mixdog 0.7.18 → 0.8.0

package/src/search/tool-defs.mjs

@@ -1,83 +0,0 @@
-import { z } from 'zod'
-import { zodToJsonSchema } from 'zod-to-json-schema'
-
-const crawlArgsSchema = z.object({
-  url: z.string().url().describe('Starting URL to begin crawling from.'),
-  maxPages: z.number().int().min(1).max(200).optional().describe('Maximum number of pages to visit (1-200).'),
-  maxDepth: z.number().int().min(0).max(5).optional().describe('Maximum link depth to follow (0-5).'),
-  sameDomainOnly: z.boolean().optional().describe('If true, only follow links on the same domain.'),
-})
-
-function buildInputSchema(zodSchema) {
-  const jsonSchema = zodToJsonSchema(zodSchema, { target: 'openApi3' })
-  delete jsonSchema.$schema
-  return jsonSchema
-}
-
-export const TOOL_DEFS = [
-  {
-    name: 'search',
-    title: 'Mixdog Web Search',
-    description: 'Web search (SERP) for external/current info. Requires query (string|array). Snippets+URLs; web_fetch for bodies.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        query: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }] },
-        site: { type: 'string' },
-        type: { type: 'string', enum: ['web', 'news', 'images'] },
-        maxResults: { type: 'number', minimum: 1, maximum: 20 },
-        locale: {
-          anyOf: [
-            { type: 'string' },
-            {
-              type: 'object',
-              properties: {
-                country: { type: 'string' },
-                language: { type: 'string' },
-                region: { type: 'string' },
-                city: { type: 'string' },
-                timezone: { type: 'string' },
-              },
-              additionalProperties: false,
-            },
-          ],
-        },
-        contextSize: { type: 'string', enum: ['low', 'medium', 'high'] },
-      },
-      required: ['query'],
-      additionalProperties: false,
-    },
-    annotations: { title: 'Mixdog Web Search', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
-  },
-  {
-    name: 'web_fetch',
-    title: 'Mixdog Web Fetch',
-    description: 'Fetch full page body from a URL (web page, article, docs). Requires url. Use after search to read a result.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        url: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }] },
-        startIndex: { type: 'number', minimum: 0 },
-        maxLength: { type: 'number', minimum: 0 },
-      },
-      required: ['url'],
-      additionalProperties: false,
-    },
-    annotations: { title: 'Mixdog Web Fetch', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
-  },
-  {
-    name: 'crawl',
-    title: 'Crawl',
-    public: false,
-    description: 'Crawl a website starting from a URL, following links up to a configured depth. Collects page summaries from each visited page.',
-    inputSchema: buildInputSchema(crawlArgsSchema),
-    annotations: { title: 'Crawl', readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },
-  },
-  {
-    name: 'setup',
-    public: false,
-    description: 'Open interactive setup form to configure search providers, API keys, and options.',
-    inputSchema: { type: 'object', properties: {} },
-    annotations: { title: 'Setup' },
-  },
-]

package/src/setup/defender-exclusion.mjs

@@ -1,183 +0,0 @@
-// Windows Defender exclusion auto-registration.
-//
-// On Windows, NTFS file read latency on ~/.claude/plugins (cache + node_modules
-// + 1.5GB ONNX model) and ~/.claude/projects (CC transcript jsonl) is heavily
-// affected by Defender real-time scanning. AV stalls have been observed to
-// produce multi-minute readFileSync hangs in the read tool, blocking mcp
-// dispatch. Adding both directories to the Defender exclusion list removes
-// the scan-on-access cost.
-//
-// Invariant: paths required for hot mcp / memory / transcript IO must be
-// excluded from real-time AV scanning. When not excluded, trigger an
-// elevated PowerShell once per 24h to request the user's UAC approval.
-// The 24h cooldown prevents UAC spam if the user declines.
-//
-// Non-Windows platforms: no-op (other AV solutions handled elsewhere).
-
-import os from 'os'
-import fs from 'fs'
-import path from 'path'
-import { spawn, spawnSync } from 'child_process'
-import { randomBytes } from 'crypto'
-
-const COOLDOWN_MS = 24 * 60 * 60 * 1000
-const TRIGGER_DELAY_MS = 5000  // let boot logs settle before UAC popup
-
-function _wantedPaths() {
-  const home = os.homedir()
-  return [
-    path.join(home, '.claude', 'plugins'),
-    path.join(home, '.claude', 'projects'),
-  ]
-}
-
-function _readFlag(flagPath) {
-  try { return JSON.parse(fs.readFileSync(flagPath, 'utf-8')) }
-  catch { return null }
-}
-
-function _writeFlag(flagPath, payload) {
-  try { fs.writeFileSync(flagPath, JSON.stringify({ ...payload, checkedAt: Date.now() })) }
-  catch { /* best-effort */ }
-}
-
-function _currentExclusions() {
-  // Get-MpPreference reads exclusions without elevation.
-  const r = spawnSync('powershell', [
-    '-NoProfile', '-NonInteractive', '-Command',
-    'Get-MpPreference | Select-Object -ExpandProperty ExclusionPath',
-  ], { encoding: 'utf8', timeout: 5000, windowsHide: true })
-  if (r.status !== 0) return null
-  return (r.stdout || '').split(/\r?\n/).map(s => s.trim()).filter(Boolean)
-}
-
-function _allCovered(existing, want) {
-  const lower = existing.map(s => s.toLowerCase())
-  return want.every(p => {
-    const pl = p.toLowerCase()
-    return lower.some(e => pl === e || pl.startsWith(e + path.sep.toLowerCase()))
-  })
-}
-
-function _triggerElevatedAdd(want) {
-  // Write a temp .ps1 file with the Add-MpPreference commands, then launch it
-  // elevated via Start-Process -Verb RunAs. Using a file avoids the nested
-  // quote-escaping mess of inlining everything on the command line.
-  //
-  // Security:
-  //  - The .ps1 is the body that will run *elevated*, so it's a juicy
-  //    TOCTOU target: a predictable per-pid filename in os.tmpdir() is
-  //    user-writable from any other process running as the same user
-  //    (or under a writable %TEMP% on shared hosts), and the original
-  //    code never deleted it — leaving a tamper window between write
-  //    and UAC-prompted execution.
-  //  - Mitigation: create a fresh randomized subdirectory under tmpdir
-  //    (mkdtempSync gives us an exclusive directory; on POSIX it's
-  //    0o700, on Windows the per-user temp ACL governs), write the
-  //    .ps1 there with 0o600, chain a deletion command into the
-  //    elevated script so the privileged side removes it after use,
-  //    and best-effort rmdir the wrapper dir after the spawn returns.
-  //  - Residual risk (intentionally unmitigated — fundamental OS
-  //    limit, not a defect): a hostile process running as THE SAME
-  //    USER can still race the file between fs.writeFileSync and
-  //    Start-Process consuming it (or replace the dir+file after we
-  //    spawn powershell.exe but before UAC consents). The 0o600 / per-
-  //    user-temp-ACL boundary only protects against OTHER users; the
-  //    same-user attacker already has our token, can read this very
-  //    .mjs, and can directly call Add-MpPreference via their own
-  //    Start-Process -Verb RunAs — exploiting *us* offers no privilege
-  //    they did not already have. No same-user mitigation (chmod
-  //    games, signing the .ps1, hashing-then-verifying in the elevated
-  //    wrapper) actually closes this — the verifier itself runs from
-  //    the same user-writable tree. Adding such a check would be
-  //    security theatre; intentionally not implemented. The TOCTOU
-  //    fixes above target the cross-user / world-writable-tmp class,
-  //    which IS a real and closable gap.
-  const escapePath = p => p.replace(/'/g, "''")
-  let tmpDir
-  try {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mixdog-defender-'))
-  } catch { return false }
-  const tmpPs1 = path.join(tmpDir, `run-${randomBytes(8).toString('hex')}.ps1`)
-  const addLines = want.map(p => `Add-MpPreference -ExclusionPath '${escapePath(p)}'`).join('\n')
-  // Self-delete at the tail of the elevated script so the .ps1 doesn't
-  // outlive its single intended execution. `Remove-Item -Force` runs
-  // inside the same elevated PowerShell that read the file, so even if
-  // the wrapper dir was somehow locked we still get the file cleaned.
-  const script =
-    addLines + '\n' +
-    `try { Remove-Item -LiteralPath '${escapePath(tmpPs1)}' -Force -ErrorAction SilentlyContinue } catch {}\n`
-  try {
-    fs.writeFileSync(tmpPs1, script, { encoding: 'utf-8', mode: 0o600 })
-  } catch {
-    try { fs.rmSync(tmpDir, { recursive: true, force: true }) } catch {}
-    return false
-  }
-  // Spawn detached so the parent process exits cleanly even if the user takes
-  // a while to click through the UAC prompt.
-  const child = spawn('powershell', [
-    '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-Command',
-    `Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-WindowStyle','Hidden','-File','${tmpPs1.replace(/'/g, "''")}'`,
-  ], { detached: true, stdio: 'ignore', windowsHide: true })
-  // Detached + stdio:'ignore' means an ENOENT (powershell missing) or
-  // EPERM would normally surface as an unhandled 'error' event and
-  // crash the process. Swallow it; the manualCmd log line is the
-  // fallback path the user already sees.
-  child.on('error', () => {})
-  child.unref()
-  // Best-effort: schedule a wrapper-dir cleanup after the elevated
-  // script has had a chance to run. We can't synchronously wait for
-  // UAC (could be minutes if the user is AFK), so leave a long delay
-  // and a recursive rmSync; the elevated script already removed the
-  // .ps1 itself by then.
-  setTimeout(() => {
-    try { fs.rmSync(tmpDir, { recursive: true, force: true }) } catch {}
-  }, 10 * 60 * 1000).unref?.()
-  return true
-}
-
-export function maybeRequestDefenderExclusion(pluginDataDir, log = () => {}) {
-  if (process.platform !== 'win32') return
-  if (!pluginDataDir) return
-  const flagPath = path.join(pluginDataDir, 'defender-exclusion-checked.json')
-  const prev = _readFlag(flagPath)
-  if (prev && typeof prev.checkedAt === 'number' && Date.now() - prev.checkedAt < COOLDOWN_MS) {
-    return  // recent attempt; respect cooldown
-  }
-
-  const want = _wantedPaths()
-  const existing = _currentExclusions()
-  // Distinguish "known-missing" from "unknown" (Get-MpPreference timed out,
-  // returned non-zero, or PowerShell was unavailable). An unknown read
-  // result must NOT trigger a UAC elevation — the exclusions might already
-  // be in place, and prompting on every transient read failure is the
-  // exact UAC spam the cooldown was added to avoid. On unknown, skip this
-  // attempt without writing the cooldown flag so the next boot retries.
-  if (existing === null) {
-    log('[defender] could not read current exclusions (Get-MpPreference unavailable/timed out) — skipping UAC prompt; will retry on next boot')
-    return
-  }
-  if (_allCovered(existing, want)) {
-    _writeFlag(flagPath, { status: 'already-excluded', want })
-    log('[defender] paths already excluded from real-time AV scan')
-    return
-  }
-
-  // Surface the missing exclusion BEFORE attempting the UAC prompt so the
-  // user sees both the auto-trigger and a manual fallback even if they
-  // decline UAC or run on a locked-down host. This is the highest-leverage
-  // I/O fix on Windows (multi-minute readFileSync stalls when scanning hot
-  // paths), so make it impossible to miss in supervisor.log.
-  const manualCmd = want.map(p => `Add-MpPreference -ExclusionPath '${p.replace(/'/g, "''")}'`).join('; ')
-  log('[defender] MISSING exclusions for hot IO paths: ' + want.join(', '))
-  log('[defender] manual fallback (elevated PowerShell, copy/paste):')
-  log('[defender]   ' + manualCmd)
-
-  // Delay so boot logs flush before the UAC prompt steals focus.
-  setTimeout(() => {
-    const ok = _triggerElevatedAdd(want)
-    if (ok) log('[defender] UAC requested — if you decline, run the manual command above')
-    else log('[defender] failed to write trigger script — use the manual command above')
-  }, TRIGGER_DELAY_MS)
-  _writeFlag(flagPath, { status: 'triggered', want })
-}