mixdog 0.8.0 → 0.9.0

package/src/runtime/agent/orchestrator/dispatch-persist.mjs

@@ -266,7 +266,7 @@ export function addPending(dataDir, handle, tool, queries, callerSessionId, clie
 /**
  * Best-effort check: is there at least one non-expired in-flight dispatch
  * recorded for this dataDir? Used by the scheduler's idle-state probe so
- * background tasks stay suppressed while a bridge dispatch is still
+ * background tasks stay suppressed while an agent dispatch is still
  * running. Never throws.
  */
 export function hasPending(dataDir) {

package/src/runtime/agent/orchestrator/internal-roles.mjs

@@ -1,20 +1,17 @@
 /**
  * Internal hidden roles — Mixdog-managed, user-untouchable.
  *
- * Unlike user-workflow.json roles (which the user defines and edits freely),
- * these roles are NEVER exposed to callers of the `bridge` MCP tool. They are
+ * Unlike public workflow agents, these hidden roles are NEVER exposed to callers of the `agent` tool. They are
  * invoked only by internal handlers (explore / recall / search) and carry
  * their own system prompt + tool-set policy.
  *
- * Lookup order (bridge-llm.resolvePresetName):
+ * Lookup order (agent-dispatch.resolvePresetName):
  *   1. explicit preset arg
  *   2. opts.preset
- *   3. hidden-role registry (defaults/hidden-roles.json) <- Mixdog-internal
- *   4. user-workflow.json[role]                          ← user-owned
+ *   3. hidden-role registry (defaults/hidden-roles.json + systemFile frontmatter)
  *
- * Role definitions live in defaults/hidden-roles.json. Editing that file is a
- * Mixdog source change; users cannot break the dispatch path by touching their
- * workflow JSON.
+ * Role definitions live in defaults/hidden-roles.json and the referenced
+ * systemFile markdown frontmatter. Editing those files is a Mixdog source change.
  *
  * The preset names refer to entries seeded in mixdog-config.json (agent.presets)
  * via DEFAULT_PRESETS (see config.mjs). If the user deletes the referenced preset
@@ -28,41 +25,91 @@
  *                     webhook). Receive only their own self section in BP2.
  *
  * Permission classification:
- *   - 'read'       : read-only — write/edit/bash blocked at loop.mjs runtime
+ *   - 'read'       : read-only — apply_patch/shell blocked at loop.mjs runtime
  *                    guard with the same error string public read-only roles see.
  *   - 'read-write' : full tool surface — used by hidden roles that legitimately
  *                    mutate state (scheduler-task launches commands,
- *                    webhook-handler persists payloads). bridge-llm honors this
+ *                    webhook-handler persists payloads). agent-dispatch honors this
  *                    declaratively instead of forcing every hidden role to 'read'.
  *
  * Tool schema profile:
- *   - 'unified'         : shared bridge tool schema for provider cache reuse.
- *   - 'llm-only'        : no tools exposed; pure transform/classifier roles.
+ *   - 'none' : no tools exposed; pure transform/classifier roles.
+ *   - 'read' : read/search/code-navigation tools only.
+ *   - 'full' : shared agent tool schema for provider cache reuse.
  *
- * BP3 role-specific instruction metadata (consumed by rules-builder.cjs
- * buildBridgeRoleSpecificContent + collect.mjs):
+ * Role-specific instruction metadata (consumed by rules-builder.cjs
+ * buildAgentRoleSpecificContent + collect.mjs):
  *   - inboundEvent   : role reports results back to Lead and must carry the
- *                      skip-protocol rule (rules/bridge/20-skip-protocol.md)
- *                      in its BP2 catalog so no-op outputs opt out of the Lead
+ *                      skip-protocol rule (rules/agent/20-skip-protocol.md)
+ *                      in its BP2 role-rule block so no-op outputs opt out of the Lead
  *                      inject.
  *   - instructionDir : DATA_DIR subdir whose *.md tree is folded into the
- *                      role's BP3 role-specific block (webhook-handler →
+ *                      role's BP4-adjacent user/task data (webhook-handler →
  *                      webhooks, scheduler-task → schedules).
  */
 
 import { readFileSync, statSync } from 'fs'
 import { join } from 'path'
 import { mixdogRoot } from '../../shared/plugin-paths.mjs'
+import {
+  normalizeAgentPermissionOrNone,
+  parseMarkdownFrontmatter,
+} from '../../shared/markdown-frontmatter.mjs'
 
 // Resolve the path to defaults/hidden-roles.json once.
+const _MIXDOG_ROOT = mixdogRoot()
 const _HIDDEN_ROLES_PATH = (() => {
-  const root = mixdogRoot()
-  return join(root, 'defaults', 'hidden-roles.json')
+  return join(_MIXDOG_ROOT, 'defaults', 'hidden-roles.json')
 })()
 
 /** @type {{ mtime: number, map: object } | null} */
 let _hiddenRolesCache = null
 
+function _mtimeSafe(file) {
+  try { return statSync(file).mtimeMs } catch { return 0 }
+}
+
+function _hiddenRolesDependencyMtime() {
+  let mtime = _mtimeSafe(_HIDDEN_ROLES_PATH)
+  try {
+    const raw = JSON.parse(readFileSync(_HIDDEN_ROLES_PATH, 'utf8'))
+    for (const entry of (raw.roles || [])) {
+      const systemFile = typeof entry?.systemFile === 'string' ? entry.systemFile.trim() : ''
+      if (!systemFile) continue
+      mtime = Math.max(mtime, _mtimeSafe(join(_MIXDOG_ROOT, systemFile)))
+    }
+  } catch {}
+  return mtime
+}
+
+function _loadHiddenRoleFrontmatter(systemFile) {
+  const rel = typeof systemFile === 'string' ? systemFile.trim() : ''
+  if (!rel) return {}
+  try {
+    return parseMarkdownFrontmatter(readFileSync(join(_MIXDOG_ROOT, rel), 'utf8'))
+  } catch {
+    return {}
+  }
+}
+
+function _mergeHiddenRoleFrontmatter(entry) {
+  const fm = _loadHiddenRoleFrontmatter(entry.systemFile)
+  const merged = { ...entry }
+  const permission = normalizeAgentPermissionOrNone(fm.permission)
+  if (permission) merged.permission = permission
+  for (const key of ['toolSchemaProfile', 'kind', 'slot', 'maintKey', 'instructionDir']) {
+    if (typeof fm[key] === 'string' && fm[key].trim()) merged[key] = fm[key].trim()
+  }
+  for (const key of ['inboundEvent']) {
+    if (typeof fm[key] === 'string' && fm[key].trim()) {
+      const raw = fm[key].trim().toLowerCase()
+      if (raw === 'true') merged[key] = true
+      else if (raw === 'false') merged[key] = false
+    }
+  }
+  return merged
+}
+
 /**
  * Read and parse defaults/hidden-roles.json. Throws on missing/malformed.
  */
@@ -71,7 +118,7 @@ function _loadHiddenRoles() {
     const raw = JSON.parse(readFileSync(_HIDDEN_ROLES_PATH, 'utf8'))
     const map = Object.create(null)
     for (const entry of (raw.roles || [])) {
-      if (entry && entry.name) map[entry.name] = Object.freeze({ ...entry })
+      if (entry && entry.name) map[entry.name] = Object.freeze(_mergeHiddenRoleFrontmatter(entry))
     }
     return Object.freeze(map)
   } catch (err) {
@@ -88,7 +135,7 @@ function _loadHiddenRoles() {
  */
 function _getHiddenRoles() {
   try {
-    const mtime = statSync(_HIDDEN_ROLES_PATH).mtimeMs
+    const mtime = _hiddenRolesDependencyMtime()
     if (_hiddenRolesCache && mtime <= _hiddenRolesCache.mtime) {
       return _hiddenRolesCache.map
     }
@@ -114,10 +161,11 @@ export function getHiddenRole(name) {
 }
 
 /**
- * Resolve permission stamped on a bridge session. Hidden roles declared
+ * Resolve permission stamped on a agent session. Hidden roles declared
  * `permission: 'read'` are read-locked — caller opts cannot upgrade them.
+ * Other built-in permissions include `none`, `read-write`, `mcp`, and `full`.
  */
-export function resolveBridgeSessionPermission(role, callerPermission) {
+export function resolveAgentSessionPermission(role, callerPermission) {
   const hidden = getHiddenRole(role)
   if (hidden && hidden.permission === 'read') return 'read'
   if (callerPermission != null && callerPermission !== '') return callerPermission
@@ -126,7 +174,7 @@ export function resolveBridgeSessionPermission(role, callerPermission) {
 }
 
 /**
- * Boolean check — useful for branching inside bridge-llm / session-manager.
+ * Boolean check — useful for branching inside agent-dispatch / session-manager.
  */
 export function isHiddenRole(name) {
   if (!name) return false
@@ -143,7 +191,7 @@ export function listHiddenRoleNames() {
 
 /**
  * List hidden role names matching a given kind ('retrieval' | 'maintenance').
- * Consumed by collect.mjs to drive BP2 cache shard classification dynamically
+ * Consumed by collect.mjs to drive BP2 role-shard classification dynamically
  * instead of hard-coding role-name sets.
  */
 export function listHiddenRolesByKind(kind) {
@@ -168,7 +216,7 @@ export function getRoleCatalogShareAgents(name) {
 
 /**
  * True when a hidden role reports results back to Lead and must carry the
- * skip-protocol rule in its BP2 catalog. Replaces the hard-coded
+ * skip-protocol rule in its BP2 role-rule block. Replaces the hard-coded
  * INBOUND_EVENT_ROLES set in collect.mjs.
  */
 export function isInboundEventRole(name) {
@@ -177,9 +225,9 @@ export function isInboundEventRole(name) {
 }
 
 /**
- * Return the DATA_DIR subdir whose *.md tree folds into a role's BP3
- * role-specific block, or null when the role declares none. Replaces the
- * webhook/scheduler ternary in rules-builder.cjs buildBridgeRoleSpecificContent.
+ * Return the DATA_DIR subdir whose *.md tree rides as BP4-adjacent
+ * user/task data, or null when the role declares none. Replaces the
+ * webhook/scheduler ternary in rules-builder.cjs buildAgentRoleSpecificContent.
  */
 export function getRoleInstructionDir(name) {
   const hidden = getHiddenRole(name)

package/src/runtime/agent/orchestrator/internal-tools.mjs

@@ -1,5 +1,5 @@
 /**
- * Internal tool registry — in-process tools exposed to external LLMs via bridge.
+ * Internal tool registry — in-process tools exposed to external LLMs via the agent runtime.
  *
  * Populated by agent/index.mjs.handleToolCall when the server injects a
  * context carrying { toolExecutor, internalTools }. The executor dispatches
@@ -9,10 +9,10 @@
  * Orchestrator modules (session/manager.mjs, session/loop.mjs) import from
  * here instead of going through mcp/client.mjs for internal tools.
  *
- * Permission enforcement: bridge-worker tool calls (including internal tools)
- * are gated by _checkWorkerPermission() in session/loop.mjs BEFORE reaching
- * executeTool() → executeInternalTool(). No duplicate check is needed here;
- * the loop is the single enforcement point for all dispatch paths.
+ * Permission enforcement has been removed (every tool call is trusted). The
+ * only remaining dispatch-time gate is the architectural scoping in
+ * _preDispatchDeny() in session/loop.mjs (agent-worker control-plane reject +
+ * no-tool role guard) — not a permission check. No gating is needed here.
  */
 
 let _executor = null;
@@ -23,7 +23,6 @@ let _bootReady = false;
 let _bootResolver = null;
 const _bootPromise = new Promise((r) => { _bootResolver = r; });
 export function markBootReady() { if (_bootReady) return; _bootReady = true; _bootResolver(); }
-export async function awaitBootReady(timeoutMs = 2000) { if (_bootReady) return; await Promise.race([_bootPromise, new Promise((r) => setTimeout(r, timeoutMs))]); }
 
 // Per-tool executor overrides. Populated by addInternalTools() for extra
 // internal tools that bypass the main dispatch (tools.json + dispatchTool).

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -1,6 +1,3 @@
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -19,6 +16,7 @@ const AUTO_DETECT_PORTS = {
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 0;
 // --- State ---
 const servers = new Map();
+let mcpSdkPromise = null;
 // Memo for mcpToolHasField(name, field) — keyed by `${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
 // inspection) runs on every MCP tool invocation but its result only changes
@@ -33,6 +31,19 @@ function mcpLog(line) {
     if (process.env.MIXDOG_QUIET_MCP_LOG) return;
     process.stderr.write(line);
 }
+
+async function loadMcpSdk() {
+    mcpSdkPromise ??= Promise.all([
+        import('@modelcontextprotocol/sdk/client/index.js'),
+        import('@modelcontextprotocol/sdk/client/stdio.js'),
+        import('@modelcontextprotocol/sdk/client/streamableHttp.js'),
+    ]).then(([clientMod, stdioMod, httpMod]) => ({
+        Client: clientMod.Client,
+        StdioClientTransport: stdioMod.StdioClientTransport,
+        StreamableHTTPClientTransport: httpMod.StreamableHTTPClientTransport,
+    }));
+    return mcpSdkPromise;
+}
 // --- Public API ---
 /**
  * Connect to MCP servers defined in config.
@@ -253,7 +264,6 @@ export function mcpToolHasField(name, field) {
 /**
  * Disconnect all MCP servers.
  */
-export const drainMcpClients = disconnectAll;
 export async function disconnectAll() {
     for (const [name, server] of servers) {
         try {
@@ -264,12 +274,8 @@ export async function disconnectAll() {
     }
     _invalidateMcpToolFieldMemo();
 }
-/**
- * Load MCP server configs from a JSON file.
- * Supports both `{ mcpServers: { ... } }` and flat `{ name: { ... } }` format.
- */
-
 async function connectServer(name, cfg) {
+    const { Client, StdioClientTransport, StreamableHTTPClientTransport } = await loadMcpSdk();
     const client = new Client({ name: `mixdog-agent/${name}`, version: '1.0.0' });
     let transport;
     // Auto-detect: read port from a running service's port file

package/src/runtime/agent/orchestrator/providers/anthropic-betas.mjs

@@ -1,5 +1,7 @@
 export const EXTENDED_CACHE_TTL_BETA_HEADER = 'extended-cache-ttl-2025-04-11';
+export const INTERLEAVED_THINKING_BETA_HEADER = 'interleaved-thinking-2025-05-14';
 export const FAST_MODE_BETA_HEADER = 'fast-mode-2026-02-01';
+export const TOOL_SEARCH_BETA_HEADER = 'advanced-tool-use-2025-11-20';
 
 export function supportsAnthropicFastMode(model) {
     const id = String(model || '').toLowerCase().replace(/\./g, '-');
@@ -7,8 +9,9 @@ export function supportsAnthropicFastMode(model) {
 }
 
 export function buildAnthropicBetaHeaders({
-    base = EXTENDED_CACHE_TTL_BETA_HEADER,
+    base = `${INTERLEAVED_THINKING_BETA_HEADER},${EXTENDED_CACHE_TTL_BETA_HEADER}`,
     fastMode = false,
+    toolSearch = false,
 } = {}) {
     const headers = String(base || '')
         .split(',')
@@ -17,5 +20,8 @@ export function buildAnthropicBetaHeaders({
     if (fastMode && !headers.includes(FAST_MODE_BETA_HEADER)) {
         headers.push(FAST_MODE_BETA_HEADER);
     }
+    if (toolSearch && !headers.includes(TOOL_SEARCH_BETA_HEADER)) {
+        headers.push(TOOL_SEARCH_BETA_HEADER);
+    }
     return headers.join(',');
 }