mixdog 0.7.5 → 0.7.7

package/setup/wizard.mjs

@@ -5,10 +5,11 @@
  * Callers must set process.env.CLAUDE_PLUGIN_DATA before importing this
  * module (install.mjs does that) so src/shared/config.mjs can resolve paths.
  */
-import { createInterface } from 'node:readline';
+import { spawnSync } from 'node:child_process';
 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'node:fs';
 import { join, dirname, basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { defaultPluginDataDir } from './install.mjs';
 import {
   mergeAgentConfig,
   mergeMemoryConfig,
@@ -16,6 +17,19 @@ import {
   mergeSearchConfig,
 } from './config-merge.mjs';
 import { DEFAULT_MODELS } from '../src/search/lib/config.mjs';
+import {
+  select,
+  multiselect,
+  confirm,
+  text,
+  password,
+  createProgressBar,
+  createSpinner,
+} from './tui.mjs';
+
+let _linuxSecretsCapable;
+const KEYTAR_SERVICE = 'mixdog';
+const KEYTAR_PROBE_TIMEOUT_MS = 8000;
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = join(__dirname, '..');
@@ -52,12 +66,59 @@ const SEARCH_OAUTH_ALIASES = Object.freeze({
 });
 function pluginDataDir() {
   const dir = process.env.CLAUDE_PLUGIN_DATA;
-  if (!dir || typeof dir !== 'string' || !String(dir).trim()) {
-    throw new Error(
-      'CLAUDE_PLUGIN_DATA must be set before running the setup wizard (install.mjs sets it unconditionally)',
-    );
+  if (dir && typeof dir === 'string' && String(dir).trim()) {
+    return String(dir).trim();
   }
-  return String(dir).trim();
+  return defaultPluginDataDir();
+}
+
+/** One-time Linux preflight: optional keytar must load before any secret prompt. */
+export function resetLinuxSecretsCapableCache() {
+  _linuxSecretsCapable = undefined;
+}
+
+function runLinuxKeytarOperationalProbe() {
+  const script = [
+    'try {',
+    'const keytar = require("keytar");',
+    'if (process.env.MIXDOG_KEYTAR_PROBE_INJECT_FAIL === "1") process.exit(3);',
+    `keytar.findCredentials(${JSON.stringify(KEYTAR_SERVICE)})`,
+    '  .then(() => process.exit(0))',
+    '  .catch((e) => { process.stderr.write(String(e && e.message ? e.message : e)); process.exit(1); });',
+    '} catch (e) { process.stderr.write(String(e && e.message ? e.message : e)); process.exit(2); }',
+  ].join(' ');
+  const r = spawnSync(process.execPath, ['-e', script], {
+    env: { ...process.env },
+    encoding: 'utf8',
+    timeout: KEYTAR_PROBE_TIMEOUT_MS,
+    windowsHide: true,
+    stdio: ['ignore', 'ignore', 'pipe'],
+  });
+  if (r.error) return false;
+  return r.status === 0;
+}
+
+/**
+ * @param {{ treatAsLinux?: boolean }} [probeOptions] — .scratch harness only (operational probe).
+ */
+export function probeLinuxSecretsCapable(probeOptions = null) {
+  const isLinux = probeOptions?.treatAsLinux === true || process.platform === 'linux';
+  if (!isLinux) return true;
+  if (_linuxSecretsCapable !== undefined) return _linuxSecretsCapable;
+  _linuxSecretsCapable = runLinuxKeytarOperationalProbe();
+  return _linuxSecretsCapable;
+}
+
+export function linuxKeychainUnavailableMessage() {
+  return [
+    '',
+    '⚠ Linux keychain unavailable (optional `keytar` not installed or libsecret missing).',
+    '  Secret prompts are skipped; non-secret setup continues. Install keytar later, then use the Mixdog UI:',
+    '    Debian/Ubuntu: sudo apt install libsecret-1-dev   then: npm install keytar',
+    '    Fedora/RHEL:   sudo dnf install libsecret-devel then: npm install keytar',
+    '    Arch:          sudo pacman -S libsecret         then: npm install keytar',
+    '',
+  ].join('\n');
 }
 
 function sanitizeName(n) {
@@ -81,61 +142,13 @@ function defaultIo() {
       say: (line) => { if (line) console.log(line); },
     };
   }
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const ask = (prompt) => new Promise((resolve) => {
-    rl.question(prompt, (answer) => resolve(answer));
-  });
-  const askSecret = (prompt) => readHiddenLine(prompt).finally(() => {
-    rl.resume();
-  });
   return {
     interactive: true,
-    ask,
-    askSecret,
     say: (line) => { if (line) console.log(line); },
-    close: () => rl.close(),
+    close: () => {},
   };
 }
 
-function readHiddenLine(prompt) {
-  return new Promise((resolve, reject) => {
-    const stdin = process.stdin;
-    if (!stdin.isTTY) {
-      resolve('');
-      return;
-    }
-    const wasRaw = stdin.isRaw;
-    stdin.setRawMode(true);
-    stdin.resume();
-    process.stdout.write(prompt);
-    let value = '';
-    const onData = (chunk) => {
-      const s = chunk.toString('utf8');
-      for (const ch of s) {
-        if (ch === '\n' || ch === '\r' || ch === '\u0004') {
-          stdin.removeListener('data', onData);
-          stdin.setRawMode(wasRaw);
-          process.stdout.write('\n');
-          resolve(value);
-          return;
-        }
-        if (ch === '\u0003') {
-          stdin.removeListener('data', onData);
-          stdin.setRawMode(wasRaw);
-          reject(new Error('cancelled'));
-          return;
-        }
-        if (ch === '\u007f' || ch === '\b') {
-          value = value.slice(0, -1);
-          continue;
-        }
-        value += ch;
-      }
-    };
-    stdin.on('data', onData);
-  });
-}
-
 async function loadConfigModules() {
   const { ensureDataSeeds } = await import('../src/shared/seed.mjs');
   const { readSection, updateSection } = await import('../src/shared/config.mjs');
@@ -193,35 +206,39 @@ function presetIdsFromAgent(agentSection) {
   return presets.map((p) => p.id || p.name).filter(Boolean);
 }
 
-export async function stepDiscordToken(io, { updateSection, readSection }) {
+export async function stepDiscordToken(io, { updateSection, readSection, secretsCapable = true }) {
   const { hasStoredSecret, SECRET_ACCOUNTS, getDiscordToken } = await import('../src/shared/config.mjs');
   io.say('\n── Step 2/9: Discord ──');
   io.say('Bot token (keychain), application ID, and optional main channel.');
 
-  const hadStoredToken = hasStoredSecret(SECRET_ACCOUNTS.discordToken);
-  const tokenPrompt = hadStoredToken
-    ? 'Discord bot token (stored, Enter=keep): '
-    : 'Discord bot token [hidden] (Enter=skip whole step): ';
-  const token = (await io.askSecret(tokenPrompt)).trim();
-  const enteredToken = !isSkippableAnswer(token);
-  if (!enteredToken && !hadStoredToken) {
-    io.say('• Skipped Discord setup.');
-    return false;
+  let hadStoredToken = false;
+  let token = '';
+  let enteredToken = false;
+  if (!secretsCapable) {
+    io.say('• Discord bot token: skipped (Linux keychain unavailable).');
+  } else {
+    hadStoredToken = hasStoredSecret(SECRET_ACCOUNTS.discordToken);
+    const tokenPrompt = hadStoredToken
+      ? 'Discord bot token (stored — leave empty to keep)'
+      : 'Discord bot token (leave empty to skip whole step)';
+    token = (await password(tokenPrompt)).trim();
+    enteredToken = !isSkippableAnswer(token);
+    if (!enteredToken && !hadStoredToken) {
+      io.say('• Skipped Discord setup.');
+      return false;
+    }
   }
 
   const channels = readSection('channels') || {};
   const curDiscord = channels.discord && typeof channels.discord === 'object' ? channels.discord : {};
   const curAppId = String(curDiscord.applicationId || '').trim();
   const appIdBase = 'Application ID';
-  const appIdPrompt = curAppId
-    ? `${appIdBase} (current: ${curAppId}, Enter=keep): `
-    : `${appIdBase}: `;
-  const appIdRaw = await io.ask(appIdPrompt);
+  const appIdRaw = await text(appIdBase, {
+    placeholder: curAppId ? `${curAppId} (Enter to keep)` : '',
+    initial: '',
+  });
   const appIdToSet = isSkippableAnswer(appIdRaw) ? '' : String(appIdRaw).trim();
-  // The main channel is conventionally named "main" with interactive mode;
-  // only the channel ID varies, so we ask just that. Extra channels and
-  // monitor mode are configured later in the UI.
-  const chIdRaw = await io.ask('Main channel ID (Enter=skip channel): ');
+  const chIdRaw = await text('Main channel ID', { placeholder: 'Enter to skip channel', initial: '' });
   const channelId = isSkippableAnswer(chIdRaw) ? '' : String(chIdRaw).trim();
   const channelName = 'main';
   const mode = 'interactive';
@@ -261,19 +278,35 @@ function formatVoiceProgress(p) {
   return `${phase} · received ${mb} MB`;
 }
 
-async function installVoiceRuntime(dataDir, io) {
+async function installVoiceRuntime(dataDir) {
   const {
     ensureWhisperRuntime,
     ensureWhisperModel,
     ensureFfmpegRuntime,
   } = await import('../src/channels/lib/voice-runtime-fetcher.mjs');
+  let spinner = createSpinner('Downloading voice runtime…');
+  let bar = null;
   const onProgress = (p) => {
     const line = formatVoiceProgress(p);
-    if (line) io.say(`  ${line}`);
+    if (!line) return;
+    const downloaded = Number(p?.downloaded) || 0;
+    const total = Number(p?.total) || 0;
+    if (total > 0) {
+      if (!bar) {
+        spinner.stop('', true);
+        spinner = null;
+        bar = createProgressBar('Voice download', { total });
+      }
+      bar.update(downloaded, total);
+    } else if (spinner) {
+      spinner.update(line);
+    }
   };
   await ensureWhisperRuntime(dataDir, onProgress);
   const model = await ensureWhisperModel(dataDir, onProgress);
   await ensureFfmpegRuntime(dataDir, onProgress);
+  if (bar) bar.done('complete');
+  else if (spinner) spinner.stop('complete', true);
   return model?.modelId || 'large-v3-turbo';
 }
 
@@ -282,20 +315,14 @@ async function stepVoiceTranscription(io, ctx, discordTokenSaved) {
   if (!discordTokenSaved) return;
   io.say('\n── Step 2a/9: Voice transcription (음성 전사) ──');
   io.say('Install local Speech-to-text (whisper.cpp) for Discord voice messages.');
-  const raw = await io.ask('Enable voice transcription? [y/N] (Enter=skip): ');
-  if (isSkippableAnswer(raw)) {
-    io.say('• Skipped voice transcription.');
-    return;
-  }
-  const a = String(raw).trim().toLowerCase();
-  if (a !== 'y' && a !== 'yes') {
+  const enable = await confirm('Enable voice transcription?', { initial: false });
+  if (!enable) {
     io.say('• Skipped voice transcription.');
     return;
   }
   const { updateSection, dataDir } = ctx;
   try {
-    io.say('• Downloading voice runtime (this may take a while)…');
-    const modelId = await installVoiceRuntime(dataDir, io);
+    const modelId = await installVoiceRuntime(dataDir);
     const voice = { language: 'auto', model: modelId };
     updateSection('channels', (current) => mergeConfig(current, { voice }, {}));
     io.say('• Voice transcription runtime installed and channels voice config saved.');
@@ -310,8 +337,14 @@ async function stepAddressForm(io, { updateSection, readSection }) {
   const memory = readSection('memory');
   const curTitle = memory?.user?.title || '';
   const curName = memory?.user?.name || '';
-  const titleRaw = await io.ask(`How should Mixdog address you? user.title [${curTitle}]: `);
-  const nameRaw = await io.ask(`Your display name? user.name [${curName}]: `);
+  const titleRaw = await text('How should Mixdog address you? user.title', {
+    placeholder: curTitle || 'Enter to skip',
+    initial: '',
+  });
+  const nameRaw = await text('Your display name? user.name', {
+    placeholder: curName || 'Enter to skip',
+    initial: '',
+  });
   const title = isSkippableAnswer(titleRaw) ? '' : String(titleRaw).trim();
   const name = isSkippableAnswer(nameRaw) ? '' : String(nameRaw).trim();
   if (!title && !name) {
@@ -326,16 +359,11 @@ async function stepAddressForm(io, { updateSection, readSection }) {
   io.say('• Saved memory.user (title/name).');
 }
 
-export async function stepWebhookReceiver(io, { updateSection, readSection }) {
+export async function stepWebhookReceiver(io, { updateSection, readSection, secretsCapable = true }) {
   io.say('\n── Step 3/9: Inbound webhooks (ngrok receiver) ──');
   io.say('Global webhook tunnel for inbound HTTP (channels.webhook). Per-endpoint registration is configured later in the UI.');
-  const enableRaw = await io.ask('Enable inbound webhooks? [y/N]: ');
-  if (isSkippableAnswer(enableRaw)) {
-    io.say('• Skipped webhook setup.');
-    return;
-  }
-  const enable = String(enableRaw).trim().toLowerCase();
-  if (enable !== 'y' && enable !== 'yes') {
+  const enableWebhooks = await confirm('Enable inbound webhooks?', { initial: false });
+  if (!enableWebhooks) {
     io.say('• Skipped webhook setup.');
     return;
   }
@@ -345,29 +373,45 @@ export async function stepWebhookReceiver(io, { updateSection, readSection }) {
   const curDomain = String(curWebhook.domain || curWebhook.ngrokDomain || '').trim();
   const domainBase =
     'Domain (ngrok, e.g. your-name.ngrok-free.dev — get it at dashboard.ngrok.com/domains)';
-  const domainPrompt = curDomain
-    ? `${domainBase} (current: ${curDomain}, Enter=keep): `
-    : `${domainBase}: `;
-  const domainRaw = await io.ask(domainPrompt);
+  const domainRaw = await text(domainBase, {
+    placeholder: curDomain ? `${curDomain} (Enter to keep)` : '',
+    initial: '',
+  });
   const webhook = { enabled: true };
   if (!isSkippableAnswer(domainRaw)) {
     webhook.domain = String(domainRaw).trim();
   }
-  const authPrompt = hasStoredSecret(SECRET_ACCOUNTS.webhookAuth)
-    ? 'Auth Token (stored, Enter=keep): '
-    : 'ngrok Auth Token [hidden]: ';
-  webhook.authtoken = (await io.askSecret(authPrompt)).trim();
+  if (secretsCapable) {
+    const authPrompt = hasStoredSecret(SECRET_ACCOUNTS.webhookAuth)
+      ? 'ngrok Auth Token (stored — leave empty to keep)'
+      : 'ngrok Auth Token';
+    webhook.authtoken = (await password(authPrompt)).trim();
+  } else {
+    io.say('• ngrok Auth Token: skipped (Linux keychain unavailable).');
+  }
   const secrets = {};
   updateSection('channels', (current) => mergeConfig(current, { webhook }, secrets));
-  io.say('• Inbound webhook receiver saved (channels.webhook enabled/domain; authtoken in keychain).');
+  io.say(secretsCapable
+    ? '• Inbound webhook receiver saved (channels.webhook enabled/domain; authtoken in keychain).'
+    : '• Inbound webhook receiver saved (channels.webhook enabled/domain; authtoken not collected).');
 }
 
-async function stepProviderKeys(io, { updateSection }) {
+async function stepProviderKeys(io, { updateSection, secretsCapable = true }) {
   io.say('\n── Step 4/9: Provider API keys ──');
-  io.say('Optional API keys (hidden). Enter to skip a provider.');
+  if (!secretsCapable) {
+    io.say('• Skipped provider API keys (Linux keychain unavailable).');
+    return;
+  }
+  io.say('Optional API keys (hidden). Pick providers to configure.');
+  const providerOpts = AG_API_PROVIDERS.map((p) => ({
+    value: p.id,
+    label: p.name,
+    hint: p.env,
+  }));
+  const selectedIds = await multiselect('Which provider API keys to set?', providerOpts, { min: 0 });
   const providers = {};
-  for (const p of AG_API_PROVIDERS) {
-    const key = (await io.askSecret(`${p.name} API key (${p.env}, Enter=skip): `)).trim();
+  for (const p of AG_API_PROVIDERS.filter((x) => selectedIds.includes(x.id))) {
+    const key = (await password(`${p.name} API key (${p.env})`)).trim();
     if (!isSkippableAnswer(key)) {
       providers[p.id] = { apiKey: key, enabled: true };
     }
@@ -388,13 +432,8 @@ async function stepPresets(io, { readSection, updateSection, DEFAULT_PRESETS })
   if (existing.length > 0) {
     io.say(`Current presets: ${existing.join(', ')}`);
   }
-  const raw = await io.ask('Install default Mixdog presets? [y/N] (Enter=skip): ');
-  if (isSkippableAnswer(raw)) {
-    io.say('• Kept existing presets.');
-    return;
-  }
-  const a = String(raw).trim().toLowerCase();
-  if (a !== 'y' && a !== 'yes') {
+  const installDefaults = await confirm('Install default Mixdog presets?', { initial: false });
+  if (!installDefaults) {
     io.say('• Kept existing presets.');
     return;
   }
@@ -422,9 +461,15 @@ async function stepRolePresetMapping(io, { readSection, dataDir }) {
   const byName = new Map(roles.map((r) => [r.name, r]));
   for (const roleName of WORKFLOW_ROLES) {
     const cur = byName.get(roleName)?.preset || DEFAULT_USER_WORKFLOW.roles.find((r) => r.name === roleName)?.preset || '';
-    const raw = await io.ask(`Preset for role "${roleName}" [${cur}]: `);
-    if (isSkippableAnswer(raw)) continue;
-    const preset = String(raw).trim();
+    const options = [
+      { value: '__keep__', label: `Keep current${cur ? ` (${cur})` : ''}` },
+      ...presetIds.map((id) => ({ value: id, label: id })),
+    ];
+    const chosen = await select(`Preset for role "${roleName}"`, options, {
+      initial: cur && presetIds.includes(cur) ? cur : '__keep__',
+    });
+    if (chosen === '__keep__') continue;
+    const preset = String(chosen).trim();
     if (!presetIds.includes(preset)) {
       io.say(`  ! Unknown preset "${preset}" — left "${roleName}" unchanged.`);
       continue;
@@ -449,28 +494,25 @@ function resolveSearchBackendInput(raw) {
   return SEARCH_OAUTH_ALIASES[key] || null;
 }
 
-function parseYesNo(raw) {
-  if (isSkippableAnswer(raw)) return null;
-  const v = String(raw).trim().toLowerCase();
-  if (v === 'y' || v === 'yes' || v === 'true' || v === '1') return true;
-  if (v === 'n' || v === 'no' || v === 'false' || v === '0') return false;
-  return undefined;
-}
-
 /** Mirrors POST /search/config → mergeSearchConfig. */
-export async function stepSearchBackend(io, { updateSection, readSection }) {
+export async function stepSearchBackend(io, { updateSection, readSection, secretsCapable = true }) {
   io.say('\n── Step 7/9: Search backend ──');
   io.say('Active provider: anthropic-oauth | openai-oauth | grok-oauth (OAuth — uses Agent credentials).');
   const { hasStoredSecret, SECRET_ACCOUNTS, getSearchApiKey } = await import('../src/shared/config.mjs');
   const search = readSection('search') || {};
   const curProvider = String(search.provider || 'anthropic-oauth').trim() || 'anthropic-oauth';
-  const backendRaw = await io.ask(`Search provider [${curProvider}]: `);
+  const providerOptions = [
+    { value: 'anthropic-oauth', label: 'anthropic-oauth', hint: 'Claude OAuth' },
+    { value: 'openai-oauth', label: 'openai-oauth', hint: 'OpenAI OAuth' },
+    { value: 'grok-oauth', label: 'grok-oauth', hint: 'xAI Grok OAuth' },
+  ];
+  const backendRaw = await select('Search provider', providerOptions, {
+    initial: SEARCH_OAUTH_PROVIDERS.has(curProvider) ? curProvider : 'anthropic-oauth',
+  });
   let provider = curProvider;
   if (!isSkippableAnswer(backendRaw)) {
-    const resolved = resolveSearchBackendInput(backendRaw);
-    if (!resolved) {
-      io.say(`  ! Unknown provider "${String(backendRaw).trim()}" — keeping ${curProvider}.`);
-    } else if (!SEARCH_OAUTH_PROVIDERS.has(resolved)) {
+    const resolved = resolveSearchBackendInput(backendRaw) || String(backendRaw).trim();
+    if (!SEARCH_OAUTH_PROVIDERS.has(resolved)) {
       io.say(`  ! Provider "${resolved}" is not a supported OAuth backend — keeping ${curProvider}.`);
     } else {
       provider = resolved;
@@ -481,15 +523,19 @@ export async function stepSearchBackend(io, { updateSection, readSection }) {
   if (provider !== curProvider) payload.provider = provider;
 
   const searchProviders = {};
-  for (const p of SEARCH_RAW_KEY_PROVIDERS) {
-    const hadKey = hasStoredSecret(SECRET_ACCOUNTS.searchApiKey(p.id));
-    const keyPrompt = hadKey
-      ? `${p.name} API key (stored, Enter=keep): `
-      : `${p.name} API key [hidden] (Enter=skip): `;
-    const key = (await io.askSecret(keyPrompt)).trim();
-    if (!isSkippableAnswer(key)) {
-      searchProviders[p.id] = key;
+  if (secretsCapable) {
+    for (const p of SEARCH_RAW_KEY_PROVIDERS) {
+      const hadKey = hasStoredSecret(SECRET_ACCOUNTS.searchApiKey(p.id));
+      const keyPrompt = hadKey
+        ? `${p.name} API key (stored — leave empty to keep)`
+        : `${p.name} API key (leave empty to skip)`;
+      const key = (await password(keyPrompt)).trim();
+      if (!isSkippableAnswer(key)) {
+        searchProviders[p.id] = key;
+      }
     }
+  } else {
+    io.say('• Search provider API keys: skipped (Linux keychain unavailable).');
   }
   if (Object.keys(searchProviders).length) payload.searchProviders = searchProviders;
 
@@ -497,14 +543,22 @@ export async function stepSearchBackend(io, { updateSection, readSection }) {
     const curModel = (search.models && search.models.openai)
       || DEFAULT_MODELS.openai
       || '';
-    const modelRaw = await io.ask(`OpenAI model [${curModel}] (Enter=keep): `);
+    const modelRaw = await text('OpenAI model', {
+      placeholder: curModel ? `${curModel} (Enter to keep)` : 'Enter to keep',
+      initial: '',
+    });
     if (!isSkippableAnswer(modelRaw)) {
       const model = String(modelRaw).trim();
       if (model) payload.models = { ...(payload.models || {}), openai: model };
     }
     const curEffort = String(search.modelOptions?.openai?.effort || 'medium').trim() || 'medium';
-    const effortRaw = await io.ask(`OpenAI effort (low/medium/high) [${curEffort}] (Enter=keep): `);
-    if (!isSkippableAnswer(effortRaw)) {
+    const effortRaw = await select('OpenAI effort', [
+      { value: '__keep__', label: `Keep current (${curEffort})` },
+      { value: 'low', label: 'low' },
+      { value: 'medium', label: 'medium' },
+      { value: 'high', label: 'high' },
+    ], { initial: '__keep__' });
+    if (!isSkippableAnswer(effortRaw) && effortRaw !== '__keep__') {
       const effort = String(effortRaw).trim().toLowerCase();
       if (!OPENAI_SEARCH_EFFORT_VALUES.has(effort)) {
         io.say(`  ! Unknown effort "${effortRaw.trim()}" — keeping ${curEffort}.`);
@@ -514,11 +568,11 @@ export async function stepSearchBackend(io, { updateSection, readSection }) {
       }
     }
     const curFast = !!search.modelOptions?.openai?.fast;
-    const fastRaw = await io.ask(`OpenAI Fast mode [${curFast ? 'y' : 'N'}] (y/N, Enter=keep): `);
-    const fastParsed = parseYesNo(fastRaw);
-    if (fastParsed === undefined && !isSkippableAnswer(fastRaw)) {
-      io.say('  ! Fast mode: answer y or n — keeping current.');
-    } else if (fastParsed !== null) {
+    const fastKeep = await confirm(`OpenAI Fast mode (current: ${curFast ? 'on' : 'off'}) — enable?`, {
+      initial: curFast,
+    });
+    const fastParsed = fastKeep === curFast ? null : fastKeep;
+    if (fastParsed !== null) {
       const base = payload.modelOptions?.openai || search.modelOptions?.openai || {};
       const openaiOpts = { ...base };
       if (fastParsed) openaiOpts.fast = true;
@@ -532,7 +586,10 @@ export async function stepSearchBackend(io, { updateSection, readSection }) {
     const curModel = (search.models && search.models.xai)
       || DEFAULT_MODELS.xai
       || '';
-    const modelRaw = await io.ask(`xAI model [${curModel}] (Enter=keep): `);
+    const modelRaw = await text('xAI model', {
+      placeholder: curModel ? `${curModel} (Enter to keep)` : 'Enter to keep',
+      initial: '',
+    });
     if (!isSkippableAnswer(modelRaw)) {
       const model = String(modelRaw).trim();
       if (model) payload.models = { ...(payload.models || {}), xai: model };
@@ -574,8 +631,14 @@ export async function stepExplorerPreset(io, { readSection, updateSection, DEFAU
   if (validIds.size > 0) {
     io.say(`Available presets: ${[...validIds].join(', ')}`);
   }
-  const raw = await io.ask(`Preset for explorer (explore tool) [${curExplore}]: `);
-  if (isSkippableAnswer(raw)) {
+  const exploreOptions = [
+    { value: '__keep__', label: `Keep current (${curExplore})` },
+    ...[...validIds].map((id) => ({ value: id, label: id })),
+  ];
+  const raw = await select('Preset for explorer (explore tool)', exploreOptions, {
+    initial: validIds.has(curExplore) ? curExplore : '__keep__',
+  });
+  if (raw === '__keep__' || isSkippableAnswer(raw)) {
     io.say(`• Explorer preset unchanged (${curExplore}).`);
     return;
   }
@@ -597,15 +660,21 @@ export async function stepExplorerPreset(io, { readSection, updateSection, DEFAU
  * @param {(prompt:string)=>Promise<string>} [ioOverride.ask]
  * @param {(prompt:string)=>Promise<string>} [ioOverride.askSecret]
  * @param {(line:string)=>void} [ioOverride.say]
+ * @param {object} [options]
+ * @param {boolean} [options.secretsCapable] — override Linux keytar preflight (tests).
  */
-export async function runSetupWizard(ioOverride = null) {
+export async function runSetupWizard(ioOverride = null, options = {}) {
   const io = ioOverride ? { ...defaultIo(), ...ioOverride } : defaultIo();
   if (!io.interactive) return { skipped: true };
 
+  const secretsCapable = options.secretsCapable ?? probeLinuxSecretsCapable();
+  if (!secretsCapable) io.say(linuxKeychainUnavailableMessage());
+
   io.say('\nMixdog setup wizard — configure before opening Claude Code.');
   io.say('Press Enter on any step to skip it.\n');
 
   const ctx = await loadConfigModules();
+  ctx.secretsCapable = secretsCapable;
   try {
     await stepAddressForm(io, ctx);
     const discordSaved = await stepDiscordToken(io, ctx);

package/src/agent/bridge-stall-watchdog.mjs

@@ -114,7 +114,7 @@ export function inspectBridgeEntry(entry, abortSeconds = DEFAULT_ABORT_S, now =
         return { verdict: 'stall', staleSeconds, stage, reason: 'tool-runtime-fallback', toolName: entry.lastToolCall || null };
     }
     if (stage === 'idle' || stage === 'done' || stage === 'error' || stage === 'cancelling') {
-        // Terminal stages never abort, but may need flush+hide after 120s (fix B).
+        // Terminal stages never abort, but may need flush+hide after the terminal-reap window (TERMINAL_REAP_MS, 1h) (fix B).
         const progressRef = entry.lastProgressAt || entry.doneAt || entry.updatedAt;
         if (progressRef && (now - progressRef) >= TERMINAL_REAP_MS) {
             return { verdict: 'terminal-reap', staleSeconds: Math.round((now - progressRef) / 1000), stage };
@@ -253,7 +253,7 @@ export function startBridgeStallWatchdog(params) {
         // alone only flips in-memory listHidden; the statusline aggregator
         // reads the on-disk JSON and keeps rendering a non-closed bridge worker
         // as idle until the store sweep. closeSession plants closed===true so
-        // the aggregator drops it immediately — one consistent 300s lifecycle.
+        // the aggregator drops it immediately — one consistent 1h lifecycle (TERMINAL_REAP_MS).
         if (res.verdict === 'terminal-reap' && !_reaped) {
             _reaped = true;
             const reapId = currentSessionId();

package/src/agent/index.mjs

@@ -441,14 +441,14 @@ function _cancelBridgeReap(sessionId) {
 // role/status filters and a brief flag mirror the legacy tool's shape, plus a
 // `tag` field resolved from the tag registry.
 function _bridgeListSessions(opts = {}) {
-  const sessions = listSessions();
+  const includeClosed = opts.includeClosed === true;
+  const sessions = listSessions({ includeClosed });
   if (sessions.length === 0) return 'No active sessions.';
   const now = Date.now();
   const brief = opts.brief !== false;
-  const includeClosed = opts.includeClosed === true;
   const roleFilter = typeof opts.role === 'string' && opts.role ? opts.role : null;
   const statusFilter = typeof opts.status === 'string' && opts.status ? opts.status : null;
-  let filtered = includeClosed ? sessions : sessions.filter((s) => s.closed !== true);
+  const filtered = sessions;
   if (filtered.length === 0) return 'No active sessions.';
   const rows = filtered.map((s) => {
     const runtime = getSessionRuntime(s.id);