mixdog 0.7.18 → 0.8.1

package/SECURITY.md

@@ -1,138 +0,0 @@
-# Security Policy
-
-mixdog is a local Claude Code plugin. Its security boundary is the user's
-machine, the active Claude Code workspace, and any external providers the user
-explicitly configures.
-
-## Supported Versions
-
-Security fixes are accepted for the latest published version. If you maintain a
-fork or an older pinned install, upgrade to the latest release before reporting
-an issue unless the vulnerability is only present in a new release.
-
-## Reporting a Vulnerability
-
-Please report suspected vulnerabilities privately first. Use a private GitHub
-security advisory on the repository when advisories are enabled, or email the
-address listed in the `author` field of `package.json`.
-
-Include:
-
-- The mixdog version.
-- Operating system and Claude Code version.
-- Whether channels, Discord, webhooks, voice, or external search providers were
-  enabled.
-- A minimal reproduction or the smallest relevant log excerpt.
-
-Do not include real API keys, Discord tokens, OAuth tokens, private prompts, or
-conversation transcripts in public issues.
-
-## Security Model
-
-mixdog exposes one MCP server plus Claude Code hooks. It is designed around
-explicit local state and layered permission gates:
-
-- Destructive shell patterns are hard-blocked before execution, with no escape
-  flag: recursive deletes of root/home (`rm -rf /`, `rd /s`,
-  `Remove-Item -Recurse -Force`), `git push --force`, `git reset --hard`, disk
-  formatting (`format`, `mkfs`, `diskpart clean`, `dd if=/dev/...`), and system
-  shutdown/reboot. PowerShell `-EncodedCommand` payloads are decoded first so
-  base64-smuggled variants are caught too. Other risky commands (`git clean -f`,
-  `kubectl delete`, `terraform destroy`, `DROP TABLE`, …) get a non-blocking
-  inline warning instead of a block.
-- File tools are scoped to the active working directory by default; HOME-wide
-  writes require the `homeAccess` capability opt-in.
-- Bridge sub-agent `Edit`/`Write` to any path outside the session workspace is
-  routed through a Discord approval prompt before it runs.
-- Dangerous system paths (`/etc`, `/proc`, `/sys`, `/dev`, `C:\Windows`,
-  `System32`, Program Files, UNC shares) are hard-denied by hook policy before
-  any permission-mode check.
-- Each role runs with a fixed permission preset — `full` (read/write tools) or
-  `read` (write/edit/bash refused at the session runtime guard). Roles do not
-  gain ambient access beyond their preset.
-- Discord tokens, webhook authtokens, and LLM provider API keys are read only
-  from `MIXDOG_*` (or standard provider) environment variables or the OS
-  keychain — never from `mixdog-config.json`, which is itself written
-  owner-only.
-- Webhook payloads and headers are wrapped in untrusted-data fences and handed
-  to the agent as data to inspect, never executed as instructions.
-- Discord, webhooks, schedules, and voice are disabled unless the user starts
-  Claude Code with the development channel flag
-  (`--dangerously-load-development-channels`).
-
-## Fail-open Hook Model
-
-The permission hooks are a convenience and guard layer, not a sandbox. They
-raise the cost of an accidental destructive action; they do not contain a
-determined or compromised agent.
-
-Hook decisions travel over a local IPC channel between Claude Code and the
-mixdog daemon:
-
-- A small Rust shim (`mixdog-shim`) receives the hook payload from Claude Code
-  and forwards it to the daemon over a named pipe (`\\.\pipe\mixdog-hooks` on
-  Windows) or a Unix domain socket (`${XDG_RUNTIME_DIR:-/tmp}/mixdog-hooks.sock`).
-- A long-lived listener inside the channels worker
-  (`src/channels/lib/hook-pipe-server.mjs`) evaluates the payload and returns a
-  decision, or `"null"` to allow.
-
-This path is **fail-open by design**. When the daemon is not running, the pipe
-is unreachable, or dispatch raises an error, the components default to allow:
-the server emits `"null"` and the shim exits `0`, so nothing is blocked. A
-missing daemon therefore never wedges the user's session — but it also means
-permission hooks are silently bypassed until the daemon is restored.
-
-Run `bun scripts/doctor.mjs` to confirm the supervisor and hook pipe are
-healthy. Do not rely on the hooks alone as a security boundary; the operating
-system account, workspace isolation, and provider-side credentials remain the
-real perimeter.
-
-## Local Writes
-
-New installs seed configuration under:
-
-```text
-~/.claude/plugins/data/mixdog-trib-plugin/
-```
-
-The seeded default prompt-injection mode is `CLAUDE.md`, which writes a
-marker-delimited managed block to the configured target file, usually
-`~/.claude/CLAUDE.md`:
-
-```text
-<!-- BEGIN mixdog managed -->
-...
-<!-- END mixdog managed -->
-```
-
-mixdog only owns the content inside those markers.
-
-## Network Surface
-
-mixdog makes outbound requests only for features the user configures or invokes:
-
-- LLM providers: Anthropic, OpenAI, Gemini, or OpenAI-compatible endpoints.
-- Search providers: Firecrawl, Tavily, Exa, the configured LLM search backends,
-  and URL fetches requested through search/fetch tools.
-- Discord and webhook endpoints when channels are enabled.
-- Runtime downloads when the user installs those optional components: signed
-  manifests from `raw.githubusercontent.com` (the memory, voice, code-graph, and
-  patch manifests, plus the LiteLLM model-pricing catalog) and the
-  checksum-verified binaries/archives they point at, served from GitHub release
-  assets (`github.com/trib-plugin/mixdog/releases`) and the upstream
-  `ffmpeg-static` releases for voice.
-
-The config UI binds to `127.0.0.1` and rejects cross-origin requests.
-
-## Dependency Hygiene
-
-Run these before publishing:
-
-```sh
-bun install --frozen-lockfile
-bun run ci
-```
-
-`bun audit` is part of `bun run ci`. If a transitive dependency is vulnerable,
-prefer a narrow `overrides` pin and document why the pin exists.
-

package/UNINSTALL.md

@@ -1,115 +0,0 @@
-# Uninstall
-
-This guide removes mixdog code, local state, and optional global rule injection.
-
-## 0. Restore User-Owned Files (recommended)
-
-Run the restore helper first. It restores your pre-mixdog `~/.claude/CLAUDE.md`
-and the `autoMemoryEnabled` / `awaySummaryEnabled` keys in
-`~/.claude/settings.json` from the snapshot captured at install time, and
-removes the gateway's `env.ANTHROPIC_BASE_URL` entry from `settings.json` if
-`/mixdog:model --enable` ever added it (so Claude Code's main model returns to
-`api.anthropic.com` instead of a dead local gateway). It deletes nothing —
-data/plugin/backup removal stays manual (it prints those steps).
-
-```text
-node scripts/uninstall.mjs        # or: bun scripts/uninstall.mjs
-node scripts/uninstall.mjs --dry-run   # preview without modifying anything
-```
-
-The helper covers only the restore portion (CLAUDE.md, the two settings keys,
-and the gateway `ANTHROPIC_BASE_URL` env entry) and prints guidance. The remaining steps below — plugin removal, deleting
-the data and backups directories, and statusLine/secrets/credential cleanup —
-are required regardless of whether you run it.
-
-## 1. Uninstall the Plugin
-
-From Claude Code:
-
-```text
-/plugin uninstall mixdog@trib-plugin
-```
-
-If the marketplace is no longer needed:
-
-```text
-/plugin marketplace remove trib-plugin
-```
-
-## 2. Remove Local Data
-
-Delete the plugin data directory if you do not want to keep memory, schedules,
-webhooks, logs, or local configuration (the unified `mixdog-config.json`):
-
-```text
-~/.claude/plugins/data/mixdog-trib-plugin/
-```
-
-This removes local memory and runtime state. It does not revoke external API
-keys at their providers.
-
-If you ran the config-preserving reinstall flow, mixdog may also have stored a
-backup of your user data. Remove it as well if you do not need it:
-
-```text
-~/.claude/backups/mixdog-user-data
-```
-
-## 3. Remove the Managed CLAUDE.md Block
-
-The restore helper in step 0 handles this automatically. To do it by hand,
-open the configured target file, usually:
-
-```text
-~/.claude/CLAUDE.md
-```
-
-Remove only the marker-delimited block:
-
-```text
-<!-- BEGIN mixdog managed -->
-...
-<!-- END mixdog managed -->
-```
-
-Older installs may contain legacy markers:
-
-```text
-<!-- BEGIN trib-plugin managed -->
-...
-<!-- END trib-plugin managed -->
-```
-
-Remove those legacy blocks as well if present.
-
-## 4. Remove the statusLine Entry
-
-If a status line appeared, mixdog injected a `statusLine` entry into:
-
-```text
-~/.claude/settings.json
-```
-
-Open that file and delete the `statusLine` object whose
-`"source": "mixdog-auto"`. Leave any status line you configured yourself
-untouched — mixdog only manages entries tagged `mixdog-auto`.
-
-## 5. Remove Secrets
-
-Delete any mixdog-related secrets from your OS keychain or credential manager.
-Common account names include:
-
-- `discord.token`
-- `webhook.authtoken`
-- `search.firecrawl.apiKey`
-- `search.tavily.apiKey`
-- `search.exa.apiKey`
-- `agent.<provider>.apiKey` (e.g. `agent.openai.apiKey`, `agent.xai.apiKey`)
-
-Also remove any `MIXDOG_*` environment variables you created.
-
-## 6. Revoke External Credentials
-
-If you configured Discord, search providers, webhooks, or direct LLM API keys,
-rotate or revoke those credentials in the provider dashboards.
-

package/agents/maintenance.md

@@ -1,5 +0,0 @@
-# Maintenance
-
-Memory cycle maintenance agent. Runs periodically (~10min) to process transcript chunks, promote facts, and keep the memory system healthy.
-
-Stateless: no transcript carried between dispatches. Each cycle is independent.

package/agents/memory-classification.md

@@ -1,30 +0,0 @@
-# Memory Classification Shared
-
-Shared category taxonomy referenced by the memory cycle agents (cycle1 chunker/classifier, cycle2 curator).
-
-## Category grades
-
-Higher grade = more permanent weight.
-
-| grade | category | meaning |
-|---|---|---|
-| 2.0 | `rule` | permanent rules, identity, operating policies |
-| 1.9 | `constraint` | hard limits (security / cost / time) |
-| 1.8 | `decision` | agreed decisions |
-| 1.6 | `fact` | verified facts / observed patterns |
-| 1.5 | `goal` | long-term direction |
-| 1.4 | `preference` | user taste / style |
-| 1.1 | `task` | active work (volatile; rarely core) |
-| 1.0 | `issue` | known problems (only if permanently relevant) |
-
-When ambiguous, pick the higher-grade category that fits (rule > constraint > decision > fact > goal > preference > task > issue).
-
-## Edge examples
-
-| contrast | A | B |
-|---|---|---|
-| rule / constraint | rule: "Commit uses `YYYY-MM-DD HH:MM` prefix" | constraint: "Never push to main without approval" |
-| decision / fact | decision: "Use bridge as the single agent entry point" | fact: "bridge dispatches via role mapping in user-workflow.json" |
-| fact / preference | fact: "User prefers Korean replies" (verified, hard) | preference: "User prefers warm polite tone" (taste) |
-| task / issue | task: "Implement chunk grouping in cycle1" | issue: "vec_memory has 6,000 stale rows" |
-| goal / decision | goal: "Cut LLM cost 50% next quarter" | decision: "Drop semantic_cache to simplify" |

package/agents/scheduler-task.md

@@ -1,18 +0,0 @@
-# Scheduler Task
-
-Scheduled channel task agent. Executes a cron-triggered run defined in the scheduler configuration.
-
-Stateless: each scheduled run is independent. Task instructions come from the schedule configuration.
-
-Per-entry config lives in `${CLAUDE_PLUGIN_DATA}/schedules/<name>/{config.json, instructions.md}` — `instructions.md` is the per-run brief, `config.json` holds time/timezone/days/channel/model.
-
-## Routing (by channel presence)
-
-Decided purely by `channel` presence in `config.json` — no `type`/`mode`/`role` field:
-
-- **No `channel`** → on fire, the task is injected into the current (Lead) session, handled with full context.
-- **With a `channel`** → this role runs as a direct dispatch and reports straight to that Discord channel (config carries the `model` preset).
-
-## Skip protocol
-
-When a run has nothing to report (no action needed, nothing changed, or a dedup/duplicate), emit `[meta:silent]` as the FIRST line and nothing else. This drops the notification entirely: zero Lead turn, zero channel post. See `rules/bridge/20-skip-protocol.md`. True skips only — never to suppress an actionable result.

package/agents/webhook-handler.md

@@ -1,27 +0,0 @@
-# Webhook Handler
-
-Webhook event analysis agent. Processes an inbound webhook delivery, extracts actionable information, and reports it.
-
-Stateless: each webhook event is processed independently. No context from prior webhooks.
-
-Per-entry config lives in `${CLAUDE_PLUGIN_DATA}/webhooks/<name>/{config.json, instructions.md}` — `instructions.md` is the per-delivery brief, `config.json` holds parser/secret/channel/model.
-
-## Routing (by channel presence)
-
-Decided purely by `channel` presence in `config.json` — no `mode`/`type`/`role` field:
-
-- **No `channel`** → the delivery is injected into the current (Lead) session, handled with full context.
-- **With a `channel`** → this role runs as a direct dispatch and reports the result straight to that Discord channel (config carries the `model` preset).
-
-## Skip protocol
-
-When a delivery has nothing to report — no code change, non-default branch, docs-only, or a dedup/duplicate event — emit `[meta:silent]` as the FIRST line and nothing else. This drops the notification entirely: zero Lead turn, zero channel post. See `rules/bridge/20-skip-protocol.md`. Use only for true skips, never to suppress an actionable finding.
-
-## Discipline
-
-- One read per concrete file:line evidence; never re-read the same file or paraphrase the same grep.
-- After 2 grep turns without a locked file:line, switch to `code_graph
-  find_symbol` / `callers` / `references`, or `mode:search` (keyword or
-  partial symbol name — file-less, before grep).
-- Response: keep narrative tight — `path:line` + one short cause + one suggested fix. Skip prelude, scope renegotiation, and closer questions.
-- Stop as soon as the issue is grounded; further tool calls without new evidence are wasted budget.

package/agents/worker.md

@@ -1,24 +0,0 @@
-Public bridge-worker tool discipline; the `explorer` role shares it.
-The universal bridge contract — `<final-answer>` output, git refusal —
-lives in rules/bridge/00-common.md; the tool routing policy lives in
-rules/shared/01-tool.md. This file adds only the public-worker edit +
-retrieval discipline.
-
-## Scope / Edits
-
-- Do only the brief; no unrelated features, cleanup, abstractions, or
-  error handling.
-- Prefer direct local changes.
-- Comment only when the WHY is non-obvious.
-- No compatibility shim inside your own change scope.
-- No unrelated rewrite.
-
-## Tools
-
-- Do not use `recall` or `search`.
-
-## Mismatch
-
-On coordinate mismatch, report
-`mismatch: at <path:line> expected '<X>' got '<Y>'`, then re-locate once
-via normal routing. Found -> continue; not found -> return partial findings.

package/bin/bridge

@@ -1,133 +0,0 @@
-#!/usr/bin/env bun
-// bridge — CLI prompt store + lightweight bridge for mixdog
-// Usage:
-//   bridge store <key> <file>   Store file content with key
-//   bridge store <key>          Read from stdin
-//   bridge list                 List stored keys
-//   bridge get <key>            Print stored content
-//   bridge delete <key>         Remove a key
-//   bridge <role> <prompt...>   Send prompt via owner HTTP (no server boot)
-//   bridge <role> -             Read prompt from stdin
-
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
-import { join, dirname } from 'path';
-import { tmpdir } from 'os';
-import { request } from 'http';
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-const { resolvePluginData } = require('../lib/plugin-paths.cjs');
-
-const STORE_PATH = join(
-  resolvePluginData(),
-  'prompt-store.json'
-);
-
-function load() {
-  if (!existsSync(STORE_PATH)) return {};
-  try { return JSON.parse(readFileSync(STORE_PATH, 'utf-8')); } catch { return {}; }
-}
-
-function save(store) {
-  mkdirSync(dirname(STORE_PATH), { recursive: true });
-  writeFileSync(STORE_PATH, JSON.stringify(store, null, 2) + '\n', 'utf-8');
-}
-
-function getOwnerPort() {
-  const activeFile = join(tmpdir(), 'mixdog', 'active-instance.json');
-  if (!existsSync(activeFile)) return null;
-  try {
-    const state = JSON.parse(readFileSync(activeFile, 'utf-8'));
-    return state.httpPort || null;
-  } catch { return null; }
-}
-
-function httpPost(port, path, body) {
-  return new Promise((resolve, reject) => {
-    const data = JSON.stringify(body);
-    const req = request({ hostname: '127.0.0.1', port, path, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) } }, res => {
-      const chunks = [];
-      res.on('data', c => chunks.push(c));
-      res.on('end', () => {
-        try { resolve(JSON.parse(Buffer.concat(chunks).toString())); }
-        catch { resolve({ raw: Buffer.concat(chunks).toString() }); }
-      });
-    });
-    req.on('error', reject);
-    req.write(data);
-    req.end();
-  });
-}
-
-const [,, cmd, ...rest] = process.argv;
-
-switch (cmd) {
-  case 'store': {
-    const [key, file] = rest;
-    if (!key) { console.error('Usage: bridge store <key> [file]'); process.exit(1); }
-    let content;
-    if (file) {
-      content = readFileSync(file, 'utf-8');
-    } else {
-      const chunks = [];
-      for await (const chunk of process.stdin) chunks.push(chunk);
-      content = Buffer.concat(chunks).toString('utf-8');
-    }
-    const store = load();
-    store[key] = content;
-    save(store);
-    console.log(`Stored '${key}' (${content.length} chars)`);
-    break;
-  }
-  case 'list': {
-    const store = load();
-    const keys = Object.keys(store);
-    if (keys.length === 0) { console.log('(empty)'); break; }
-    for (const k of keys) console.log(`${k} (${store[k].length} chars)`);
-    break;
-  }
-  case 'get': {
-    const [key2] = rest;
-    if (!key2) { console.error('Usage: bridge get <key>'); process.exit(1); }
-    const store = load();
-    if (!(key2 in store)) { console.error(`Key '${key2}' not found`); process.exit(1); }
-    console.log(store[key2]);
-    break;
-  }
-  case 'delete': {
-    const [key3] = rest;
-    if (!key3) { console.error('Usage: bridge delete <key>'); process.exit(1); }
-    const store = load();
-    if (!(key3 in store)) { console.error(`Key '${key3}' not found`); process.exit(1); }
-    delete store[key3];
-    save(store);
-    console.log(`Deleted '${key3}'`);
-    break;
-  }
-  default: {
-    const role = cmd;
-    if (!role || role.startsWith('-')) { console.error('Usage: bridge <role> <prompt...> | bridge <role> - (stdin)'); process.exit(1); }
-    const port = getOwnerPort();
-    if (!port) { console.error('No running mixdog instance found'); process.exit(1); }
-    const body = { role };
-    if (rest[0] === '-') {
-      const chunks = [];
-      for await (const chunk of process.stdin) chunks.push(chunk);
-      body.prompt = Buffer.concat(chunks).toString('utf-8').trim();
-    } else if (rest.length) {
-      body.prompt = rest.join(' ');
-    } else {
-      console.error('Usage: bridge <role> <prompt...> | bridge <role> - (stdin)');
-      process.exit(1);
-    }
-    try {
-      const result = await httpPost(port, '/bridge', body);
-      const text = result?.content?.[0]?.text || JSON.stringify(result);
-      console.log(text);
-    } catch (e) {
-      console.error(`bridge failed: ${e.message}`);
-      process.exit(1);
-    }
-    break;
-  }
-}

package/bin/statusline-launcher.mjs

@@ -1,82 +0,0 @@
-#!/usr/bin/env node
-// mixdog statusline launcher — version-independent STABLE entry.
-// settings.json points here forever; each tick it resolves the ACTIVE
-// install from installed_plugins.json (never a version-pinned path), so a
-// plugin version bump self-heals on the next refresh with no restart.
-// Node-builtins only — must run under both bun and node.
-//
-// FAIL-SOFT INVARIANT (non-negotiable): this command runs for EVERY machine
-// on every tick. ANY error (missing/locked/parse-broken manifest, missing
-// target, throw) must still print one minimal `mixdog` line and exit 0. A
-// crashing command makes CC render nothing.
-
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { spawnSync } from 'child_process';
-import { pathToFileURL } from 'url';
-
-function failSoft() {
-  try { process.stdout.write('mixdog\n'); } catch {}
-  process.exit(0);
-}
-
-function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
-}
-
-async function main() {
-  // CC stdin JSON (may be empty). Never block the tick on a read error.
-  let stdinBuf = Buffer.alloc(0);
-  try { stdinBuf = fs.readFileSync(0); } catch {}
-
-  // Resolve the ACTIVE install from the manifest — manifest-canonical, no
-  // version pin. Any failure here → fail-soft.
-  const manifestPath = path.join(
-    claudeConfigDir(), 'plugins', 'installed_plugins.json'
-  );
-  let installPath = '';
-  try {
-    const data = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-    const entry = data?.plugins?.['mixdog@trib-plugin']?.[0];
-    installPath = String(entry?.installPath || '').replace(/\\/g, '/');
-  } catch { return failSoft(); }
-  if (!installPath) return failSoft();
-
-  // (a) Native shim fast path — match resolveStatusLineCommand's os/arch map.
-  const ext = process.platform === 'win32' ? '.exe' : '';
-  const platMap = { win32: 'windows', darwin: 'macos', linux: 'linux' };
-  const archMap = { x64: 'x86_64', arm64: 'aarch64' };
-  const prebuiltDir = `${platMap[process.platform]}-${archMap[process.arch]}`;
-  const shimCandidates = [
-    `${installPath}/native/mixdog-shim/target/release/mixdog-shim${ext}`,
-    `${installPath}/native/prebuilt/${prebuiltDir}/mixdog-shim${ext}`,
-  ];
-  for (const shimPath of shimCandidates) {
-    let exists = false;
-    try { exists = fs.existsSync(shimPath); } catch {}
-    if (!exists) continue;
-    try {
-      const r = spawnSync(shimPath, ['--kind=statusline'], { input: stdinBuf, windowsHide: true });
-      if (r.status === 0 && r.stdout && r.stdout.length) {
-        process.stdout.write(r.stdout);
-        return process.exit(0);
-      }
-    } catch {}
-    // Shim present but failed — fall through to the lib path / fail-soft.
-    break;
-  }
-
-  // (b) Library fallback — render in-process via statusline-lib's export.
-  const libPath = `${installPath}/bin/statusline-lib.mjs`;
-  let mod;
-  try { mod = await import(pathToFileURL(libPath).href); } catch { return failSoft(); }
-  const render = mod && mod.renderStatusLine;
-  if (typeof render !== 'function') return failSoft();
-  let out = '';
-  try { out = await render(stdinBuf.toString('utf8')); } catch { return failSoft(); }
-  process.stdout.write(out && out.length ? out : 'mixdog\n');
-  process.exit(0);
-}
-
-main().catch(failSoft);