIDER_ENV)) {
         const apiKey = process.env[envKey];
         providers[name] = {
             enabled: !!apiKey,
@@ -138,11 +134,11 @@ export function loadConfig() {
             // Provider API keys live in the OS keychain (std env / MIXDOG_AGENT_*
             // -> keychain), never plaintext in config. Overlay them so the
             // provider clients see config.apiKey populated.
-            // ENV_KEY_MAP covers first-class key providers; OPENAI_COMPAT_PRESETS
+            // AGENT_PROVIDER_ENV covers first-class key providers; OPENAI_COMPAT_PRESETS
             // covers compat providers (opencode-go, …) whose key also lives in
             // the keychain. Without the union, a compat provider with a valid
             // stored key still ships 'no-key' → 401.
-            for (const name of new Set([...Object.keys(ENV_KEY_MAP), ...Object.keys(OPENAI_COMPAT_PRESETS)])) {
+            for (const name of new Set([...Object.keys(AGENT_PROVIDER_ENV), ...Object.keys(OPENAI_COMPAT_PRESETS)])) {
                 const kc = getAgentApiKey(name);
                 if (kc) mergedProviders[name] = { ...(mergedProviders[name] || {}), apiKey: kc, enabled: true };
             }

package/src/agent/orchestrator/tools/graph-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.7.14",
+  "version": "0.7.15",
   "_comment": "Rewritten by .github/workflows/graph-release.yml on each tagged release. assets maps platformKey (process.platform-process.arch, e.g. win32-x64, linux-x64, darwin-arm64) to { url, sha256 } of the mixdog-graph binary on the GitHub release. A local cargo build under native/mixdog-graph/target/release always takes precedence at runtime. (v0.5.236 entries were filled manually after CI's commit step hit detached HEAD; the workflow now checks out ref: main so future releases self-update.)",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-darwin-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-graph-darwin-arm64",
       "sha256": "53f45f8373000fb55ccb49f9b03af0275ca2a663f924b68ee8ded4535e14445a"
     },
     "darwin-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-darwin-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-graph-darwin-x64",
       "sha256": "347dc5e1b39dfc33ae07e01319b085c1f1ee775a70be1ac09f7b0d2954b36591"
     },
     "linux-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-linux-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-graph-linux-arm64",
       "sha256": "7648be2c4bc89bef837b4843639a9ab38c382ba103518ad52d4439587521542f"
     },
     "linux-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-linux-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-graph-linux-x64",
       "sha256": "6e5a1b548c69c3a51170eb11c769985be7ca7029ede2597b19304c8dc106eded"
     },
     "win32-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-win32-x64.exe",
-      "sha256": "2ca840a008a26a6ebdeab2803a994c6b2a462b178269cc3e2ab5a005c51d3663"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-graph-win32-x64.exe",
+      "sha256": "e2933fcf6ad0d7ab517c0beda4f8c7258638602bca73170dbda2cd8311c8637f"
     }
   }
 }

package/src/agent/orchestrator/tools/patch-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.7.14",
+  "version": "0.7.15",
   "_comment": "Rewritten by .github/workflows/patch-release.yml on each tagged release. assets maps platformKey (process.platform-process.arch, e.g. win32-x64, linux-x64, darwin-arm64) to { url, sha256 } of the mixdog-patch binary on the GitHub release. A local cargo build under native/mixdog-patch/target/release always takes precedence; otherwise the binary is fetched per this manifest into the data dir (apply is native-only — no JS apply engine).",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-darwin-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-patch-darwin-arm64",
       "sha256": "836a0b60a443b0a6a8c1bbe24d15a79ed70ee92c2f0fbc05374c4e9ed2536415"
     },
     "darwin-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-darwin-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-patch-darwin-x64",
       "sha256": "cab10c4e1e8b72d3958241dffdff764712ed74f4861d105bafa8258961215c98"
     },
     "linux-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-linux-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-patch-linux-arm64",
       "sha256": "a90c32ce3417a7d853f2723f82f3613cf2cd030fe885cf710cfc9f8e4b193264"
     },
     "linux-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-linux-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-patch-linux-x64",
       "sha256": "0fea40ab98acd35bfb47515756024d1882a2abbaddce8a0b51642d20ac405577"
     },
     "win32-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-win32-x64.exe",
-      "sha256": "d6e7d19bf48c55f3a54bf5183546b657f2a34ebb235f25304d2d37b74017c873"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.15/mixdog-patch-win32-x64.exe",
+      "sha256": "bc57bc029667bd62ce3798b4bfe23a42e4278148a6bbb778236769b3713397d8"
     }
   }
 }

package/src/channels/index.mjs

@@ -1826,12 +1826,21 @@ function wireWebhookHandlers() {
       // partial `silent_to_agent` semantics that still audit to Discord.
       const raw = String(text);
       if (/^\s*(?:\[[^\]\n]+\]\s*)*\[meta:silent\]/.test(raw)) return;
+      // Deterministic findings-count drop. Code-review handlers emit a
+      // structured `[[findings:N]]` token (N = number of issues). The RELAY —
+      // not the worker's prose — decides: N==0 => clean review, drop entirely
+      // (no Lead inject, no Discord forward). Token absent => fail-safe forward
+      // so a real finding is never silently dropped if the worker omits it.
+      const fc = raw.match(/\[\[findings:(\d+)\]\]/i);
+      if (fc && Number(fc[1]) === 0) return;
       // Lifecycle pings (started / iter echoes, marked silent_to_agent) are
       // channel noise for an automated webhook review — drop them entirely so
       // a skip stays fully silent and only the final answer reaches the
       // channel. The final [meta:silent] skip result is already dropped above.
       if (meta?.silent_to_agent === true) return;
-      injectAndRecord(channelId, label, raw, {
+      // Strip the verdict token before surfacing (findings present, N>0).
+      const surfaced = raw.replace(/\[\[findings:\d+\]\]/gi, "").replace(/[^\S\n]{2,}/g, " ").trim();
+      injectAndRecord(channelId, label, surfaced || raw, {
         type: "webhook",
         instruction,
       });

package/src/shared/config.mjs

@@ -297,16 +297,19 @@ export function getSearchApiKey(provider) {
 
 // Standard provider env names take precedence so existing OPENAI_API_KEY-style
 // exports keep working, then MIXDOG_AGENT_<P>_APIKEY, then the OS keychain.
-const AGENT_PROVIDER_ENV = Object.freeze({
+// SSOT for agent API-key providers: setup-server.mjs and config-merge.mjs import
+// this so UI key-presence detection uses the exact same predicate the runtime
+// loads from. Add a provider here and every path picks it up.
+export const AGENT_PROVIDER_ENV = Object.freeze({
   openai: 'OPENAI_API_KEY', anthropic: 'ANTHROPIC_API_KEY', gemini: 'GEMINI_API_KEY',
-  deepseek: 'DEEPSEEK_API_KEY', xai: 'XAI_API_KEY',
+  deepseek: 'DEEPSEEK_API_KEY', xai: 'XAI_API_KEY', 'opencode-go': 'OPENCODE_API_KEY',
 })
 
 // Last-resort env aliases honored AFTER the standard env / MIXDOG_AGENT_* /
 // keychain sources. GROK_API_KEY is the established xAI alias elsewhere in the
 // repo (search discovery, xai-api/grok-oauth backends), so honoring it here
 // keeps provider discovery and dispatch resolving the same credential.
-const AGENT_PROVIDER_ENV_ALIASES = Object.freeze({
+export const AGENT_PROVIDER_ENV_ALIASES = Object.freeze({
   xai: ['GROK_API_KEY'],
 })