mixdog 0.7.17 → 0.8.0

package/src/shared/llm/http-agent.mjs

@@ -1,123 +0,0 @@
-/**
- * Shared HTTP connection pool for outbound LLM provider API calls.
- *
- * The provider modules (anthropic-oauth, openai-oauth, grok-oauth, gemini)
- * call the global `fetch()` with no dispatcher, so they ride Node's default
- * undici agent. That agent keeps connections alive only briefly, so after an
- * idle gap the first request to a provider pays a fresh TLS handshake — a
- * 100-300ms first-byte penalty observed on cold calls.
- *
- * This module exports ONE lazily-created singleton undici `Agent` with a long
- * keep-alive window and a sane connection cap, passed as the `dispatcher`
- * option on those providers' `fetch()` calls so warm sockets survive idle
- * gaps. `preconnect(origin)` opens a socket ahead of the first real request
- * (best-effort, errors swallowed) and is called once at provider construction.
- *
- * Scope note: this is deliberately NOT used by src/search/lib/web-tools.mjs,
- * whose per-request Agent pins a pre-validated DNS address for SSRF safety and
- * must own its own short-lived pool. LLM API origins are fixed, trusted hosts,
- * so a shared long-lived pool is appropriate here.
- */
-
-import { Agent, getGlobalDispatcher, request as undiciRequest } from 'undici'
-
-let _agent = null
-
-function envInt(name, fallback) {
-  const raw = process.env[name]
-  if (!raw) return fallback
-  const n = Number(raw)
-  return Number.isFinite(n) && n > 0 ? Math.trunc(n) : fallback
-}
-
-/**
- * Detect whether outbound HTTP is meant to flow through a proxy or any custom
- * global dispatcher. When so, pinning our own bare keep-alive `Agent` as the
- * per-request `dispatcher` would silently bypass `setGlobalDispatcher(...)` and
- * env-proxy wiring — so callers must fall back to the global dispatcher.
- *
- * What is preserved (we step aside): explicit proxy env vars, undici's built-in
- * `ProxyAgent`, and ANY non-default global dispatcher — i.e. any installed
- * global whose constructor name is not `Agent` (undici's default global is a
- * plain `Agent`). Our own singleton is never installed via
- * `setGlobalDispatcher`, so this never self-detects.
- *
- * Accepted gap: a custom dispatcher deliberately constructed AS a plain undici
- * `Agent` and set as the global is indistinguishable from the default here, so
- * we'd keep using our shared pool. That's tolerable — such a dispatcher is
- * itself a direct-connection pool (no proxy hop), so the bypass risk is minimal.
- */
-function proxyConfigured() {
-  const env = process.env
-  if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) return true
-  if (env.NODE_USE_ENV_PROXY) return true
-  try {
-    const g = getGlobalDispatcher?.()
-    // Any non-default global dispatcher (constructor name other than the plain
-    // `Agent` undici installs by default) is treated as custom — ProxyAgent,
-    // EnvHttpProxyAgent, MockAgent, or a user subclass — and we step aside.
-    if (g && g.constructor && g.constructor.name !== 'Agent') return true
-  } catch { /* getGlobalDispatcher unavailable — treat as no proxy */ }
-  return false
-}
-
-/**
- * The shared singleton dispatcher for LLM API requests. Created on first use.
- *
- * keepAliveTimeout (~60s) keeps a socket warm across the typical idle gap
- * between bridge turns; connections caps concurrent sockets per origin so a
- * burst of parallel calls can't open an unbounded number of handshakes.
- *
- * Returns `undefined` when a proxy / any custom (non-default) global dispatcher
- * is configured, so `fetch({ dispatcher: undefined })` falls back to that
- * global dispatcher instead of bypassing it. `dispatcher: undefined` is a
- * harmless fetch option, so call sites need no change.
- */
-export function getLlmDispatcher() {
-  if (proxyConfigured()) return undefined
-  if (_agent) return _agent
-  _agent = new Agent({
-    keepAliveTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MS', 60_000),
-    // Cap the idle keep-alive bump the server may request, so a generous
-    // upstream Keep-Alive header can't pin sockets open far longer than us.
-    keepAliveMaxTimeout: envInt('MIXDOG_LLM_KEEPALIVE_MAX_MS', 90_000),
-    connections: envInt('MIXDOG_LLM_CONNECTIONS', 16),
-  })
-  return _agent
-}
-
-// Origins already warmed (or warming) this process, so repeated provider
-// construction or multiple providers on the same host don't spam handshakes.
-const _preconnected = new Set()
-
-/**
- * Best-effort warm a kept-alive socket to `origin` so the first real request
- * skips the TLS handshake. Fire-and-forget: never throws, never returns a
- * pending promise the caller must await.
- *
- * @param {string} origin e.g. 'https://api.anthropic.com'
- */
-export function preconnect(origin) {
-  try {
-    // With a proxy / custom global dispatcher in play we deliberately don't own
-    // the connection pool, so there's no warm socket to seed — no-op.
-    if (proxyConfigured()) return
-    if (!origin || typeof origin !== 'string') return
-    let url
-    try { url = new URL(origin) } catch { return }
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') return
-    const key = url.origin
-    if (_preconnected.has(key)) return
-    _preconnected.add(key)
-    // A throwaway HEAD lands a pooled socket without fetching a body. Any
-    // failure (offline, DNS, 4xx/5xx) is irrelevant — the handshake is the
-    // point, and the real request will surface genuine errors.
-    undiciRequest(key, {
-      method: 'HEAD',
-      dispatcher: getLlmDispatcher(),
-      signal: AbortSignal.timeout(10_000),
-    })
-      .then((res) => res.body?.dump?.())
-      .catch(() => { /* best-effort warmup; ignore */ })
-  } catch { /* never let warmup break construction */ }
-}

package/src/shared/open-url.mjs

@@ -1,62 +0,0 @@
-import { spawn } from 'child_process';
-import { isWSL } from './wsl.mjs';
-
-/**
- * Open a URL in the user's default browser. Best-effort and non-blocking —
- * the caller always prints the URL too, so a failure here is never fatal.
- *
- * Platform dispatch (deterministic, not heuristic):
- *  - Windows: `rundll32 url.dll,FileProtocolHandler <url>` passes the URL as a
- *    single argv token, so query-string `&` separators are NOT re-parsed by a
- *    shell. The old `start "<url>"` form is broken on Windows: cmd's `start`
- *    treats the first quoted string as the WINDOW TITLE, so the URL is dropped
- *    and nothing opens.
- *  - macOS: `open <url>`.
- *  - WSL: xdg-open usually fails (no Linux GUI), so reach the Windows-HOST
- *    browser — prefer `wslview` (wslu), else `powershell.exe Start-Process`.
- *    cmd.exe `start` is deliberately NOT used: cmd re-parses URL metacharacters
- *    so a query-string `&` (e.g. `?a=1&b=2`) is treated as a command separator
- *    and the URL truncates. PowerShell's Start-Process takes the URL as one
- *    argument and does not reparse `&`; the URL is passed inside a single-quoted
- *    PowerShell literal (single quotes doubled) so `&`, spaces and quotes
- *    survive and no injection is possible. Falls back through the chain when an
- *    opener is missing.
- *  - Linux/other: `xdg-open <url>`.
- */
-export function openInBrowser(url) {
-  const u = String(url);
-  // Ordered [cmd, args] candidates. Every platform but WSL has exactly one;
-  // WSL has a fallback chain since the first opener may be absent.
-  let candidates;
-  if (process.platform === 'win32') {
-    candidates = [['rundll32', ['url.dll,FileProtocolHandler', u]]];
-  } else if (process.platform === 'darwin') {
-    candidates = [['open', [u]]];
-  } else if (isWSL()) {
-    // Single-quoted PowerShell literal: double any embedded single quote.
-    // Everything else (incl. `&`) is literal inside a single-quoted string.
-    const psUrl = `'${u.replace(/'/g, "''")}'`;
-    candidates = [
-      ['wslview', [u]],
-      ['powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `Start-Process -FilePath ${psUrl}`]],
-    ];
-  } else {
-    candidates = [['xdg-open', [u]]];
-  }
-  tryOpenCandidates(candidates, 0);
-}
-
-// Spawn candidates[index]; on spawn error (opener missing) advance to the next.
-// Always non-blocking — the caller prints the URL, so exhausting the chain is
-// never fatal.
-function tryOpenCandidates(candidates, index) {
-  if (index >= candidates.length) return;
-  const [cmd, args] = candidates[index];
-  try {
-    const child = spawn(cmd, args, { stdio: 'ignore', detached: true, windowsHide: true });
-    child.on('error', () => { tryOpenCandidates(candidates, index + 1); });
-    child.unref();
-  } catch {
-    tryOpenCandidates(candidates, index + 1);
-  }
-}

package/src/shared/plugin-paths.mjs

@@ -1,58 +0,0 @@
-/**
- * Canonical resolver for CLAUDE_PLUGIN_DATA (plugin data dir).
- *
- * Resolution order:
- *   1. process.env.CLAUDE_PLUGIN_DATA  — set by Claude Code when spawning
- *                                        the MCP server or a hook.
- *   2. Derive from CLAUDE_PLUGIN_ROOT  — supports two real layouts:
- *        cache:        .../cache/{marketplace}/{plugin}/{version}/
- *        marketplace:  .../marketplaces/{marketplace}/   (root *is* the
- *                      marketplace dir; plugin name comes from
- *                      .claude-plugin/plugin.json or DEFAULT_PLUGIN)
- *
- * Throws if neither env var is present — the plugin always runs under
- * Claude Code, which sets one of them. Callers must not silently fall
- * back to a hardcoded path.
- *
- * DEFAULT_PLUGIN / DEFAULT_MARKETPLACE are exported so a handful of
- * callers (MCP client spawning sibling plugins, session-manager building
- * PLUGIN_ROOT for rule injection) can reference the canonical names
- * without re-hardcoding the strings. Update both in lockstep with
- * `.claude-plugin/marketplace.json` if the marketplace is ever renamed.
- */
-
-import { homedir } from 'os';
-import { join, basename } from 'path';
-import { readFileSync } from 'fs';
-
-export const DEFAULT_PLUGIN = 'mixdog';
-export const DEFAULT_MARKETPLACE = 'trib-plugin';
-
-function readPluginManifestName(root) {
-  try {
-    const manifest = JSON.parse(readFileSync(join(root, '.claude-plugin', 'plugin.json'), 'utf8'));
-    if (manifest && typeof manifest.name === 'string' && manifest.name.trim()) return manifest.name.trim();
-  } catch { /* fall through to default */ }
-  return DEFAULT_PLUGIN;
-}
-
-export function resolvePluginData() {
-  if (process.env.CLAUDE_PLUGIN_DATA) return process.env.CLAUDE_PLUGIN_DATA;
-  const root = process.env.CLAUDE_PLUGIN_ROOT;
-  if (root) {
-    const dirName = basename(root);
-    // Cache layout: .../cache/{marketplace}/{plugin}/{version}/
-    if (/^\d+\.\d+\.\d+/.test(dirName)) {
-      const pluginName = basename(join(root, '..'));
-      const marketplace = basename(join(root, '..', '..'));
-      return join(homedir(), '.claude', 'plugins', 'data', `${pluginName}-${marketplace}`);
-    }
-    // Marketplace layout: .../marketplaces/{marketplace}/
-    // The root dir itself is the marketplace. Plugin name lives in the
-    // manifest; fall back to DEFAULT_PLUGIN when it's unreadable.
-    const marketplace = dirName;
-    const pluginName = readPluginManifestName(root);
-    return join(homedir(), '.claude', 'plugins', 'data', `${pluginName}-${marketplace}`);
-  }
-  throw new Error('[plugin-paths] CLAUDE_PLUGIN_DATA and CLAUDE_PLUGIN_ROOT are both unset — cannot resolve plugin data dir outside of Claude Code.');
-}

package/src/shared/schedules-store.mjs

@@ -1,70 +0,0 @@
-/**
- * Canonical reader for registered schedules.
- *
- * `${CLAUDE_PLUGIN_DATA}/schedules/<name>/` is the single source of truth.
- * Each schedule directory contains `config.json` (metadata) and
- * `instructions.md` (prompt body). Both the setup UI (POST /schedules)
- * and the `schedule-add` skill write the same two files; every reader —
- * setup-server (GET /schedules), channels/lib/config.mjs (loadConfig),
- * status/aggregator.mjs — must go through listSchedules() so a single
- * entry shape is presented everywhere.
- *
- * The legacy `mixdog-config.json` `channels.schedules.items` /
- * `channels.nonInteractive` / `channels.interactive` arrays are no longer
- * consulted. Migration: rename any legacy `prompt.md` to `instructions.md`
- * — no in-code fallback.
- */
-
-import { readFileSync, readdirSync } from 'fs';
-import { join } from 'path';
-import { resolvePluginData } from './plugin-paths.mjs';
-
-function schedulesDir() {
-  return join(resolvePluginData(), 'schedules');
-}
-
-function readJsonFile(path) {
-  try { return JSON.parse(readFileSync(path, 'utf8')); }
-  catch { return null; }
-}
-
-function readTextFile(path) {
-  try { return readFileSync(path, 'utf8'); }
-  catch { return ''; }
-}
-
-/**
- * List every registered schedule.
- *
- * Return shape per entry: `{ name, ...config, prompt }`.
- * - `name` is the directory name (slug).
- * - Spread of `config.json` keys (time/days/type/channel/model/enabled
- *   when written by the setup UI; cron/timezone/mode/role when written
- *   by the schedule-add skill).
- * - `prompt` carries `instructions.md` content (empty string when the
- *   file is missing — caller decides whether that is a hard error).
- *
- * Returns an empty array when the directory does not exist (fresh
- * install with no schedules registered yet).
- */
-export function listSchedules() {
-  const dir = schedulesDir();
-  const out = [];
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    // ENOENT (fresh install, no schedules/ yet) / EACCES -> empty list.
-    // Replaces the previous existsSync check, which was racy: the dir
-    // could disappear between existsSync and readdirSync.
-    return out;
-  }
-  for (const ent of entries) {
-    if (!ent.isDirectory()) continue;
-    const name = ent.name;
-    const cfg = readJsonFile(join(dir, name, 'config.json')) || {};
-    const prompt = readTextFile(join(dir, name, 'instructions.md'));
-    out.push({ name, ...cfg, prompt });
-  }
-  return out;
-}

package/src/shared/seed.mjs

@@ -1,136 +0,0 @@
-import { existsSync, mkdirSync, readFileSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-import { DEFAULT_PRESETS, DEFAULT_MAINTENANCE } from '../agent/orchestrator/config.mjs';
-import { writeFileAtomicSync, withFileLockSync } from './atomic-file.mjs';
-import { backupUserData, hasUserDataInitMarker, markUserDataInitialized, shouldSeedMissingUserData } from './user-data-guard.mjs';
-import { disableClaudeBuiltinsOnFirstInstall } from './disable-claude-builtins.mjs';
-
-const DEFAULTS_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'defaults');
-
-// Idempotent seed of the unified mixdog-config.json so first-time installs
-// land with the Config UI already populated with defaults (presets, search
-// scaffold, memory config) instead of presenting empty lists.
-//
-// Only plugin-owned paths under `<plugin-data>/` are seeded. User-owned
-// surfaces — global CLAUDE.md files, project repo files, etc. — are not
-// touched by seeding. `existsSync()` gates every write so a second boot
-// never overwrites user edits.
-
-//
-// Seed bodies are thunks so dynamic content (DEFAULT_PRESETS pulling
-// ANTHROPIC_DEFAULT_*_MODEL overrides at load time) resolves at seed time,
-// not at module-import time.
-const SEEDS = {
-    // Single unified config file — all sections in one JSON.
-    // Prompt injection is seeded under `channels`. New installs default to
-    // CLAUDE.md mode so the managed global rule block is authoritative from
-    // the next Claude Code session.
-    // providers/mcpServers intentionally omitted from `agent` so runtime
-    // auto-detect (buildDefaultConfig) decides based on env keys / OAuth.
-    'mixdog-config.json': () => {
-        // Template carries the static channels/memory/search defaults; agent
-        // section is composed at seed time so DEFAULT_PRESETS picks up the
-        // ANTHROPIC_DEFAULT_*_MODEL env overrides resolved at boot. Top-level
-        // key order is rebuilt explicitly so seed output stays
-        // channels/memory/agent/search regardless of template author.
-        const template = JSON.parse(
-            readFileSync(join(DEFAULTS_DIR, 'mixdog-config.template.json'), 'utf8'),
-        );
-        const composed = {
-            channels: template.channels,
-            memory: template.memory,
-            agent: {
-                presets: DEFAULT_PRESETS.map((p) => ({ ...p })),
-                maintenance: { ...DEFAULT_MAINTENANCE },
-                default: 'opus-high',
-            },
-            search: template.search,
-        };
-        return JSON.stringify(composed, null, 2) + '\n';
-    },
-    // Role→preset mapping consumed by Smart Bridge (loadResolvedRoles); without
-    // it on disk bridge roles fall back to the default preset. Baseline Lead
-    // workflow description ships alongside. Seeded HERE (not in setup-server)
-    // so this is the single first-install SSOT and the init marker is set once,
-    // after the whole default set lands.
-    'user-workflow.json': () => readFileSync(join(DEFAULTS_DIR, 'user-workflow.json'), 'utf8'),
-    'user-workflow.md': () => readFileSync(join(DEFAULTS_DIR, 'user-workflow.md'), 'utf8'),
-};
-
-export function ensureDataSeeds(dataDir) {
-    if (!dataDir) return { created: [], skipped: [] };
-    const created = [];
-    const skipped = [];
-    // Capture fresh-install state ONCE, before the loop. The per-file
-    // markUserDataInitialized() below sets the marker as soon as the first seed
-    // lands; if we re-consulted the guard per file, every SUBSEQUENT first-time
-    // seed in this same pass would be refused (treated as a post-init deletion),
-    // which is exactly how user-workflow.json could end up permanently missing.
-    // On a fresh dir we seed the whole default set; once initialized, the guard
-    // governs (never recreate a file the user deleted on purpose).
-    const freshInstall = !hasUserDataInitMarker(dataDir);
-    for (const [rel, bodyFn] of Object.entries(SEEDS)) {
-        const full = join(dataDir, rel);
-        if (existsSync(full)) {
-            markUserDataInitialized(dataDir);
-            skipped.push(rel);
-            continue;
-        }
-        if (!freshInstall && !shouldSeedMissingUserData(dataDir, rel)) {
-            skipped.push(rel);
-            continue;
-        }
-        // Body composition (template read / config build) errors are fatal —
-        // a missing defaults/ file means the plugin install itself is
-        // incomplete, and silently skipping the seed would leave the user
-        // with an empty Config UI. Filesystem errors during the actual write
-        // are non-fatal and only logged so a transient mkdir/write failure
-        // does not block boot.
-        const body = bodyFn();
-        try {
-            mkdirSync(dirname(full), { recursive: true });
-            // Re-check existence under a file lock to serialize cooperating
-            // seed writers, then use createOnly:true so the final commit
-            // step (linkSync with O_EXCL semantics) refuses to overwrite a
-            // file that a non-locking external writer (user/editor)
-            // created in between. linkSync→EEXIST is caught inside
-            // writeFileAtomicSync and reported as `false`; we treat that
-            // as a clean skip rather than an overwrite, preserving the
-            // "never overwrites user edits" invariant in the header.
-            withFileLockSync(`${full}.lock`, () => {
-                if (existsSync(full)) {
-                    markUserDataInitialized(dataDir);
-                    skipped.push(rel);
-                    return;
-                }
-                const wrote = writeFileAtomicSync(full, body, {
-                    fsyncDir: true,
-                    createOnly: true,
-                });
-                if (wrote) {
-                    markUserDataInitialized(dataDir);
-                    created.push(rel);
-                    // Fresh creation of mixdog-config.json is the first-install
-                    // signal: disable Claude Code's built-in memory/recap once
-                    // (restore snapshot captured first). Best-effort; never
-                    // breaks seeding.
-                    if (rel === 'mixdog-config.json') {
-                        disableClaudeBuiltinsOnFirstInstall();
-                    }
-                } else {
-                    skipped.push(rel);
-                }
-            });
-        } catch (e) {
-            process.stderr.write(`[seed] ${rel} create failed: ${e.message}\n`);
-        }
-    }
-    if (created.length > 0) {
-        if (process.env.MIXDOG_SETUP_QUIET !== '1') {
-            process.stderr.write(`[seed] created ${created.length} file(s): ${created.join(', ')}\n`);
-        }
-        try { backupUserData(dataDir, 'post-seed'); } catch {}
-    }
-    return { created, skipped };
-}

package/src/shared/user-cwd.mjs

@@ -1,225 +0,0 @@
-/**
- * IMPORTANT — cwd model role:
- * pwd() resolves the user's working directory for RELATIVE PATH RESOLUTION only.
- * It is NOT a sandbox boundary. Sandbox decisions are governed by Claude Code's
- * settings.json permissions govern sandbox decisions.
- */
-
-/**
- * user-cwd.mjs — shared helper to resolve the user's working directory
- * from the persisted user-cwd.txt sentinel file, with an optional
- * session-cwd override (process.env.MIXDOG_SESSION_CWD) that takes
- * precedence when set.
- *
- * Single-source-of-truth model:
- *   - captureOriginalUserCwd() reads MIXDOG_SESSION_CWD first (if set
- *     to a valid directory), otherwise user-cwd.txt fresh on every
- *     call. No in-memory freeze.
- *   - rawUserCwd() reads ONLY user-cwd.txt (no env consult) — exposed
- *     for the cwd-tool auto-init path so the env-var fallback cannot
- *     become self-referential.
- *   - AsyncLocalStorage override (runWithCwdOverride) isolates concurrent worker cwds.
- *   - pwd() = override ?? originalCwd. Hot lookups short-circuit on the
- *     override, so the no-override fallback path is cold and per-call
- *     disk reads of user-cwd.txt are negligible.
- */
-
-import { AsyncLocalStorage } from 'async_hooks'
-import { readFileSync, statSync, writeFileSync } from 'fs'
-import { join, resolve } from 'path'
-import { homedir } from 'os'
-
-const _cwdOverride = new AsyncLocalStorage()
-
-// process.cwd() is the server's LAUNCH directory. In daemon mode that IS
-// CLAUDE_PLUGIN_ROOT (the plugin install/cache root), so using it as a
-// relative-path base silently resolves into the DEPLOYED plugin copy instead
-// of the user's working tree — the exact cause of stale reads in a worker that
-// inherited no explicit cwd. Treat that one case as "no usable cwd" and fall
-// back to the home dir: a missing session signal then surfaces as ENOENT
-// (absolute paths required) rather than a silent stale read. Invariant check
-// (exact path equality with the known root), not a path-substring heuristic.
-export function _safeProcessCwd() {
-  const cwd = process.cwd()
-  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT
-  if (pluginRoot) {
-    try { if (resolve(cwd) === resolve(pluginRoot)) return homedir() } catch { /* fall through to cwd */ }
-  }
-  return cwd
-}
-
-// Hook payloads can deliver POSIX paths on Windows (e.g. `/c/Project`); Node's
-// path.resolve does not map MSYS-style drive prefixes, so the value must be
-// rewritten to the platform-native shape before path resolution.
-function _normalizePlatformCwd(p) {
-  if (!p || typeof p !== 'string') return p
-  if (process.platform !== 'win32') return resolve(p)
-  // Map all three POSIX drive-prefix shapes to native Windows paths before
-  // resolution, aligned with path-utils.mjs posixPathToWindowsPath:
-  //   /cygdrive/c/... (Cygwin), /mnt/c/... (WSL), /c/... (MSYS/Git-Bash) → C:\...
-  // Cygwin/WSL prefixes must be tested before the bare single-letter form
-  // because their slice offsets differ.
-  const cyg = p.match(/^\/cygdrive\/([a-zA-Z])\//)
-  const wsl = p.match(/^\/mnt\/([a-zA-Z])\//)
-  let native = p
-  if (cyg) native = `${cyg[1].toUpperCase()}:\\${p.slice(11).replace(/\//g, '\\')}`
-  else if (wsl) native = `${wsl[1].toUpperCase()}:\\${p.slice(7).replace(/\//g, '\\')}`
-  else {
-    const m = p.match(/^[\/\\]([a-zA-Z])[\/\\](.*)$/)
-    if (m) native = `${m[1].toUpperCase()}:\\${m[2].replace(/\//g, '\\')}`
-  }
-  return resolve(native)
-}
-
-/**
- * Resolve the session cwd from EXPLICIT signals only:
- *   1. process.env.MIXDOG_SESSION_CWD — session-level override set via
- *      the `cwd` MCP tool. Honoured only when non-empty AND the resolved
- *      directory actually exists.
- *   2. user-cwd.txt — single source of truth maintained by claude-code
- *      (rewritten at every session start).
- * Returns null when neither is available.
- *
- * Unlike captureOriginalUserCwd()/pwd(), this NEVER falls back to
- * process.cwd(): the server's launch directory is not a session signal,
- * and letting it leak into PROJECT CLASSIFICATION (resolveProjectScope)
- * would misclassify rows under the service/plugin cwd. Use this for
- * project_id resolution; use pwd() for relative-path resolution.
- */
-export function explicitSessionCwd() {
-  const sessionRaw = process.env.MIXDOG_SESSION_CWD
-  if (typeof sessionRaw === 'string' && sessionRaw.length > 0) {
-    const normalized = _normalizePlatformCwd(sessionRaw)
-    if (normalized) {
-      try {
-        const st = statSync(normalized)
-        if (st.isDirectory()) return normalized
-      } catch { /* fall through to user-cwd.txt */ }
-    }
-  }
-  try {
-    const txt = readFileSync(join(process.env.CLAUDE_PLUGIN_DATA || '', 'user-cwd.txt'), 'utf8').trim()
-    return (txt && _normalizePlatformCwd(txt)) || null
-  } catch {
-    return null
-  }
-}
-
-/**
- * Resolve the Claude Code SESSION ENTRY root from CLAUDE_PROJECT_DIR — the
- * directory the user launched Claude Code in, injected by the host on every
- * run. This is an explicit host-provided invariant (not a heuristic guess),
- * so it is the correct relative-path base when no session cwd has been set
- * yet AND user-cwd.txt is unwritten (e.g. a hook fired with an empty
- * _event.cwd). Returns null when the var is absent or not a live directory,
- * so callers chain it ahead of the process.cwd() last resort.
- */
-function startRootCwd() {
-  const dir = process.env.CLAUDE_PROJECT_DIR
-  if (typeof dir === 'string' && dir.length > 0) {
-    const normalized = _normalizePlatformCwd(dir)
-    if (normalized) {
-      try {
-        if (statSync(normalized).isDirectory()) return normalized
-      } catch { /* not a live directory — fall through */ }
-    }
-  }
-  return null
-}
-
-/**
- * Resolve the user's current working directory for RELATIVE PATH
- * RESOLUTION. Same explicit precedence as explicitSessionCwd(), then the
- * session-entry root (CLAUDE_PROJECT_DIR), with process.cwd() as the final
- * fallback when no explicit session cwd exists.
- *
- * Read fresh on every call: hot lookups inside a worker are short-
- * circuited by runWithCwdOverride AsyncLocalStorage long before reaching
- * this function, so the no-override fallback path is cold and per-call
- * disk reads are negligible.
- */
-export function captureOriginalUserCwd() {
-  return explicitSessionCwd() ?? startRootCwd() ?? _safeProcessCwd()
-}
-
-/**
- * Read the user-cwd.txt sentinel directly, with NO env-var consult.
- * Used by the cwd-tool auto-init path to avoid self-reference when
- * deciding whether to seed MIXDOG_SESSION_CWD from disk.
- */
-export function rawUserCwd() {
-  try {
-    const txt = readFileSync(join(process.env.CLAUDE_PLUGIN_DATA || '', 'user-cwd.txt'), 'utf8').trim()
-    return _normalizePlatformCwd(txt) || startRootCwd() || _safeProcessCwd()
-  } catch {
-    return startRootCwd() ?? _safeProcessCwd()
-  }
-}
-
-/**
- * Path of the persisted last-session-cwd sentinel, KEYED by the supervisor
- * (run-mcp) PID injected as MIXDOG_SUPERVISOR_PID. The supervisor is one
- * per terminal/MCP client and is preserved across a dev-sync child restart
- * (only the child is killed + respawned), so its PID is a stable, per-
- * terminal key that survives the restart. Keying by it makes the restore
- * multi-terminal safe: terminal A's `cwd set` writes session-cwd-<pidA>.txt
- * and terminal B writes session-cwd-<pidB>.txt, so a restart in one terminal
- * can never restore the other terminal's cwd. When no supervisor PID is
- * present (direct launch with no respawn lifecycle) a single 'solo' file is
- * used — there is no cross-restart key in that mode, matching the absence of
- * a respawning supervisor.
- */
-function _lastSessionCwdFile(keyPid) {
-  // Explicit keyPid (a connection's leadPid in daemon mode) wins; otherwise
-  // fall back to this process's MIXDOG_SUPERVISOR_PID. Under the shared daemon
-  // a single process serves N terminals, so keying writes by the per-connection
-  // leadPid is what keeps one terminal's `cwd set` out of another's sentinel.
-  const raw = (keyPid != null && keyPid !== '') ? String(keyPid) : process.env.MIXDOG_SUPERVISOR_PID
-  const key = (typeof raw === 'string' && /^\d+$/.test(raw)) ? raw : 'solo'
-  return join(process.env.CLAUDE_PLUGIN_DATA || '', `session-cwd-${key}.txt`)
-}
-
-/**
- * Best-effort persist the last session cwd to disk (keyed per supervisor —
- * see _lastSessionCwdFile) so the respawned child of the SAME terminal can
- * restore it. Errors are swallowed — a convenience signal, not a contract.
- */
-export function writeLastSessionCwd(cwd, keyPid) {
-  try {
-    writeFileSync(_lastSessionCwdFile(keyPid), String(cwd))
-  } catch { /* best-effort */ }
-}
-
-/**
- * Read the persisted last session cwd for THIS terminal (keyed per supervisor
- * PID). Returns the normalized path only when the directory still exists;
- * otherwise null. Consulted by the boot-time cwd auto-init (server-main.mjs)
- * ahead of the user-cwd.txt seed so the last `cwd set` survives a dev-sync
- * child restart that dropped MIXDOG_SESSION_CWD.
- */
-export function readLastSessionCwd(keyPid) {
-  try {
-    const content = readFileSync(_lastSessionCwdFile(keyPid), 'utf8')
-    const normalized = _normalizePlatformCwd(content.trim())
-    if (normalized && statSync(normalized).isDirectory()) return normalized
-    return null
-  } catch {
-    return null
-  }
-}
-
-/**
- * Run fn inside an async context where pwd() returns cwd.
- * All descendant async calls within fn see cwd as their working directory.
- */
-export function runWithCwdOverride(cwd, fn) {
-  return _cwdOverride.run(cwd, fn)
-}
-
-/**
- * Current effective working directory:
- *   override set by runWithCwdOverride (innermost wins) ?? original user cwd.
- */
-export function pwd() {
-  return _cwdOverride.getStore() ?? captureOriginalUserCwd()
-}