mixdog 0.7.18 → 0.8.0

package/src/runtime/channels/tool-defs.mjs

@@ -0,0 +1,177 @@
+export const TOOL_DEFS = [
+  {
+    name: "reply",
+    title: "Discord Reply",
+    annotations: { title: "Discord Reply", readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    description: "Send a reply/message to a configured channel. Requires chat_id and text; files are local paths to attach.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", description: "Target channel/chat id from the channel context." },
+        text: { type: "string", description: "Message text to send." },
+        reply_to: { type: "string", description: "Optional message id to reply to." },
+        files: {
+          type: "array",
+          items: { type: "string" },
+          description: "Local file paths to attach."
+        },
+        embeds: {
+          type: "array",
+          items: { type: "object", additionalProperties: true },
+          description: "Discord embed payloads."
+        },
+        components: {
+          type: "array",
+          items: { type: "object", additionalProperties: true },
+          description: "Discord component payloads."
+        }
+      },
+      required: ["chat_id", "text"]
+    }
+  },
+  {
+    name: "react",
+    title: "Reaction",
+    annotations: { title: "Reaction", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    description: "Add an emoji reaction to an existing channel message.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", description: "Target channel/chat id." },
+        message_id: { type: "string", description: "Message id to react to." },
+        emoji: { type: "string", description: "Emoji name or Unicode emoji." }
+      },
+      required: ["chat_id", "message_id", "emoji"]
+    }
+  },
+  {
+    name: "edit_message",
+    title: "Edit Message",
+    annotations: { title: "Edit Message", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    description: "Edit a bot-authored channel message. Requires chat_id, message_id, and replacement text.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", description: "Target channel/chat id." },
+        message_id: { type: "string", description: "Bot message id to edit." },
+        text: { type: "string", description: "Replacement message text." },
+        embeds: {
+          type: "array",
+          items: { type: "object", additionalProperties: true },
+          description: "Replacement Discord embed payloads."
+        },
+        components: {
+          type: "array",
+          items: { type: "object", additionalProperties: true },
+          description: "Replacement Discord component payloads."
+        }
+      },
+      required: ["chat_id", "message_id", "text"]
+    }
+  },
+  {
+    name: "download_attachment",
+    title: "Download Attachment",
+    annotations: { title: "Download Attachment", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    description: "Download attachments from a channel message. Requires chat_id and message_id.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", description: "Source channel/chat id." },
+        message_id: { type: "string", description: "Message id containing attachments." }
+      },
+      required: ["chat_id", "message_id"]
+    }
+  },
+  {
+    name: "fetch",
+    title: "Fetch",
+    annotations: { title: "Fetch", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    description: "Discord-only: fetch recent messages from a Discord channel. Requires channel (id); optional limit (count). NOT for URLs or web pages — use web_fetch for those.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        channel: { type: "string", description: "Discord channel id." },
+        limit: { type: "number", description: "Maximum recent messages to return." }
+      },
+      required: ["channel"]
+    }
+  },
+  {
+    name: "schedule_status",
+    title: "Schedule Status",
+    annotations: { title: "Schedule Status", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    description: "Show configured schedules and their current status.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false
+    }
+  },
+  {
+    name: "trigger_schedule",
+    title: "Trigger Schedule",
+    annotations: { title: "Trigger Schedule", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    description: "Run a configured scheduled task immediately by name. Requires name.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Schedule name." }
+      },
+      required: ["name"]
+    }
+  },
+  {
+    name: "schedule_control",
+    title: "Schedule Control",
+    annotations: { title: "Schedule Control", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    description: 'Defer or skip a schedule without running it now: action=defer pushes by minutes; action=skip_today skips the next run today. Requires name and action.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Schedule name." },
+        action: { type: "string", enum: ["defer", "skip_today"], description: "Schedule control action." },
+        minutes: { type: "number", description: "Minutes to defer when action=defer." }
+      },
+      required: ["name", "action"]
+    }
+  },
+  {
+    name: "activate_channel_bridge",
+    title: "Activate Channel Bridge",
+    annotations: { title: "Activate Channel Bridge", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    description: "Enable or disable channel bridge forwarding.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        active: { type: "boolean", description: "true to activate forwarding, false to deactivate." }
+      },
+      required: ["active"]
+    }
+  },
+  // memory and recall_memory tools are now provided by memory-service.mjs via MCP
+  {
+    name: "reload_config",
+    title: "Reload Config",
+    annotations: { title: "Reload Config", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    description: "Reload channel/runtime configuration from disk.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    name: "inject_command",
+    title: "Inject Mixdog Slash Command",
+    annotations: { title: "Inject Mixdog Slash Command", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    description: "Inject a supported Mixdog slash command into the active channel/session.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: {
+          type: "string",
+          enum: ["reload-plugins", "clear"],
+          description: "Slash command to inject."
+        }
+      },
+      required: ["command"]
+    }
+  }
+];

package/src/runtime/lib/keychain-cjs.cjs

@@ -0,0 +1,289 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const { resolvePluginData } = require('./plugin-paths.cjs');
+
+const SERVICE = 'mixdog';
+// Shared bound for every synchronous keychain backend (DPAPI/PowerShell on
+// Windows, security(1) on macOS). A single env override keeps them consistent.
+const KEYCHAIN_TIMEOUT_MS = Number(process.env.MIXDOG_KEYCHAIN_TIMEOUT_MS || 15000);
+const POWERSHELL_TIMEOUT_MS = KEYCHAIN_TIMEOUT_MS;
+
+// CommonJS module: cannot import the ESM src/shared/wsl.mjs, so inline an
+// equivalent WSL check (process.platform reports 'linux' inside WSL).
+function isWSL() {
+    if (process.platform !== 'linux') return false;
+    if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) return true;
+    try { return /microsoft|wsl/i.test(fs.readFileSync('/proc/version', 'utf8')); }
+    catch { return false; }
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function platform() {
+    return process.platform;
+}
+
+function run(cmd, args, opts) {
+    // windowsHide + stdio:['ignore','pipe','pipe'] keeps powershell.exe
+    // consoleless during DPAPI ops. Without these flags every keychain
+    // read/write flashes a conhost window: setup-html's loaders call
+    // /agent/config and /memory/auth, and each credential probe can trigger
+    // one powershell.exe spawn — users saw 8-15 console flashes during
+    // config-UI page load.
+    // Default opts go BEFORE the spread so callers can still override.
+    const result = spawnSync(cmd, args, {
+        encoding: 'utf8',
+        shell: false,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        ...opts,
+    });
+    return result;
+}
+
+// PS 5.1(powershell.exe) first: pwsh(PS 7) does not auto-load ProtectedData assembly,
+// so DPAPI calls silently fail there. Windows always ships powershell.exe.
+function powershell(script) {
+    // Bound DPAPI PowerShell calls with a timeout: a hung powershell.exe
+    // (AV scan stall, profile loader, transient cert chain lookup) would
+    // otherwise block hook/server callers synchronously. The default is long
+    // enough for cold PowerShell startup on Windows without silently dropping
+    // setup UI credential saves.
+    // Resolve powershell.exe to its deterministic System32 location rather than
+    // a PATH lookup, so a shadow `powershell.exe` earlier in PATH cannot hijack
+    // secret encryption/decryption. (pwsh/PS7 is intentionally not used: it does
+    // not auto-load the ProtectedData assembly, so DPAPI silently fails there.)
+    const _sysRoot = process.env.SystemRoot || process.env.windir;
+    if (!_sysRoot) {
+        throw new Error('[keychain] cannot resolve SystemRoot to locate powershell.exe for DPAPI');
+    }
+    const _psHosts = [path.join(_sysRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')];
+    let timedOut = null;
+    for (const exe of _psHosts) {
+        const r = run(exe, ['-NonInteractive', '-NoProfile', '-Command', script], { timeout: POWERSHELL_TIMEOUT_MS });
+        if (r.error && r.error.code === 'ENOENT') continue;
+        if (r.error && r.error.code === 'ETIMEDOUT') {
+            timedOut = { exe, timeoutMs: POWERSHELL_TIMEOUT_MS };
+            continue;
+        }
+        return r;
+    }
+    if (timedOut) {
+        throw new Error(`[keychain] PowerShell DPAPI command timed out after ${timedOut.timeoutMs}ms (last host: ${timedOut.exe})`);
+    }
+    const err = new Error('[keychain] PowerShell not found (tried powershell, pwsh)');
+    throw err;
+}
+
+function secretsDir() {
+    return path.join(resolvePluginData(), 'secrets');
+}
+
+function dpApiFile(account) {
+    return path.join(secretsDir(), account + '.dpapi');
+}
+
+// ---------------------------------------------------------------------------
+// darwin — security(1)
+// ---------------------------------------------------------------------------
+
+// Bound security(1) calls so a stuck Keychain prompt (locked keychain, GUI
+// unlock dialog with no display) cannot block hook/server callers forever —
+// matching the Windows DPAPI and Linux keytar timeouts.
+function darwinRun(args) {
+    const r = run('security', args, { timeout: KEYCHAIN_TIMEOUT_MS });
+    if (r.error && r.error.code === 'ETIMEDOUT') {
+        throw new Error(`[keychain] security command timed out after ${KEYCHAIN_TIMEOUT_MS}ms`);
+    }
+    return r;
+}
+
+function darwinGet(account) {
+    const r = darwinRun(['find-generic-password', '-a', account, '-s', SERVICE, '-w']);
+    if (r.status !== 0) return null;
+    return r.stdout.trimEnd();
+}
+
+function darwinSet(account, value) {
+    const r = darwinRun(['add-generic-password', '-a', account, '-s', SERVICE, '-w', value, '-U']);
+    if (r.status !== 0) throw new Error(`[keychain] security set failed: ${r.stderr || r.stdout}`);
+}
+
+function darwinDelete(account) {
+    const r = darwinRun(['delete-generic-password', '-a', account, '-s', SERVICE]);
+    if (r.status !== 0) throw new Error(`[keychain] security delete failed: ${r.stderr || r.stdout}`);
+}
+
+// ---------------------------------------------------------------------------
+// linux/WSL — keytar (libsecret binding, optionalDependency)
+// ---------------------------------------------------------------------------
+// keytar must be installed: npm install keytar (requires libsecret-dev on
+// Debian/Ubuntu, or libsecret on other distros). If not installed, every
+// call throws immediately — silent credential loss is not permitted.
+
+let _keytarMod = null;
+function loadKeytar() {
+    if (_keytarMod !== null) return _keytarMod;
+    try { _keytarMod = require('keytar'); }
+    catch {
+        throw new Error(
+            '[keychain] keytar is not installed — run: npm install keytar\n' +
+            '  Requires libsecret-dev (Debian/Ubuntu) or libsecret (other distros).\n' +
+            '  Cannot access credentials on this platform without it.' +
+            (isWSL()
+                ? '\n  Detected WSL: there is usually no Secret Service here; ' +
+                  'set the relevant MIXDOG_*/PROVIDER_API_KEY env var instead.'
+                : '')
+        );
+    }
+    return _keytarMod;
+}
+
+// keytar is Promise-based; bridge to sync via spawnSync of a child Node process.
+// Avoids Atomics.wait on main thread (which hangs when SAB is not forwarded to worker).
+function keytarSync(method, ...args) {
+    loadKeytar(); // throws if not installed — before spawning child
+    const { spawnSync } = require('child_process');
+    // Pass service/account/value via env to avoid shell injection entirely.
+    const env = {
+        ...process.env,
+        _KEYTAR_METHOD: method,
+        _KEYTAR_ARGS: JSON.stringify(args),
+    };
+    const script = [
+        'const kt = require("keytar");',
+        'const method = process.env._KEYTAR_METHOD;',
+        'const args = JSON.parse(process.env._KEYTAR_ARGS);',
+        'kt[method](...args)',
+        '  .then(v => { process.stdout.write(JSON.stringify({ ok: true, value: v })); })',
+        '  .catch(e => { process.stdout.write(JSON.stringify({ ok: false, error: e.message })); });',
+    ].join(' ');
+    const r = spawnSync(process.execPath, ['-e', script], {
+        env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 5000,
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    if (r.error) throw new Error(`[keychain] keytar.${method} spawnSync failed: ${r.error.message}`);
+    if (r.status !== 0) {
+        const detail = (r.stderr || '').trim() || `exit ${r.status}`;
+        throw new Error(`[keychain] keytar.${method} child exited with error: ${detail}`);
+    }
+    let parsed;
+    try { parsed = JSON.parse(r.stdout); } catch {
+        throw new Error(`[keychain] keytar.${method} child returned unparseable output: ${String(r.stdout).slice(0, 200)}`);
+    }
+    if (!parsed.ok) throw new Error(`[keychain] keytar.${method} failed: ${parsed.error}`);
+    return parsed.value ?? null;
+}
+
+function linuxGet(account) {
+    return keytarSync('getPassword', SERVICE, account);
+}
+
+function linuxSet(account, value) {
+    keytarSync('setPassword', SERVICE, account, value);
+}
+
+function linuxDelete(account) {
+    keytarSync('deletePassword', SERVICE, account);
+}
+
+// ---------------------------------------------------------------------------
+// win32 — DPAPI via PowerShell
+// ---------------------------------------------------------------------------
+
+// Add-Type loads System.Security on PS 5.1 hosts where the assembly is not
+// auto-loaded — ProtectedData/DataProtectionScope resolve to TypeNotFound
+// otherwise, and the host returns exit 0 with empty stdout, which then falls
+// through win32Set's empty-output guard. PS 7+ already has the type loaded;
+// SilentlyContinue covers the benign "already loaded" case on repeat calls.
+const PS_PROTECT = [
+    'Add-Type -AssemblyName System.Security -ErrorAction SilentlyContinue;',
+    '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;',
+    '$value = $args[0];',
+    '$bytes = [System.Text.Encoding]::UTF8.GetBytes($value);',
+    '$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser;',
+    '$enc = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, $scope);',
+    '[Convert]::ToBase64String($enc)',
+].join(' ');
+
+const PS_UNPROTECT = [
+    'Add-Type -AssemblyName System.Security -ErrorAction SilentlyContinue;',
+    '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;',
+    '$b64 = $args[0];',
+    '$enc = [Convert]::FromBase64String($b64);',
+    '$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser;',
+    '$dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, $scope);',
+    '[System.Text.Encoding]::UTF8.GetString($dec)',
+].join(' ');
+
+function win32Get(account) {
+    const file = dpApiFile(account);
+    if (!fs.existsSync(file)) return null;
+    const b64 = fs.readFileSync(file, 'utf8').trim();
+    if (!b64) throw new Error(`[keychain] DPAPI ciphertext file is empty: ${file}`);
+    const r = powershell(`& { ${PS_UNPROTECT} } '${b64}'`);
+    if (r.status !== 0) throw new Error(`[keychain] DPAPI decrypt failed (exit ${r.status}): ${r.stderr || r.stdout}`);
+    const out = (r.stdout || '').trim();
+    if (!out) throw new Error(`[keychain] DPAPI decrypt returned empty output (stderr: ${(r.stderr || '').trim()})`);
+    return out;
+}
+
+function win32Set(account, value) {
+    const dir = secretsDir();
+    fs.mkdirSync(dir, { recursive: true });
+    // Pass value as a PS argument via -Command inline to avoid shell injection;
+    // value is embedded as a PS single-quoted string literal with ' escaped.
+    const escaped = value.replace(/'/g, "''");
+    const r = powershell(`& { ${PS_PROTECT} } '${escaped}'`);
+    if (r.status !== 0) throw new Error(`[keychain] DPAPI encrypt failed (exit ${r.status}): ${r.stderr || r.stdout}`);
+    const out = (r.stdout || '').trim();
+    if (!out) throw new Error(`[keychain] DPAPI encrypt returned empty output (stderr: ${(r.stderr || '').trim()})`);
+    fs.writeFileSync(dpApiFile(account), out, 'utf8');
+}
+
+function win32Delete(account) {
+    const file = dpApiFile(account);
+    if (!fs.existsSync(file)) throw new Error(`[keychain] secret not found: ${account}`);
+    fs.unlinkSync(file);
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+function getSecret(account) {
+    switch (platform()) {
+        case 'darwin': return darwinGet(account);
+        case 'linux':  return linuxGet(account);
+        case 'win32':  return win32Get(account);
+        default: throw new Error(`[keychain] unsupported platform: ${process.platform}`);
+    }
+}
+
+function setSecret(account, value) {
+    switch (platform()) {
+        case 'darwin': return darwinSet(account, value);
+        case 'linux':  return linuxSet(account, value);
+        case 'win32':  return win32Set(account, value);
+        default: throw new Error(`[keychain] unsupported platform: ${process.platform}`);
+    }
+}
+
+function deleteSecret(account) {
+    switch (platform()) {
+        case 'darwin': return darwinDelete(account);
+        case 'linux':  return linuxDelete(account);
+        case 'win32':  return win32Delete(account);
+        default: throw new Error(`[keychain] unsupported platform: ${process.platform}`);
+    }
+}
+
+module.exports = { getSecret, setSecret, deleteSecret, SERVICE };

package/src/runtime/memory/data/runtime-manifest.json

@@ -0,0 +1,40 @@
+{
+  "schema_version": 1,
+  "generated_at": "2026-06-11T13:16:44.033Z",
+  "release_tag": "runtime-v0.4.0",
+  "pg": {
+    "major": 16,
+    "minor": 4
+  },
+  "pgvector": {
+    "version": "0.8.2"
+  },
+  "assets": {
+    "darwin-arm64": {
+      "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-darwin-arm64-pg16.4-pgvector0.8.2.tar.gz",
+      "sha256": "7a642006ef60ccf8c385ba89c761c2b6f4927f6f01a1c4fb152604e6b41fe3d2",
+      "size": 23397361
+    },
+    "darwin-x64": {
+      "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-darwin-x64-pg16.4-pgvector0.8.2.tar.gz",
+      "sha256": "8e39bfc3f06d88e9854946d5d83f7d77d9530f99284d7c1c51872c12f389f7e7",
+      "size": 23687666
+    },
+    "linux-x64": {
+      "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-linux-x64-pg16.4-pgvector0.8.2.tar.gz",
+      "sha256": "28ee64125a0125ff36c47560c08ce8f38e49aef034c010c7e4867e8cdd783385",
+      "size": 23276106
+    },
+    "win32-x64": {
+      "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-win32-x64-pg16.4-pgvector0.8.2.tar.gz",
+      "sha256": "6faed8a49b3303b0adb1c5715b2b19c5cc47df2e738d586d0d0bd432f1ca035d",
+      "size": 44036958
+    },
+    "linux-arm64": {
+      "unsupported": true,
+      "url": "TBD",
+      "sha256": "TBD",
+      "size": 0
+    }
+  }
+}