mixdog 0.7.14 → 0.7.16

package/src/agent/orchestrator/config.mjs

@@ -1,5 +1,5 @@
 import { resolvePluginData } from '../../shared/plugin-paths.mjs';
-import { readSection, updateSection, getAgentApiKey } from '../../shared/config.mjs';
+import { readSection, updateSection, getAgentApiKey, AGENT_PROVIDER_ENV } from '../../shared/config.mjs';
 import { OPENAI_COMPAT_PRESETS } from './providers/openai-compat.mjs';
 import { hasAnthropicOAuthCredentials } from './providers/anthropic-oauth.mjs';
 import { hasOpenAIOAuthCredentials } from './providers/openai-oauth.mjs';
@@ -10,13 +10,9 @@ import { hasGrokOAuthCredentials } from './providers/grok-oauth.mjs';
 export function getPluginData() {
     return resolvePluginData();
 }
-const ENV_KEY_MAP = {
-    openai: 'OPENAI_API_KEY',
-    anthropic: 'ANTHROPIC_API_KEY',
-    gemini: 'GEMINI_API_KEY',
-    deepseek: 'DEEPSEEK_API_KEY',
-    xai: 'XAI_API_KEY',
-};
+// First-class agent API-key providers: imported from the shared SSOT
+// (src/shared/config.mjs) so default-config and overlay paths cannot drift
+// from the env names the runtime key loader (getAgentApiKey) actually uses.
 // Canonical maintenance defaults. Single source of truth — imported by
 // llm/index.mjs and setup-server.mjs so UI/runtime cannot drift from config.
 //
@@ -73,7 +69,7 @@ export const DEFAULT_PRESETS = Object.freeze([
 function buildDefaultConfig() {
     const providers = {};
     // API providers — enabled if env key exists
-    for (const [name, envKey] of Object.entries(ENV_KEY_MAP)) {
+    for (const [name, envKey] of Object.entries(AGENT_PROVIDER_ENV)) {
         const apiKey = process.env[envKey];
         providers[name] = {
             enabled: !!apiKey,
@@ -138,11 +134,11 @@ export function loadConfig() {
             // Provider API keys live in the OS keychain (std env / MIXDOG_AGENT_*
             // -> keychain), never plaintext in config. Overlay them so the
             // provider clients see config.apiKey populated.
-            // ENV_KEY_MAP covers first-class key providers; OPENAI_COMPAT_PRESETS
+            // AGENT_PROVIDER_ENV covers first-class key providers; OPENAI_COMPAT_PRESETS
             // covers compat providers (opencode-go, …) whose key also lives in
             // the keychain. Without the union, a compat provider with a valid
             // stored key still ships 'no-key' → 401.
-            for (const name of new Set([...Object.keys(ENV_KEY_MAP), ...Object.keys(OPENAI_COMPAT_PRESETS)])) {
+            for (const name of new Set([...Object.keys(AGENT_PROVIDER_ENV), ...Object.keys(OPENAI_COMPAT_PRESETS)])) {
                 const kc = getAgentApiKey(name);
                 if (kc) mergedProviders[name] = { ...(mergedProviders[name] || {}), apiKey: kc, enabled: true };
             }

package/src/agent/orchestrator/tools/builtin/path-utils.mjs

@@ -1,6 +1,7 @@
 import { homedir } from 'os';
 import { isAbsolute, relative, resolve } from 'path';
 import { realpathSync } from 'node:fs';
+import { isWSL } from '../../../../shared/wsl.mjs';
 
 // Restore the on-disk casing of a path (win32 only). rg relativizes candidate
 // paths against its process cwd with a CASE-SENSITIVE prefix strip before
@@ -28,6 +29,21 @@ export function posixPathToWindowsPath(posixPath) {
     return posixPath;
 }
 
+// Reverse of posixPathToWindowsPath, for WSL: a Windows-HOST drive path that
+// arrives from the host (e.g. `C:\Users\x` or `C:/Users/x`) is unreachable as
+// a literal under WSL — the drive surfaces at `/mnt/<letter>/...`. Map
+// `<drive>:` → `/mnt/<lowercase-drive>` and flip backslashes to slashes. Only
+// drive-letter paths are touched; anything else is returned unchanged.
+export function windowsPathToPosixPath(winPath) {
+    if (typeof winPath !== 'string') return winPath;
+    const m = winPath.match(/^([a-zA-Z]):[\\/](.*)$/);
+    if (m) return `/mnt/${m[1].toLowerCase()}/${m[2].replace(/\\/g, '/')}`;
+    // Bare `C:` with no separator → drive root.
+    const root = winPath.match(/^([a-zA-Z]):$/);
+    if (root) return `/mnt/${root[1].toLowerCase()}/`;
+    return winPath;
+}
+
 export function normalizeInputPath(p) {
     if (typeof p !== 'string') return p;
     // Trim leading/trailing whitespace — LLMs intermittently emit paths with
@@ -49,6 +65,13 @@ export function normalizeInputPath(p) {
         if (looksPosixDrive || looksCygdrive || looksWsl || looksUnc) {
             out = posixPathToWindowsPath(out);
         }
+    } else if (isWSL()) {
+        // Reverse direction: a Windows-style drive path from the host maps to
+        // the /mnt/<letter> mount. Native-Linux behavior is untouched (gated
+        // on isWSL()); a path already in /mnt/... POSIX form is left as-is.
+        if (/^[a-zA-Z]:([\\/]|$)/.test(out)) {
+            out = windowsPathToPosixPath(out);
+        }
     }
     try { out = out.normalize('NFC'); } catch {}
     return out;

package/src/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -712,7 +712,11 @@ export function adoptForegroundShellJob({ command, cwd, pid, timeoutMs, mergeStd
 }
 
 function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, shellArg, shellType, clientHostPid }) {
-    if (process.platform === 'win32' && isPowerShellShell(shell, shellType)) {
+    // Route ANY PowerShell shell to the PS wrapper, regardless of platform.
+    // Gating on win32 sent shell:'powershell' on macOS/Linux down the POSIX
+    // path below, which spawns `pwsh <wrapper>.sh` — pwsh then tries to run a
+    // bash script. isPowerShellShell already matches pwsh/powershell by stem.
+    if (isPowerShellShell(shell, shellType)) {
         return startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, clientHostPid });
     }
 
@@ -738,9 +742,11 @@ function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr
     // only the setTimeout below enforced; a mixdog restart between spawn
     // and deadline would orphan the runaway. --preserve-status keeps the
     // user command's exit code on success; on timeout the wrapper exits 124.
-    // `timeout` ships with GNU coreutils on Linux and brew coreutils on
-    // macOS; absent platforms fall through to the inner
-    // command (the parent setTimeout still calls refreshShellJob to clean up).
+    // `timeout` ships with GNU coreutils on Linux. On macOS, Homebrew
+    // coreutils installs it as `gtimeout` (the un-prefixed name is NOT created
+    // by default), so the wrapper picks `timeout` if present else `gtimeout`.
+    // When neither exists it falls through to the inner command (the parent
+    // setTimeout still calls refreshShellJob to clean up).
     const userCmdQuoted = shellQuoteSingle(command);
     // P2 fix: invoke the resolved shell (not bash -c) so zsh / dash /
     // alternate shells run snapshot-aware commands correctly. Drop
@@ -762,7 +768,7 @@ function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr
     // status for processes that actually exited 0. `rm -- "$0"` removes
     // the staged wrapper .cmd.sh after donePath is published so a host
     // crash before this point still leaves the file for the sweep to GC.
-    const wrapped = `{ if command -v timeout >/dev/null 2>&1; then touch ${shellQuoteSingle(enforcedPath)}; timeout ${timeoutSeconds} ${innerShellQ} ${innerArgQ} ${userCmdQuoted}; else ${innerShellQ} ${innerArgQ} ${userCmdQuoted}; fi; rc=$?; printf '%s' "$rc" > ${shellQuoteSingle(exitPath)}; touch ${shellQuoteSingle(donePath)}; rm -- "$0" 2>/dev/null; exit $rc; }`;
+    const wrapped = `{ if command -v timeout >/dev/null 2>&1; then _to=timeout; elif command -v gtimeout >/dev/null 2>&1; then _to=gtimeout; else _to=; fi; if [ -n "$_to" ]; then touch ${shellQuoteSingle(enforcedPath)}; "$_to" ${timeoutSeconds} ${innerShellQ} ${innerArgQ} ${userCmdQuoted}; else ${innerShellQ} ${innerArgQ} ${userCmdQuoted}; fi; rc=$?; printf '%s' "$rc" > ${shellQuoteSingle(exitPath)}; touch ${shellQuoteSingle(donePath)}; rm -- "$0" 2>/dev/null; exit $rc; }`;
     // Stage the wrapped command to a .sh and let the script open its own
     // output files via `exec > … 2> …`. The parent does NOT pass file
     // descriptors via stdio inheritance (`stdio: 'ignore'` for all three).
@@ -841,9 +847,24 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
         '$code = 1',
         'try {',
         "    $argList = @('-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', $encoded)",
-        '    $p = Start-Process -FilePath $exe -ArgumentList $argList -RedirectStandardOutput $stdoutPath -RedirectStandardError $stderrPath -WindowStyle Hidden -PassThru',
+        // -WindowStyle is a Windows-only Start-Process parameter; pwsh on
+        // macOS/Linux throws "not supported on this platform". Add it only on win32.
+        '    $spArgs = @{ FilePath = $exe; ArgumentList = $argList; RedirectStandardOutput = $stdoutPath; RedirectStandardError = $stderrPath; PassThru = $true }',
+        '    if ($IsWindows -or $null -eq $IsWindows) { $spArgs[\'WindowStyle\'] = \'Hidden\' }',
+        '    $p = Start-Process @spArgs',
         '    if ($timeoutMs -gt 0 -and -not $p.WaitForExit($timeoutMs)) {',
-        '        try { Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue } catch {}',
+        // Kill the whole process TREE, not just the direct child: Start-Process
+        // launches an intermediate pwsh that spawns the user command, so
+        // Stop-Process on $p.Id alone orphans the grandchildren. On Windows use
+        // `taskkill /T /F` (tree-terminate); on macOS/Linux pwsh, fall back to
+        // Stop-Process (no taskkill there).
+        '        try {',
+        '            if ($IsWindows -or $null -eq $IsWindows) {',
+        '                & taskkill.exe /pid $p.Id /t /f 2>$null | Out-Null',
+        '            } else {',
+        '                try { Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue } catch {}',
+        '            }',
+        '        } catch {}',
         '        $code = 124',
         '    } else {',
         '        try { $p.WaitForExit() } catch {}',
@@ -875,9 +896,14 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
     }
 
     const shellStem = basename(String(shell || '')).toLowerCase().replace(/\.exe$/, '');
-    const wrapperArgs = shellStem === 'powershell'
-        ? ['-NoLogo', '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-ExecutionPolicy', 'Bypass', '-File', wrappedTempPath]
-        : ['-NoLogo', '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-File', wrappedTempPath];
+    // `-WindowStyle Hidden` is a Windows-only CLI switch; pwsh on macOS/Linux
+    // rejects it. `-ExecutionPolicy` likewise only applies to Windows
+    // PowerShell. Build args per-platform so cross-OS pwsh background jobs run.
+    const isWin = process.platform === 'win32';
+    const wrapperArgs = ['-NoLogo', '-NoProfile', '-NonInteractive'];
+    if (isWin) wrapperArgs.push('-WindowStyle', 'Hidden');
+    if (isWin && shellStem === 'powershell') wrapperArgs.push('-ExecutionPolicy', 'Bypass');
+    wrapperArgs.push('-File', wrappedTempPath);
     // Spawn the staged wrapper directly. detached MUST be false on Windows:
     // a native pwsh launched with detached:true + stdio:'ignore' exits
     // immediately without running -File (verified — the detached child dies

package/src/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -19,10 +19,15 @@ function shellTypeFor(shell) {
 
 function shellSpec(shell, shellType = shellTypeFor(shell)) {
     if (shellType === 'powershell') {
+        // `-WindowStyle Hidden` is a Windows-only switch. PowerShell Core
+        // (pwsh) on macOS/Linux rejects it, so only append it on win32.
+        const psArgs = ['-NoLogo', '-NoProfile', '-NonInteractive'];
+        if (process.platform === 'win32') psArgs.push('-WindowStyle', 'Hidden');
+        psArgs.push('-Command');
         return {
             shell,
             shellArg: '-Command',
-            shellArgs: ['-NoLogo', '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-Command'],
+            shellArgs: psArgs,
             shellType,
         };
     }
@@ -60,8 +65,10 @@ function resolveWindowsPowerShell() {
 
 export function resolveShell() {
     if (_resolvedShell) return _resolvedShell;
-    const isWindows = process.platform === 'win32'
-        || !!(process.env.WINDIR || process.env.SystemRoot);
+    // Gate on the actual platform, NOT WINDIR/SystemRoot env presence: under
+    // WSL those vars can be inherited via interop while process.platform is
+    // 'linux', and WSL must resolve /bin/sh — not Windows PowerShell.
+    const isWindows = process.platform === 'win32';
     if (!isWindows) {
         _resolvedShell = shellSpec('/bin/sh', 'posix');
         return _resolvedShell;
@@ -76,7 +83,9 @@ export function resolveShell() {
 }
 
 function _isWindows() {
-    return process.platform === 'win32' || !!(process.env.WINDIR || process.env.SystemRoot);
+    // Real-platform check only (see resolveShell): env presence would make
+    // WSL (process.platform 'linux') mis-resolve to Windows Git Bash.
+    return process.platform === 'win32';
 }
 
 // Resolve Git Bash on Windows. Strategy (invariant-based, no silent fallback):

package/src/agent/orchestrator/tools/graph-binary-fetcher.mjs

@@ -118,7 +118,17 @@ export function ensureGraphBinary(dataDir) {
     const pkey = platformKey();
     const asset = manifest.assets?.[pkey];
     if (!asset || !asset.url || !asset.sha256) {
-      throw new Error(`[graph-fetcher] no prebuilt mixdog-graph asset for platform ${pkey}`);
+      // Unsupported platform/arch (e.g. win32-arm64): the manifest has no
+      // downloadable asset for this {os}-{arch}. The code graph has NO JS
+      // parsing fallback, so this is terminal — surface a single clear,
+      // actionable message instead of a cryptic crash downstream.
+      const supported = Object.keys(manifest.assets || {}).join(', ') || '(none)';
+      throw new Error(
+        `[graph-fetcher] no prebuilt mixdog-graph binary for platform ${pkey} `
+        + `(unsupported platform/arch — there is no JS parsing fallback). `
+        + `Supported platforms: ${supported}. `
+        + `Build it locally: cargo build --release in native/mixdog-graph.`,
+      );
     }
     const version = String(manifest.version || '0');
     const dir = graphBinDir(dataDir);

package/src/agent/orchestrator/tools/graph-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.7.14",
+  "version": "0.7.16",
   "_comment": "Rewritten by .github/workflows/graph-release.yml on each tagged release. assets maps platformKey (process.platform-process.arch, e.g. win32-x64, linux-x64, darwin-arm64) to { url, sha256 } of the mixdog-graph binary on the GitHub release. A local cargo build under native/mixdog-graph/target/release always takes precedence at runtime. (v0.5.236 entries were filled manually after CI's commit step hit detached HEAD; the workflow now checks out ref: main so future releases self-update.)",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-darwin-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-graph-darwin-arm64",
       "sha256": "53f45f8373000fb55ccb49f9b03af0275ca2a663f924b68ee8ded4535e14445a"
     },
     "darwin-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-darwin-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-graph-darwin-x64",
       "sha256": "347dc5e1b39dfc33ae07e01319b085c1f1ee775a70be1ac09f7b0d2954b36591"
     },
     "linux-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-linux-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-graph-linux-arm64",
       "sha256": "7648be2c4bc89bef837b4843639a9ab38c382ba103518ad52d4439587521542f"
     },
     "linux-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-linux-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-graph-linux-x64",
       "sha256": "6e5a1b548c69c3a51170eb11c769985be7ca7029ede2597b19304c8dc106eded"
     },
     "win32-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-graph-win32-x64.exe",
-      "sha256": "2ca840a008a26a6ebdeab2803a994c6b2a462b178269cc3e2ab5a005c51d3663"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-graph-win32-x64.exe",
+      "sha256": "6e53cdf523871f818942678d95e2235105b939ceeafc56a3b83b8190eeeba026"
     }
   }
 }

package/src/agent/orchestrator/tools/patch-binary-fetcher.mjs

@@ -107,7 +107,17 @@ export function ensurePatchBinary(dataDir) {
     const pkey = platformKey();
     const asset = manifest.assets?.[pkey];
     if (!asset || !asset.url || !asset.sha256) {
-      throw new Error(`[patch-fetcher] no prebuilt mixdog-patch asset for platform ${pkey}`);
+      // Unsupported platform/arch (e.g. win32-arm64): the manifest has no
+      // downloadable asset for this {os}-{arch}. apply_patch is native-only
+      // (no JS apply fallback), so this is terminal — surface a single clear,
+      // actionable message instead of a cryptic crash downstream.
+      const supported = Object.keys(manifest.assets || {}).join(', ') || '(none)';
+      throw new Error(
+        `[patch-fetcher] no prebuilt mixdog-patch binary for platform ${pkey} `
+        + `(unsupported platform/arch — apply_patch is native-only, no JS apply fallback). `
+        + `Supported platforms: ${supported}. `
+        + `Build it locally: cargo build --release in native/mixdog-patch.`,
+      );
     }
     const version = String(manifest.version || '0');
     const dir = patchBinDir(dataDir);

package/src/agent/orchestrator/tools/patch-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.7.14",
+  "version": "0.7.16",
   "_comment": "Rewritten by .github/workflows/patch-release.yml on each tagged release. assets maps platformKey (process.platform-process.arch, e.g. win32-x64, linux-x64, darwin-arm64) to { url, sha256 } of the mixdog-patch binary on the GitHub release. A local cargo build under native/mixdog-patch/target/release always takes precedence; otherwise the binary is fetched per this manifest into the data dir (apply is native-only — no JS apply engine).",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-darwin-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-patch-darwin-arm64",
       "sha256": "836a0b60a443b0a6a8c1bbe24d15a79ed70ee92c2f0fbc05374c4e9ed2536415"
     },
     "darwin-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-darwin-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-patch-darwin-x64",
       "sha256": "cab10c4e1e8b72d3958241dffdff764712ed74f4861d105bafa8258961215c98"
     },
     "linux-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-linux-arm64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-patch-linux-arm64",
       "sha256": "a90c32ce3417a7d853f2723f82f3613cf2cd030fe885cf710cfc9f8e4b193264"
     },
     "linux-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-linux-x64",
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-patch-linux-x64",
       "sha256": "0fea40ab98acd35bfb47515756024d1882a2abbaddce8a0b51642d20ac405577"
     },
     "win32-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.14/mixdog-patch-win32-x64.exe",
-      "sha256": "d6e7d19bf48c55f3a54bf5183546b657f2a34ebb235f25304d2d37b74017c873"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.16/mixdog-patch-win32-x64.exe",
+      "sha256": "81fbabab9aa53f5fa57b1691b5ab24cbc1cf6ac1c2a36482c336411abe452d14"
     }
   }
 }

package/src/channels/index.mjs

@@ -1826,12 +1826,21 @@ function wireWebhookHandlers() {
       // partial `silent_to_agent` semantics that still audit to Discord.
       const raw = String(text);
       if (/^\s*(?:\[[^\]\n]+\]\s*)*\[meta:silent\]/.test(raw)) return;
+      // Deterministic findings-count drop. Code-review handlers emit a
+      // structured `[[findings:N]]` token (N = number of issues). The RELAY —
+      // not the worker's prose — decides: N==0 => clean review, drop entirely
+      // (no Lead inject, no Discord forward). Token absent => fail-safe forward
+      // so a real finding is never silently dropped if the worker omits it.
+      const fc = raw.match(/\[\[findings:(\d+)\]\]/i);
+      if (fc && Number(fc[1]) === 0) return;
       // Lifecycle pings (started / iter echoes, marked silent_to_agent) are
       // channel noise for an automated webhook review — drop them entirely so
       // a skip stays fully silent and only the final answer reaches the
       // channel. The final [meta:silent] skip result is already dropped above.
       if (meta?.silent_to_agent === true) return;
-      injectAndRecord(channelId, label, raw, {
+      // Strip the verdict token before surfacing (findings present, N>0).
+      const surfaced = raw.replace(/\[\[findings:\d+\]\]/gi, "").replace(/[^\S\n]{2,}/g, " ").trim();
+      injectAndRecord(channelId, label, surfaced || raw, {
         type: "webhook",
         instruction,
       });

package/src/channels/lib/executor.mjs

@@ -130,30 +130,65 @@ function runScript(name, scriptName, onResult) {
     return;
   }
   const ext = extname(scriptName).toLowerCase();
-  const cmd = ext === ".py" ? "python3" : "node";
-  const proc = spawn(cmd, [scriptPath], {
-    timeout: 3e4,
-    env: { ...process.env },
-    windowsHide: true
-  });
-  let stdout = "";
-  let stderr = "";
-  if (proc.stdout) proc.stdout.on("data", (d) => {
-    stdout += d;
-  });
-  if (proc.stderr) proc.stderr.on("data", (d) => {
-    stderr += d;
-  });
-  proc.on("close", (code) => {
-    if (code !== 0) {
-      logEvent(`${name}: script exited ${code}: ${stderr.substring(0, 500)}`);
-    }
-    onResult(stdout.substring(0, 2e3), code);
-  });
-  proc.on("error", (err) => {
-    logEvent(`${name}: script spawn error: ${err.message}`);
-    onResult("", null);
-  });
+  // Pick interpreter candidates. `python3` does not exist on a default
+  // Windows install — the Python launcher `py` (and often `python`) does —
+  // so on win32 try py → python → python3, falling through on ENOENT.
+  // POSIX keeps python3 → python.
+  let candidates;
+  if (ext === ".py") {
+    candidates = process.platform === "win32"
+      ? ["py", "python", "python3"]
+      : ["python3", "python"];
+  } else {
+    candidates = ["node"];
+  }
+  // onResult MUST fire exactly once across the whole candidate chain. A failed
+  // ENOENT spawn emits BOTH 'error' (→ we advance) AND 'close', so guard the
+  // final callback at the chain level and mark each attempt that advanced so
+  // its own 'close' is ignored.
+  let resultSent = false;
+  const finish = (out, code) => {
+    if (resultSent) return;
+    resultSent = true;
+    onResult(out, code);
+  };
+  const trySpawn = (idx) => {
+    const cmd = candidates[idx];
+    let advanced = false;
+    const proc = spawn(cmd, [scriptPath], {
+      timeout: 3e4,
+      env: { ...process.env },
+      windowsHide: true
+    });
+    let stdout = "";
+    let stderr = "";
+    if (proc.stdout) proc.stdout.on("data", (d) => {
+      stdout += d;
+    });
+    if (proc.stderr) proc.stderr.on("data", (d) => {
+      stderr += d;
+    });
+    proc.on("close", (code) => {
+      // This attempt ENOENT'd and handed off to the next candidate — its
+      // 'close' is spurious and must not report a result.
+      if (advanced) return;
+      if (code !== 0) {
+        logEvent(`${name}: script exited ${code}: ${stderr.substring(0, 500)}`);
+      }
+      finish(stdout.substring(0, 2e3), code);
+    });
+    proc.on("error", (err) => {
+      // Interpreter not found → try the next candidate before giving up.
+      if (err.code === "ENOENT" && idx + 1 < candidates.length) {
+        advanced = true;
+        trySpawn(idx + 1);
+        return;
+      }
+      logEvent(`${name}: script spawn error: ${err.message}`);
+      finish("", null);
+    });
+  };
+  trySpawn(0);
 }
 export {
   applyParser,

package/src/channels/lib/hook-pipe-server.mjs

@@ -35,7 +35,14 @@ const {
 // net.createServer().listen() accepts both transparently.
 const PIPE_PATH = moduleRequire('../../../lib/hook-pipe-path.cjs')()
 
-const RUNTIME_ROOT = join(tmpdir(), 'mixdog')
+// Honor MIXDOG_RUNTIME_ROOT consistently with runtime-paths.mjs (the consumer
+// of these tool-exec signals): when the override is set, the signal PRODUCER
+// here must write into the same root the channels worker watches, or signals
+// are silently dropped. Default stays tmpdir()/mixdog so non-override installs
+// are unchanged.
+const RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
+  ? pathResolve(process.env.MIXDOG_RUNTIME_ROOT)
+  : join(tmpdir(), 'mixdog')
 const SIGNAL_CONSUMER_MARKER = join(RUNTIME_ROOT, '.tool-exec-consumer')
 const SUBAGENT_SIGNAL_CONSUMER_MARKER = join(RUNTIME_ROOT, '.tool-exec-subagent-consumer')
 const SIGNAL_RE_GENERIC = /^tool-exec-\d+-[0-9a-f]+\.signal$/

package/src/memory/lib/runtime-fetcher.mjs

@@ -341,13 +341,29 @@ export async function ensureRuntime(dataDir) {
   const pkey     = platformKey()
   const asset    = manifest.assets?.[pkey]
   if (!asset) {
+    // Platform/arch absent from the manifest entirely (e.g. win32-arm64).
+    // The memory PG runtime cannot start here; fail with a single clear,
+    // actionable message. The memory worker's init().catch reports this as
+    // degraded and the rest of mixdog (agent, tools) keeps working without
+    // memory.
+    const supported = Object.keys(manifest.assets || {})
+      .filter((k) => isUsableAsset(manifest.assets[k]))
+      .join(', ') || '(none)'
     throw new Error(
-      `[runtime-fetcher] no asset for platform ${pkey} in manifest. ` +
-      `Available: ${Object.keys(manifest.assets || {}).join(', ')}`
+      `[runtime-fetcher] memory runtime not available on ${pkey}: ` +
+      `no runtime asset for this platform/arch in the manifest. ` +
+      `Supported: ${supported}. ` +
+      `Memory is disabled on this platform; the rest of mixdog continues to work.`
     )
   }
   if (!isUsableAsset(asset)) {
-    throw new Error(`unsupported platform/arch: no validated runtime asset for ${pkey}`)
+    // Platform/arch present but explicitly marked unsupported or carrying a
+    // placeholder/TBD payload (e.g. linux-arm64). Same graceful-degrade path.
+    throw new Error(
+      `[runtime-fetcher] memory runtime not available on ${pkey}: ` +
+      `this platform/arch is marked unsupported (no validated runtime asset). ` +
+      `Memory is disabled on this platform; the rest of mixdog continues to work.`
+    )
   }
 
   const { url, sha256, size } = asset

package/src/search/lib/web-tools.mjs

@@ -6,6 +6,7 @@ import { Agent, fetch as undiciFetch } from 'undici'
 import { JSDOM } from 'jsdom'
 import puppeteer from 'puppeteer-core'
 import { Readability } from '@mozilla/readability'
+import { isWSL } from '../../shared/wsl.mjs'
 
 
 const PKG_VERSION = (() => { try { return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version } catch { return '0.0.1' } })()
@@ -38,13 +39,24 @@ const COMMON_BROWSER_PATHS = (() => {
     ].filter(Boolean)
   }
   if (platform === 'linux') {
-    return [
+    // Native-Linux Chromium/Chrome binaries first. The /mnt/c Windows .exe
+    // entries are reachable from WSL's filesystem but puppeteer-core CANNOT
+    // drive a Windows GUI browser as a Linux child process (CDP over a pipe to
+    // a Win32 binary launched from the Linux ABI does not work), so advertising
+    // puppeteer-available off a Windows .exe yields launch failures at runtime.
+    // Only offer the Windows .exe fallbacks on plain Linux (Wine/dual-mount
+    // edge cases), never under WSL.
+    const linuxNative = [
       '/usr/bin/google-chrome',
       '/usr/bin/google-chrome-stable',
       '/usr/bin/chromium',
       '/usr/bin/chromium-browser',
       '/snap/bin/chromium',
       '/usr/bin/microsoft-edge',
+    ]
+    if (isWSL()) return linuxNative
+    return [
+      ...linuxNative,
       '/mnt/c/Program Files/Google/Chrome/Application/chrome.exe',
       '/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe',
       '/mnt/c/Program Files/Microsoft/Edge/Application/msedge.exe',

package/src/shared/config.mjs

@@ -297,16 +297,19 @@ export function getSearchApiKey(provider) {
 
 // Standard provider env names take precedence so existing OPENAI_API_KEY-style
 // exports keep working, then MIXDOG_AGENT_<P>_APIKEY, then the OS keychain.
-const AGENT_PROVIDER_ENV = Object.freeze({
+// SSOT for agent API-key providers: setup-server.mjs and config-merge.mjs import
+// this so UI key-presence detection uses the exact same predicate the runtime
+// loads from. Add a provider here and every path picks it up.
+export const AGENT_PROVIDER_ENV = Object.freeze({
   openai: 'OPENAI_API_KEY', anthropic: 'ANTHROPIC_API_KEY', gemini: 'GEMINI_API_KEY',
-  deepseek: 'DEEPSEEK_API_KEY', xai: 'XAI_API_KEY',
+  deepseek: 'DEEPSEEK_API_KEY', xai: 'XAI_API_KEY', 'opencode-go': 'OPENCODE_API_KEY',
 })
 
 // Last-resort env aliases honored AFTER the standard env / MIXDOG_AGENT_* /
 // keychain sources. GROK_API_KEY is the established xAI alias elsewhere in the
 // repo (search discovery, xai-api/grok-oauth backends), so honoring it here
 // keeps provider discovery and dispatch resolving the same credential.
-const AGENT_PROVIDER_ENV_ALIASES = Object.freeze({
+export const AGENT_PROVIDER_ENV_ALIASES = Object.freeze({
   xai: ['GROK_API_KEY'],
 })
 
@@ -331,7 +334,26 @@ export function getAgentApiKey(provider) {
  * Never writes to mixdog-config.json.
  */
 export function saveSecret(account, value) {
-  _setSecret(account, value)
+  try {
+    _setSecret(account, value)
+  } catch (err) {
+    // On WSL/headless Linux (and any host missing a usable keychain backend,
+    // e.g. keytar/libsecret not installed or no running Secret Service) the OS
+    // write throws a cryptic backend error. Surface an actionable message that
+    // points at the env-var read path the getters already honor, instead of
+    // silently writing the plaintext secret to mixdog-config.json.
+    const envKey = _envKey(account)
+    const agentMatch = String(account || '').match(/^agent\.([^.]+)\.apiKey$/)
+    const stdEnv = agentMatch ? AGENT_PROVIDER_ENV[agentMatch[1]] : null
+    const envHint = stdEnv ? `${stdEnv} (or ${envKey})` : envKey
+    const e = new Error(
+      `[config] could not save secret to the OS keychain: ${err && err.message ? err.message : err}\n` +
+      `  No usable keychain backend on this host (common on WSL / headless Linux without libsecret).\n` +
+      `  Set the ${envHint} environment variable instead — the runtime reads it directly.`
+    )
+    e.cause = err
+    throw e
+  }
 }
 
 export function deleteSecret(account) {