mixdog 0.9.0 → 0.9.2

package/src/runtime/channels/lib/telegram-format.mjs

@@ -0,0 +1,283 @@
+// Telegram MarkdownV2 conversion — a faithful JS port of hermes-agent's
+// gateway/platforms/telegram.py (functions: _MDV2_ESCAPE_RE, _escape_mdv2,
+// _strip_mdv2, _TABLE_SEPARATOR_RE, _is_table_row, _split_markdown_table_row,
+// _render_table_block_for_telegram, _wrap_markdown_tables, and the 12-step
+// format_message pipeline). The Python behaviour is battle-tested; this port
+// keeps the same step order and the same table/header/blockquote decisions so
+// output matches the reference.
+//
+// Exported:
+//   toMarkdownV2(text)  — the main converter (port of format_message)
+//   stripMdV2(text)     — plain-text fallback (port of _strip_mdv2)
+//   escapeMdV2(text)    — raw escape helper (port of _escape_mdv2)
+//   isParseEntitiesError(err) — detect a MarkdownV2 400 parse failure
+
+// Matches every character MarkdownV2 requires to be backslash-escaped outside a
+// code span / fenced block. Port of _MDV2_ESCAPE_RE:
+//   Python: r'([_*\[\]()~`>#\+\-=|{}.!\\])'
+const MDV2_ESCAPE_RE = /([_*[\]()~`>#+\-=|{}.!\\])/g;
+
+/** Port of _escape_mdv2: backslash-escape all MarkdownV2 specials. */
+export function escapeMdV2(text) {
+  return String(text).replace(MDV2_ESCAPE_RE, "\\$1");
+}
+
+/**
+ * Port of _strip_mdv2: remove MarkdownV2 escape backslashes AND the entity
+ * markers format_message introduced, producing clean plain text for the
+ * parse-error fallback.
+ */
+export function stripMdV2(text) {
+  let cleaned = String(text);
+  // Remove escape backslashes before special characters.
+  cleaned = cleaned.replace(/\\([_*[\]()~`>#+\-=|{}.!\\])/g, "$1");
+  // Remove bold markers (*text* → text).
+  cleaned = cleaned.replace(/\*([^*]+)\*/g, "$1");
+  // Remove italic markers (_text_ → text). Word-boundary guards keep
+  // snake_case identifiers intact (mirrors the Python lookbehind/lookahead).
+  cleaned = cleaned.replace(/(^|\W)_([^_]+)_(?!\w)/g, "$1$2");
+  // Remove strikethrough markers (~text~ → text).
+  cleaned = cleaned.replace(/~([^~]+)~/g, "$1");
+  // Remove spoiler markers (||text|| → text).
+  cleaned = cleaned.replace(/\|\|([^|]+)\|\|/g, "$1");
+  return cleaned;
+}
+
+// ── Markdown table → Telegram-friendly row groups ──────────────────────────
+// Port of _TABLE_SEPARATOR_RE / _is_table_row / _split_markdown_table_row /
+// _render_table_block_for_telegram / _wrap_markdown_tables.
+
+// Python: r'^\s*\|?\s*:?-+:?\s*(?:\|\s*:?-+:?\s*){1,}\|?\s*$'
+const TABLE_SEPARATOR_RE = /^\s*\|?\s*:?-+:?\s*(?:\|\s*:?-+:?\s*){1,}\|?\s*$/;
+
+function isTableRow(line) {
+  const stripped = line.trim();
+  return !!stripped && stripped.includes("|");
+}
+
+function splitMarkdownTableRow(line) {
+  let stripped = line.trim();
+  if (stripped.startsWith("|")) stripped = stripped.slice(1);
+  if (stripped.endsWith("|")) stripped = stripped.slice(0, -1);
+  return stripped.split("|").map((cell) => cell.trim());
+}
+
+function renderTableBlockForTelegram(tableBlock) {
+  if (tableBlock.length < 3) return tableBlock.join("\n");
+
+  const headers = splitMarkdownTableRow(tableBlock[0]);
+  if (headers.length < 2) return tableBlock.join("\n");
+
+  // Row-label column present when data rows carry one more cell than headers.
+  const firstDataRow = tableBlock.length > 2 ? splitMarkdownTableRow(tableBlock[2]) : [];
+  const hasRowLabelCol = firstDataRow.length === headers.length + 1;
+
+  const renderedGroups = [];
+  for (let idx = 0; idx < tableBlock.length - 2; idx++) {
+    const row = tableBlock[idx + 2];
+    const cells = splitMarkdownTableRow(row);
+    let heading;
+    let dataCells;
+    if (hasRowLabelCol) {
+      heading = cells.length && cells[0] ? cells[0] : `Row ${idx + 1}`;
+      dataCells = cells.slice(1);
+    } else {
+      heading = cells.find((c) => c) ?? `Row ${idx + 1}`;
+      dataCells = cells.slice();
+    }
+    // Pad / trim dataCells to headers length.
+    if (dataCells.length < headers.length) {
+      dataCells = dataCells.concat(Array(headers.length - dataCells.length).fill(""));
+    } else if (dataCells.length > headers.length) {
+      dataCells = dataCells.slice(0, headers.length);
+    }
+    const bullets = [];
+    for (let c = 0; c < headers.length; c++) {
+      const value = dataCells[c];
+      // Skip a bullet that just duplicates the heading (no row-label column).
+      if (!hasRowLabelCol && value === heading) continue;
+      bullets.push(`• ${headers[c]}: ${value}`);
+    }
+    // The heading is emitted as `**heading**` markdown so step 5 (bold) of the
+    // main pipeline converts it — matches the Python ordering intentionally.
+    const groupLines = [`**${heading}**`, ...bullets];
+    renderedGroups.push(groupLines.join("\n"));
+  }
+  return renderedGroups.join("\n\n");
+}
+
+function wrapMarkdownTables(text) {
+  if (!text.includes("|") || !text.includes("-")) return text;
+  const lines = text.split("\n");
+  const out = [];
+  let inFence = false;
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const stripped = line.replace(/^\s+/, "");
+    // Track existing fenced code blocks — never touch content inside.
+    if (stripped.startsWith("```")) {
+      inFence = !inFence;
+      out.push(line);
+      i++;
+      continue;
+    }
+    if (inFence) {
+      out.push(line);
+      i++;
+      continue;
+    }
+    // Header row (contains '|') immediately followed by a delimiter row.
+    if (line.includes("|") && i + 1 < lines.length && TABLE_SEPARATOR_RE.test(lines[i + 1])) {
+      const tableBlock = [line, lines[i + 1]];
+      let j = i + 2;
+      while (j < lines.length && isTableRow(lines[j])) {
+        tableBlock.push(lines[j]);
+        j++;
+      }
+      out.push(renderTableBlockForTelegram(tableBlock));
+      i = j;
+      continue;
+    }
+    out.push(line);
+    i++;
+  }
+  return out.join("\n");
+}
+
+// ── Main converter — port of format_message (12-step placeholder pipeline) ──
+
+/**
+ * Convert standard/assistant markdown into Telegram MarkdownV2.
+ *
+ * Protected regions (fenced code, inline code, links) are stashed behind
+ * `\x00PH{n}\x00` placeholders BEFORE escaping so their interiors survive; the
+ * remaining text is converted to MarkdownV2 entities then fully escaped, and
+ * placeholders are restored in reverse insertion order.
+ */
+export function toMarkdownV2(content) {
+  if (!content) return content;
+
+  const placeholders = new Map();
+  let counter = 0;
+  const ph = (value) => {
+    const key = `\x00PH${counter}\x00`;
+    counter += 1;
+    placeholders.set(key, value);
+    return key;
+  };
+
+  let text = String(content);
+
+  // 0) Rewrite GFM pipe tables into Telegram-friendly row groups first.
+  text = wrapMarkdownTables(text);
+
+  // 1) Protect fenced code blocks (``` ... ```). Inside pre/code only \ and `
+  //    must be escaped per the MarkdownV2 spec.
+  text = text.replace(/(```(?:[^\n]*\n)?[\s\S]*?```)/g, (raw) => {
+    // Split off the opening ``` (+ optional language line) and closing ```.
+    const openEnd = raw.slice(3).includes("\n") ? raw.indexOf("\n") + 1 : 3;
+    const opening = raw.slice(0, openEnd);
+    const bodyAndClose = raw.slice(openEnd);
+    let body = bodyAndClose.slice(0, -3);
+    body = body.replace(/\\/g, "\\\\").replace(/`/g, "\\`");
+    return ph(opening + body + "```");
+  });
+
+  // 2) Protect inline code (`...`). Escape \ inside per spec.
+  text = text.replace(/(`[^`]+`)/g, (m) => ph(m.replace(/\\/g, "\\\\")));
+
+  // 3) Convert markdown links — escape display text; inside the URL only ')'
+  //    and '\' need escaping.
+  text = text.replace(/\[([^\]]+)\]\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g, (_m, display, url) => {
+    const d = escapeMdV2(display);
+    const u = url.replace(/\\/g, "\\\\").replace(/\)/g, "\\)");
+    return ph(`[${d}](${u})`);
+  });
+
+  // 4) Headers (## Title) → bold *Title* (MarkdownV2 has no headers).
+  text = text.replace(/^#{1,6}\s+(.+)$/gm, (_m, inner) => {
+    const stripped = inner.trim().replace(/\*\*(.+?)\*\*/g, "$1");
+    return ph(`*${escapeMdV2(stripped)}*`);
+  });
+
+  // 5) Bold: **text** → *text*.
+  text = text.replace(/\*\*(.+?)\*\*/g, (_m, inner) => ph(`*${escapeMdV2(inner)}*`));
+
+  // 6) Italic: *text* (single asterisk) → _text_. [^*\n]+ avoids matching
+  //    across newlines (which would corrupt * bullet lists / multi-line text).
+  text = text.replace(/\*([^*\n]+)\*/g, (_m, inner) => ph(`_${escapeMdV2(inner)}_`));
+
+  // 7) Strikethrough: ~~text~~ → ~text~.
+  text = text.replace(/~~(.+?)~~/g, (_m, inner) => ph(`~${escapeMdV2(inner)}~`));
+
+  // 8) Spoiler: ||text|| → ||text|| (protect from | escaping).
+  text = text.replace(/\|\|(.+?)\|\|/g, (_m, inner) => ph(`||${escapeMdV2(inner)}||`));
+
+  // 9) Blockquotes: line-leading >, >>, >>>, **>, **>> etc. Preserve the
+  //    prefix from escaping; an expandable quote (**> … ||) keeps a trailing ||.
+  text = text.replace(/^((?:\*\*)?>{1,3}) (.+)$/gm, (_m, prefix, quoteContent) => {
+    if (prefix.startsWith("**") && quoteContent.endsWith("||")) {
+      return ph(`${prefix} ${escapeMdV2(quoteContent.slice(0, -2))}||`);
+    }
+    return ph(`${prefix} ${escapeMdV2(quoteContent)}`);
+  });
+
+  // 10) Escape all remaining special characters in the plain text.
+  text = escapeMdV2(text);
+
+  // 11) Restore placeholders in REVERSE insertion order so a placeholder
+  //     nested inside another resolves correctly.
+  const keys = [...placeholders.keys()].reverse();
+  for (const key of keys) {
+    text = text.split(key).join(placeholders.get(key));
+  }
+
+  // 12) Safety net: escape bare ( ) { } that slipped past placeholder
+  //     processing, WITHOUT touching content inside code spans/blocks.
+  const codeSplit = text.split(/(```[\s\S]*?```|`[^`]+`)/g);
+  const safeParts = [];
+  for (let idx = 0; idx < codeSplit.length; idx++) {
+    const seg = codeSplit[idx];
+    if (idx % 2 === 1) {
+      // Inside a code span/block — leave untouched.
+      safeParts.push(seg);
+      continue;
+    }
+    safeParts.push(seg.replace(/[(){}]/g, (ch, s) => {
+      // Already escaped.
+      if (s > 0 && seg[s - 1] === "\\") return ch;
+      // '(' that opens a MarkdownV2 link [text](url).
+      if (ch === "(" && s > 0 && seg[s - 1] === "]") return ch;
+      // ')' that closes a link URL.
+      if (ch === ")") {
+        const before = seg.slice(0, s);
+        if (before.includes("](http") || before.includes("](")) {
+          let depth = 0;
+          for (let j = s - 1; j >= Math.max(s - 2000, 0); j--) {
+            if (seg[j] === "(") {
+              depth -= 1;
+              if (depth < 0) {
+                if (j > 0 && seg[j - 1] === "]") return ch;
+                break;
+              }
+            } else if (seg[j] === ")") {
+              depth += 1;
+            }
+          }
+        }
+      }
+      return "\\" + ch;
+    }));
+  }
+  text = safeParts.join("");
+
+  return text;
+}
+
+/** True when a Bot API error looks like a MarkdownV2 parse failure. */
+export function isParseEntitiesError(err) {
+  const status = err?.status;
+  const msg = err instanceof Error ? err.message : String(err ?? "");
+  return status === 400 && /can't parse entities|entities/i.test(msg);
+}

package/src/runtime/channels/lib/tool-format.mjs

@@ -42,7 +42,7 @@ function isMemoryFile(filePath) {
 function isHidden(name) {
   if (HIDDEN_TOOLS.has(name)) return true;
   if (formatToolSurface(name, {}).label === "Memory") return false;
-  if (name.includes("plugin_mixdog") && !name.endsWith("recall_memory") || name === "reply" || name === "react" || name === "edit_message" || name === "fetch" || name === "download_attachment") return true;
+  if (name === "reply" || name === "react" || name === "edit_message" || name === "fetch" || name === "download_attachment") return true;
   return false;
 }
 /**
@@ -116,7 +116,6 @@ export {
   HIDDEN_TOOLS,
   isRecallMemory,
   isMemoryFile,
-  isHidden,
   buildDedupKey,
   buildToolLine
 };

package/src/runtime/channels/lib/transcript-discovery.mjs

@@ -1,6 +1,5 @@
 import { readdirSync, existsSync, statSync } from "fs";
 import { basename, join, resolve } from "path";
-import { homedir } from "os";
 import {
   cwdToProjectSlug,
   discoverCurrentClaudeSession,
@@ -142,6 +141,25 @@ function candidateAffinity(candidate) {
 }
 const TRANSCRIPT_MTIME_DECISIVE_MS = 30_000;
 function compareTranscriptCandidates(left, right) {
+  // Identity beats recency. A live "parent-chain" candidate is the session
+  // that actually forked THIS owner worker (process.ppid walk) — it is the
+  // same session that receives injected input. When another co-located
+  // session (same cwd) writes its transcript more recently, the mtime rule
+  // below would otherwise hand the output-forwarder the wrong session's
+  // transcript: input lands in our window while output tails the sibling.
+  // Anchoring on the parent-chain session keeps forward output pinned to the
+  // owning session and lets it "steal back" the binding from a busier
+  // neighbour. Only decisive when exactly one side is the live self session;
+  // standalone remote (no parent session) falls through to the heuristics.
+  const leftSelf = Boolean(left.active && left.parentChain);
+  const rightSelf = Boolean(right.active && right.parentChain);
+  if (leftSelf !== rightSelf) return rightSelf ? 1 : -1;
+  // A live same-cwd session is a stronger ownership signal than an older
+  // transcript's mtime. The previous ordering let a stale-but-recent transcript
+  // keep winning after a remote runtime restart, so the output forwarder stayed
+  // bound to the old JSONL while inbound was delivered to the live session.
+  const affinityDiff = candidateAffinity(right) - candidateAffinity(left);
+  if (affinityDiff !== 0 && (left.active || right.active)) return affinityDiff;
   const leftMtime = Number(left.transcriptMtime) || 0;
   const rightMtime = Number(right.transcriptMtime) || 0;
   if (leftMtime > 0 && rightMtime > 0) {
@@ -149,7 +167,6 @@ function compareTranscriptCandidates(left, right) {
     if (mtimeDelta >= TRANSCRIPT_MTIME_DECISIVE_MS) return 1;
     if (-mtimeDelta >= TRANSCRIPT_MTIME_DECISIVE_MS) return -1;
   }
-  const affinityDiff = candidateAffinity(right) - candidateAffinity(left);
   if (affinityDiff !== 0) return affinityDiff;
   if (Number(right.exists) !== Number(left.exists)) return Number(right.exists) - Number(left.exists);
   if (right.transcriptMtime !== left.transcriptMtime) return right.transcriptMtime - left.transcriptMtime;
@@ -181,16 +198,8 @@ function discoverSessionBoundTranscript() {
 }
 
 export {
-  resolveTranscriptForSession,
   findLatestTranscriptByMtime,
-  isPidAlive,
   sameResolvedPath,
-  transcriptStat,
-  sessionTranscriptCandidate,
-  latestMtimeTranscriptCandidate,
-  candidateAffinity,
-  compareTranscriptCandidates,
   detectCurrentSessionTranscript,
-  discoverSessionBoundTranscript,
-  TRANSCRIPT_MTIME_DECISIVE_MS
+  discoverSessionBoundTranscript
 };

package/src/runtime/channels/lib/webhook.mjs

@@ -7,6 +7,7 @@ import { getWebhookAuthtoken } from "../../shared/config.mjs";
 import { appendFileSync, readFileSync, readdirSync, mkdirSync, writeFileSync, unlinkSync, existsSync, renameSync, watch as fsWatch } from "fs";
 import { appendFile } from "fs/promises";
 import { randomUUID } from "crypto";
+import { readMarkdownDocument } from "../../shared/markdown-frontmatter.mjs";
 const WEBHOOKS_DIR = join(DATA_DIR, "webhooks");
 const WEBHOOK_LOG = join(DATA_DIR, "webhook.log");
 let webhookLogBuffer = [];
@@ -101,15 +102,29 @@ function verifySignature(secret, rawBody, signatureValue, parser) {
 }
 
 // ── Endpoint config loader ─────────────────────────────────────────────
-// Reads DATA_DIR/webhooks/<name>/config.json (written by setup-server.mjs
-// via POST /webhooks). Cached in-memory, invalidated by fs.watch on the
-// webhooks directory. Returns { secret, parser, channel, mode, role }
-// where mode ∈ {"delegate","interactive"} and role names a user-workflow
-// entry (e.g. "reviewer") when mode=delegate.
+// Reads DATA_DIR/webhooks/<name>/WEBHOOK.md (written by setup-server.mjs
+// via POST /webhooks). The frontmatter IS the config object; the markdown
+// body is the instructions/prompt. Cached in-memory, invalidated by
+// fs.watch on the webhooks directory. Returns the frontmatter object
+// { secret, parser, channel, model, role, enabled } where routing is by
+// `channel` presence and `role` names a user-workflow entry when set.
 const _endpointCache = new Map();
 let _endpointWatcher = null;
 function _endpointConfigPath(name) {
-  return join(WEBHOOKS_DIR, name, "config.json");
+  return join(WEBHOOKS_DIR, name, "WEBHOOK.md");
+}
+// Per-endpoint HMAC secret is stored in a side file (WEBHOOKS_DIR/<name>/secret),
+// not in WEBHOOK.md frontmatter — frontmatter is a lossy `key: value` format
+// (unquote strips surrounding quotes) and would corrupt user secrets on the
+// save->rewrite round-trip. Read fresh on each verify (no cache): the signing
+// path is not hot and a stale secret would silently reject valid deliveries.
+function _readEndpointSecret(name) {
+  try {
+    const s = readFileSync(join(WEBHOOKS_DIR, name, "secret"), "utf8").trim();
+    return s || null;
+  } catch {
+    return null;
+  }
 }
 function _ensureEndpointWatcher() {
   if (_endpointWatcher) return;
@@ -117,7 +132,7 @@ function _ensureEndpointWatcher() {
     if (!existsSync(WEBHOOKS_DIR)) return;
     _endpointWatcher = fsWatch(WEBHOOKS_DIR, { recursive: true }, (_event, filename) => {
       if (!filename) { _endpointCache.clear(); return; }
-      // filename is like "<endpoint>/config.json" or "<endpoint>"
+      // filename is like "<endpoint>/WEBHOOK.md" or "<endpoint>"
       const parts = String(filename).split(/[\\/]/);
       const endpointName = parts[0];
       if (endpointName) _endpointCache.delete(endpointName);
@@ -138,7 +153,7 @@ function loadEndpointConfig(name) {
   if (!name) return null;
   // A cached entry is only authoritative while the fs.watch handle is
   // armed — otherwise a later mkdir+write of WEBHOOKS_DIR/<name>/
-  // config.json has no way to invalidate the cache and a stale `null`
+  // WEBHOOK.md has no way to invalidate the cache and a stale `null`
   // (e.g. captured before WEBHOOKS_DIR existed) would pin forever.
   if (_endpointCache.has(name) && _endpointWatcher) return _endpointCache.get(name);
   _ensureEndpointWatcher();
@@ -151,7 +166,14 @@ function loadEndpointConfig(name) {
     return null;
   }
   try {
-    const cfg = JSON.parse(readFileSync(p, "utf8"));
+    // Frontmatter is the config object; `enabled` arrives as a string and
+    // is cast so `endpoint?.enabled === false` gates match a written
+    // `enabled: false`.
+    const { frontmatter } = readMarkdownDocument(readFileSync(p, "utf8"));
+    const cfg = { ...frontmatter };
+    if (Object.prototype.hasOwnProperty.call(cfg, "enabled")) {
+      cfg.enabled = cfg.enabled !== "false" && cfg.enabled !== false;
+    }
     _endpointCache.set(name, cfg);
     return cfg;
   } catch {
@@ -631,7 +653,7 @@ class WebhookServer {
     }
     const _registeredPre = !!(
       _endpointPreCheck
-      || existsSync(join(WEBHOOKS_DIR, name, "instructions.md"))
+      || existsSync(join(WEBHOOKS_DIR, name, "WEBHOOK.md"))
     );
     if (!_registeredPre) {
       logWebhook(`rejected: unknown endpoint ${name}`);
@@ -707,7 +729,7 @@ class WebhookServer {
       // routing is reachable only through a registered endpoint.
       const _registered = !!(
         endpoint
-        || existsSync(join(WEBHOOKS_DIR, name, "instructions.md"))
+        || existsSync(join(WEBHOOKS_DIR, name, "WEBHOOK.md"))
       );
       if (!_registered) {
         logWebhook(`rejected: unknown endpoint ${name}`);
@@ -810,7 +832,11 @@ class WebhookServer {
   // Returns true when the request may proceed; otherwise writes the
   // appropriate 401/403 response and returns false.
   _verifySignatureGate(name, endpoint, body, headers, res) {
-    const secret = endpoint?.secret || this.config.secret;
+    // Per-endpoint secret lives in the side file WEBHOOKS_DIR/<name>/secret
+    // (plaintext, one line) — NOT in WEBHOOK.md frontmatter, so a user
+    // secret containing quotes/colons/newlines round-trips losslessly and
+    // setWebhookEnabled (which only rewrites WEBHOOK.md) cannot corrupt it.
+    const secret = _readEndpointSecret(name) || this.config.secret;
     const parser = endpoint?.parser || this.config.endpoints?.[name]?.parser;
     if (secret) {
       const signature = extractSignature(headers, parser);
@@ -836,18 +862,18 @@ class WebhookServer {
       res.end(JSON.stringify({ error: "webhook secret required for signed parser" }));
       return false;
     }
-    // instructions.md folder endpoint with no resolved signature
+    // WEBHOOK.md folder endpoint with no resolved signature
     // mode. handleWebhook's instructions.md branch enqueues the body as
     // an interactive prompt (or dispatches a delegate) — both are
     // privileged. With no per-endpoint secret/parser AND no global
     // secret/parser, there is no signature mode to fall back on, so
     // accepting the request would inject attacker-controlled input.
-    // Fail closed. (Endpoints that DO carry a config.json with a
+    // Fail closed. (Endpoints that DO carry a WEBHOOK.md with a
     // secret/parser are handled by the branches above.)
-    if (!secret && !parser && existsSync(join(WEBHOOKS_DIR, name, "instructions.md"))) {
-      logWebhook(`${name}: rejected (instructions.md endpoint requires a webhook secret)`);
+    if (!secret && !parser && existsSync(join(WEBHOOKS_DIR, name, "WEBHOOK.md"))) {
+      logWebhook(`${name}: rejected (WEBHOOK.md endpoint requires a webhook secret)`);
       res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "webhook secret required for instructions.md endpoint" }));
+      res.end(JSON.stringify({ error: "webhook secret required for WEBHOOK.md endpoint" }));
       return false;
     }
     if (!this.noSecretWarned) {
@@ -1139,21 +1165,24 @@ class WebhookServer {
   }
   // ── Webhook handler ───────────────────────────────────────────────
   _readFolderHandler(folderPath) {
-    const configPath = join(folderPath, "config.json");
+    const mdPath = join(folderPath, "WEBHOOK.md");
     // Routing by channel presence (no `mode` field): an endpoint WITH a
     // channel dispatches to the hidden webhook-handler role and reports to
     // that channel; an endpoint WITHOUT a channel injects into the current
     // (Lead) session. `channel` starts NULL so its absence is detectable;
     // `role` defaults to the mandatory webhook-handler for the direct path.
-    // The signature gate (below) fails closed on any instructions.md
+    // The signature gate (below) fails closed on any WEBHOOK.md
     // endpoint lacking a secret, so dropping `mode` does not weaken auth.
-    const handler = { channel: null, role: "webhook-handler", model: null };
-    if (existsSync(configPath)) {
+    // `instructions` carries the markdown body (the prompt) so callers read
+    // one file instead of a config.json + instructions.md pair.
+    const handler = { channel: null, role: "webhook-handler", model: null, instructions: "" };
+    if (existsSync(mdPath)) {
       try {
-        const cfg = JSON.parse(readFileSync(configPath, "utf8"));
-        if (cfg.channel) handler.channel = cfg.channel;
-        if (typeof cfg.role === "string" && cfg.role) handler.role = cfg.role;
-        if (typeof cfg.model === "string" && cfg.model) handler.model = cfg.model;
+        const { frontmatter, body } = readMarkdownDocument(readFileSync(mdPath, "utf8"));
+        if (frontmatter.channel) handler.channel = frontmatter.channel;
+        if (typeof frontmatter.role === "string" && frontmatter.role) handler.role = frontmatter.role;
+        if (typeof frontmatter.model === "string" && frontmatter.model) handler.model = frontmatter.model;
+        handler.instructions = String(body || "").trim();
       } catch {
       }
     }
@@ -1222,21 +1251,20 @@ ${payload}
   }
   handleWebhook(name, body, headers, res, deliveryId) {
     const folderPath = join(WEBHOOKS_DIR, name);
-    const instructionsPath = join(folderPath, "instructions.md");
-    if (existsSync(instructionsPath)) {
+    const mdPath = join(folderPath, "WEBHOOK.md");
+    if (existsSync(mdPath)) {
       try {
-        const instructions = readFileSync(instructionsPath, "utf8").trim();
-        const { channel, role, model } = this._readFolderHandler(folderPath);
+        const { channel, role, model, instructions } = this._readFolderHandler(folderPath);
         const payloadContent = this._buildFencedPayload(body, headers);
         if (channel) {
           if (!role) {
-            appendDelivery(name, { id: deliveryId, status: "failed", error: "delegate mode requires role in config.json" });
+            appendDelivery(name, { id: deliveryId, status: "failed", error: "delegate mode requires role in WEBHOOK.md" });
             logWebhook(`${name}: delegate mode requires role - rejected`);
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ status: "rejected", error: "delegate mode requires role" }));
             return;
           } else if (!model) {
-            appendDelivery(name, { id: deliveryId, status: "failed", error: "delegate mode requires model in config.json" });
+            appendDelivery(name, { id: deliveryId, status: "failed", error: "delegate mode requires model in WEBHOOK.md" });
             logWebhook(`${name}: delegate mode requires model - rejected`);
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ status: "rejected", error: "delegate mode requires model" }));

package/src/runtime/channels/tool-defs.mjs

@@ -167,7 +167,7 @@ export const TOOL_DEFS = [
       properties: {
         command: {
           type: "string",
-          enum: ["reload-plugins", "clear"],
+          enum: ["clear"],
           description: "Slash command."
         }
       },

package/src/runtime/lib/keychain-cjs.cjs

@@ -148,7 +148,6 @@ function loadKeytar() {
 // Avoids Atomics.wait on main thread (which hangs when SAB is not forwarded to worker).
 function keytarSync(method, ...args) {
     loadKeytar(); // throws if not installed — before spawning child
-    const { spawnSync } = require('child_process');
     // Pass service/account/value via env to avoid shell injection entirely.
     const env = {
         ...process.env,

package/src/runtime/memory/data/runtime-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "generated_at": "2026-06-11T13:16:44.033Z",
+  "generated_at": "2026-06-30T06:23:20.385Z",
   "release_tag": "runtime-v0.4.0",
   "pg": {
     "major": 16,
@@ -20,6 +20,11 @@
       "sha256": "8e39bfc3f06d88e9854946d5d83f7d77d9530f99284d7c1c51872c12f389f7e7",
       "size": 23687666
     },
+    "linux-arm64": {
+      "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-linux-arm64-pg16.4-pgvector0.8.2.tar.gz",
+      "sha256": "64ff170013b9543ad8843c98cbfe14019e6be6ea3d142ec189b2bea0dd1dc797",
+      "size": 22885036
+    },
     "linux-x64": {
       "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-linux-x64-pg16.4-pgvector0.8.2.tar.gz",
       "sha256": "28ee64125a0125ff36c47560c08ce8f38e49aef034c010c7e4867e8cdd783385",
@@ -29,12 +34,6 @@
       "url": "https://github.com/tribgames/mixdog/releases/download/runtime-v0.4.0/mixdog-runtime-win32-x64-pg16.4-pgvector0.8.2.tar.gz",
       "sha256": "6faed8a49b3303b0adb1c5715b2b19c5cc47df2e738d586d0d0bd432f1ca035d",
       "size": 44036958
-    },
-    "linux-arm64": {
-      "unsupported": true,
-      "url": "TBD",
-      "sha256": "TBD",
-      "size": 0
     }
   }
 }