mixdog 0.9.144 → 0.9.145

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.144",
+  "version": "0.9.145",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/prepare-native-assets.mjs

@@ -58,11 +58,24 @@ export async function prepareRequiredNativeAssets({
         return [name, join(target, fileName)];
       }),
     );
-    await rm(target, { recursive: true, force: true });
+    await rm(target, {
+      recursive: true,
+      force: true,
+      maxRetries: 8,
+      retryDelay: 100,
+    });
     await rename(stagedToolsDir, target);
     return Object.fromEntries(entries);
   } finally {
-    await rm(stagingRoot, { recursive: true, force: true });
+    // Antivirus and process scanners can briefly retain freshly copied .exe
+    // handles on Windows. Cleanup must not replace the installer's real error
+    // with a transient EBUSY from the staging directory.
+    await rm(stagingRoot, {
+      recursive: true,
+      force: true,
+      maxRetries: 8,
+      retryDelay: 100,
+    });
   }
 }
 

package/src/output-styles/common.md

@@ -7,32 +7,23 @@ partial: true
 
 ## Shared Output Format
 
-- Lead with the answer or action, then the context needed to understand it, then
-  lower-priority detail. Write for a person, not a console log: complete
-  sentences, explained terms, and a register matched to the reader's language,
-  tone, and apparent expertise.
-- Select content by the active depth variation before formatting it. Formatting
-  never restores information that variation discarded.
-- Choose the shape from the content and the reader. Markdown is available, not
-  mandatory; prose, bullets, numbered steps, headings, tables, and code may
-  combine in any way that makes this particular answer easier to read, and no
-  response shape is a default or a required mapping from question type.
-- Output renders as GitHub-flavored Markdown — tables, task lists, footnotes,
-  fenced code with a language tag, and `$$…$$` math — in a proportional-width
-  surface, so space-aligned columns and ASCII art never line up; use a real table
-  or a fenced block instead. Use tables only for short enumerable or quantitative
-  facts, and keep explanatory reasoning outside the cells.
-- Keep simple answers visually simple and add structure only where it creates
-  useful grouping, order, or contrast. Never produce an essay-shaped wall of
-  text, and never overcorrect into fragments, decorative emphasis, tiny headings,
+- Lead with the answer or action, then the context needed to understand it and
+  lower-priority detail. Use complete sentences and a register suited to the
+  reader.
+- Select content by the active depth variation before formatting it; omitted
+  content stays omitted.
+- Choose the shape from the content and the reader. Prose, lists, headings,
+  tables, and code may combine, and no response shape is a default. Output uses
+  GitHub-flavored Markdown with `$$…$$` math in a proportional-width surface;
+  use tables or fenced blocks instead of spacing. Use tables only for short
+  enumerable or quantitative facts, with explanation outside the cells.
+- Keep simple answers visually simple. Never produce an essay-shaped wall of
+  text or overcorrect into fragments, decorative emphasis, tiny headings,
   needless nesting, or a recurring template.
-- Give each paragraph or list item one idea and keep the flow linear, so the
-  reader builds meaning forward without re-parsing what came before.
-- Keep established facts separate from plausible inference. Never invent a
-  mechanism, value, or certainty to make an explanation feel complete, preserve
-  exact technical literals, and show code or file references only where their
-  exact form helps.
+- Give each paragraph or list item one idea and keep the flow linear.
+- Keep established facts separate from plausible inference. Never invent
+  certainty, preserve exact technical literals, and show references only where
+  useful.
 - State each material point once and stop when the request is covered. Do not
-  restate the request, close with a recap, or append an unrequested
-  recommendation, next step, or offer of help; no emojis, raw output dumps, or
-  narration of your own process unless asked.
+  restate the request, close with a recap, or append unrequested recommendations
+  or offers; avoid emojis, raw output dumps, and process narration unless asked.

package/src/output-styles/detailed.md

@@ -9,8 +9,8 @@ aliases: verbose, full
 
 Detailed — concrete explanation.
 
-- Retain: the answer plus every established explanatory layer that materially
-  improves understanding — mechanism, evidence, trade-offs, implications, and
-  useful examples. Deepen the requested subject rather than widening it.
-- Omit: speculation that fills an evidentiary gap, and any expansion into fixes,
-  recommendations, or adjacent lessons that were not requested.
+- Retain: the answer and every established layer that materially aids
+  understanding—mechanism, evidence, trade-offs, implications, and useful
+  examples. Deepen the subject rather than widening it.
+- Omit: unsupported speculation and unrequested fixes, recommendations, or
+  adjacent lessons.

package/src/output-styles/extreme-minimal.md

@@ -9,9 +9,8 @@ aliases: extreme, extreme-simple, one-line, mono
 
 Extreme minimal — final decision or answer.
 
-- Retain: only the final decision, result, or direct answer. For a cause
-  question, that is the highest-level cause, not its concrete causal chain.
-- Omit: every heading, label, list, explanation, supporting fact, scope, caveat,
-  recap, and follow-up, even when asked to explain or report.
-- Shape: one or two short sentences. Never pack discarded detail into a longer
-  sentence.
+- Retain: only the decision, result, or direct answer; for cause questions, only
+  the highest-level cause.
+- Omit: headings, labels, lists, explanation, evidence, scope, caveats, recap,
+  and follow-up, even when requested.
+- Shape: one or two short sentences; do not pack omitted detail into them.

package/src/output-styles/minimal.md

@@ -9,9 +9,7 @@ aliases: brief, short
 
 Minimal — conclusion and core cause.
 
-- Retain: the conclusion, the single core cause that determines it, one or two
-  decisive concrete facts that make the cause clear, and the immediate
-  consequence when it completes the answer. Stop before a full explanation.
-- Omit: secondary evidence, deployment state, unaffected scope, broader impact,
-  exceptions, remediation, and process, unless that category is the requested
-  answer.
+- Retain: the conclusion, determining cause, one or two decisive facts, and the
+  immediate consequence when needed.
+- Omit: secondary evidence, unaffected scope, broader impact, exceptions,
+  remediation, and process unless requested.

package/src/output-styles/simple.md

@@ -9,10 +9,7 @@ aliases: default, concise, handoff
 
 Simple — concise summary.
 
-- Retain: the main answer, the essential causal sequence, the strongest
-  supporting evidence, direct consequences, and any material scope or caveat.
-  Preserve enough context for the answer to stand on its own, and prefer a
-  complete explanation over compression that makes the reader infer a missing
-  step.
-- Omit: secondary evidence, exhaustive implementation detail, examples, edge
-  cases, adjacent implications, alternatives, and unrequested remediation.
+- Retain: the answer, core causal sequence, strongest evidence, direct
+  consequences, and material scope or caveat. Keep it self-contained.
+- Omit: secondary evidence, implementation detail, examples, edge cases,
+  adjacent implications, alternatives, and unrequested remediation.

package/src/rules/agent/00-common.md

@@ -1,7 +1,8 @@
 # Public Agent Constraints
 
-- Never touch git/Ship. Refuse `git add`/`commit`/`push`/`stash` with `git
-  operations deferred to Lead`.
+- Use `git` only for read-only repository evidence. Refuse Git mutations
+  including `add`/`commit`/`push`/`stash`, and Ship, with `git operations
+  deferred to Lead`.
 - `permission: read` agents use shell only for verification and never change
   state; other agents never use it to explore, install, or change state beyond
   the brief.

package/src/rules/lead/01-general.md

@@ -2,10 +2,9 @@
 
 - You are Mixdog, the coding-agent CLI/TUI assistant for multi-provider
   workflows; never generic OpenAI/ChatGPT.
-- Before the first tool call, state in one short sentence what you are about
-  to do; add a short update when you find something load-bearing, change
-  direction, or work a stretch without one. No direct names, honorifics,
-  headings, labels, or a colon before a tool call.
+- Before the first tool call, briefly state what you are about to do; add a
+  short update when you find something load-bearing, change direction, or
+  work a stretch without one. Do not use a colon before a tool call.
 - Confirm destructive/hard-to-reverse actions against explicit validated paths;
   never `~`, a root, or unresolved variables/globs; report material deletion
   recoverability.

package/src/rules/lead/02-persona.md

@@ -1,7 +1,6 @@
 # Persona
 
-You are a curious, thoughtful, and grounded collaborator with a distinct point
-of view. Your presence is warm, candid, and natural, with understated humor when
-it fits. Conversation with you feels attentive and alive rather than scripted,
-ingratiating, or performative. You are attentive to the user's linguistic and
-cultural context and level of expertise, without mimicry or stereotyping.
+You are a curious, grounded collaborator with a distinct point of view. Be warm,
+candid, natural, and attentive, with understated humor when it fits—never
+scripted, ingratiating, or performative. Respect the user's linguistic and
+cultural context without mimicry or stereotyping.

package/src/rules/shared/10-tool-workflow.md

@@ -14,8 +14,9 @@
   summary, overview, or enumeration is not a prerequisite when that operation's
   complete inputs are already known; if independently required, batch it with
   the detailed operation.
-- Never duplicate a facet, widen retrieval speculatively, or cap fanout; apply
-  one analysis to many targets as one parameterized call when supported.
+- Never duplicate a facet, widen retrieval speculatively, or arbitrarily omit
+  required fanout. Respect tool/schema limits; split only when necessary, and
+  apply one analysis to many targets as one parameterized call when supported.
 1. Determine the required outcome and missing information; requirements are
    not evidence.
 2. If needed, gather only missing information through Research or Exploration;

package/src/rules/shared/30-exploration.md

@@ -2,10 +2,8 @@
 
 - Use read-only means for inspection; never mutate to clear an obstacle or
   unexpected state. Preserve evidence before a required mutation can destroy it.
-- Ownership is exclusive: each evidence type has one owner, another tool's
-  ability to reach the same target is never an alternative route, and a
-  successful owner result closes that facet — only a different evidence type
-  routes elsewhere.
+- Ownership is exclusive: each evidence type has one owner;
+  a successful owner result closes that facet.
 - Route the missing evidence to its primary owner:
   repository state, history, or diff→`git`;
   exact symbol declaration, body, usage, or relation→`code_graph`;

package/src/rules/shared/70-delivery.md

@@ -2,4 +2,4 @@
 
 - Commit, push, release, and deployment happen only on the user's explicit
   request.
-- Every repository mutation→`git`.
+- Every Git operation→`git`; source-file edits stay with `edit`/`apply_patch`.

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -590,6 +590,9 @@ export function buildShellOutputTelemetryPayload({
         reduction_pct: commandOutputBytes > 0
             ? Math.round((1 - visibleBytes / commandOutputBytes) * 100)
             : null,
+        exit_code: Number.isInteger(telemetry?.exitCode) ? telemetry.exitCode : null,
+        signal: telemetry?.signal || null,
+        timed_out: telemetry?.timedOut === true,
         spilled: telemetry?.spilled === true,
         offloaded: offloaded === true,
     };

package/src/runtime/agent/orchestrator/session/evidence-union.mjs

@@ -167,6 +167,7 @@ function mutationBatch(toolCalls) {
         return name === 'apply_patch'
             || name === 'shell'
             || name === 'bash_session'
+            || name === 'git_stage'
             || (name === 'git' && gitCallMutates(call));
     });
 }

package/src/runtime/agent/orchestrator/session/evidence-union.test.mjs

@@ -141,6 +141,7 @@ test('apply_patch, shell, and mutating git batches invalidate all earlier eviden
     for (const [mutationName, mutationArgs] of [
         ['apply_patch', {}],
         ['shell', {}],
+        ['git_stage', { diff_id: 'diff_test', change_ids: ['chg_test'] }],
         ['git', { command: 'git commit -m test' }],
         ['git', { command: "git reflog delete 'HEAD@{1}'" }],
     ]) {

package/src/runtime/agent/orchestrator/session/loop/tool-classify.mjs

@@ -16,11 +16,11 @@ export function _isReadTool(name) {
 }
 export function _isMutationTool(name, args = null) {
     const n = String(_stripMcpPrefix(name) || '').toLowerCase();
-    return n === 'apply_patch' || n === 'edit' || (n === 'git' && gitCommandMutates(args));
+    return n === 'apply_patch' || n === 'edit' || n === 'git_stage' || (n === 'git' && gitCommandMutates(args));
 }
 export function _isGitMutationTool(name, args = null) {
     const n = String(_stripMcpPrefix(name) || '').toLowerCase();
-    return n === 'git' && gitCommandMutates(args);
+    return n === 'git_stage' || (n === 'git' && gitCommandMutates(args));
 }
 export function _isEditTool(name) {
     return String(_stripMcpPrefix(name) || '').toLowerCase() === 'edit';

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -55,6 +55,7 @@ const SESSION_ROUTE_TOOL_ORDER = [
     'edit',
     'apply_patch',
     'git',
+    'git_stage',
     'shell',
     'task',
     'web_search',
@@ -137,6 +138,7 @@ const AGENT_STRING_PERMISSION_READ_WRITE_ALLOW = Object.freeze([
     'edit',
     'apply_patch',
     'git',
+    'git_stage',
     'shell',
     'task',
     'web_search',
@@ -284,7 +286,7 @@ function _computeBaseTools(toolSpec, mcp, skillTools, { ownerIsAgentSession = fa
                     addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'shell' || t.name === 'task'));
                     break;
                 case 'tools:git':
-                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'git' || t.name === 'shell' || t.name === 'task'));
+                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'git' || t.name === 'git_stage' || t.name === 'shell' || t.name === 'task'));
                     break;
                 case 'tools:mcp':
                     addMany(mcp);

package/src/runtime/agent/orchestrator/session/provider-prefix-guard.mjs

@@ -39,12 +39,6 @@ export function prepareProviderPrefixGuard(previous, messages, requestPrefix, op
     const next = snapshot(Array.isArray(messages) ? messages : [], requestPrefix);
     if (!previous || isCompactionPrefixReset(options.cacheBreakIntent)) return next;
 
-    if (previous.requestPrefixHash !== next.requestPrefixHash) {
-        throw new ProviderPrefixMutationError('provider request prefix changed outside compaction', {
-            provider: options.provider || null,
-            kind: 'request_prefix',
-        });
-    }
     if (next.messageHashes.length < previous.messageHashes.length) {
         throw new ProviderPrefixMutationError('provider message history shrank outside compaction', {
             provider: options.provider || null,
@@ -59,5 +53,11 @@ export function prepareProviderPrefixGuard(previous, messages, requestPrefix, op
             index,
         });
     }
+    if (previous.requestPrefixHash !== next.requestPrefixHash) {
+        // Tool schemas are request metadata, not durable conversation state.
+        // App updates may change them between turns, so rebaseline the provider
+        // cache prefix after the transcript itself has passed integrity checks.
+        return next;
+    }
     return next;
 }

package/src/runtime/agent/orchestrator/session/provider-prefix-guard.test.mjs

@@ -40,7 +40,7 @@ test('accepts append-only provider history for every provider surface', () => {
     }
 });
 
-test('rejects prior-message and tool-prefix rewrites outside compaction', () => {
+test('rejects prior-message rewrites outside compaction', () => {
     const first = prepareProviderPrefixGuard(
         null,
         [{ role: 'user', content: 'one' }],
@@ -54,10 +54,32 @@ test('rejects prior-message and tool-prefix rewrites outside compaction', () =>
         ),
         ProviderPrefixMutationError,
     );
+});
+
+test('rebaselines tool-prefix changes while preserving transcript integrity checks', () => {
+    const first = prepareProviderPrefixGuard(
+        null,
+        [{ role: 'user', content: 'one' }],
+        { tools: [{ name: 'read' }], nativeTools: [] },
+    );
+    const changed = prepareProviderPrefixGuard(
+        first,
+        [{ role: 'user', content: 'one' }],
+        { tools: [{ name: 'read' }, { name: 'shell' }], nativeTools: [] },
+    );
+    assert.notEqual(changed.requestPrefixHash, first.requestPrefixHash);
+    assert.doesNotThrow(() => prepareProviderPrefixGuard(
+        changed,
+        [
+            { role: 'user', content: 'one' },
+            { role: 'assistant', content: 'two' },
+        ],
+        { tools: [{ name: 'read' }, { name: 'shell' }], nativeTools: [] },
+    ));
     assert.throws(
         () => prepareProviderPrefixGuard(
-            first,
-            [{ role: 'user', content: 'one' }],
+            changed,
+            [{ role: 'user', content: 'rewritten' }],
             { tools: [{ name: 'read' }, { name: 'shell' }], nativeTools: [] },
         ),
         ProviderPrefixMutationError,

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -802,10 +802,10 @@ function guardGlob(a) {
     }
     for (const k of globPatternKeys) {
         if (hasOwn(a, k)) a[k] = coercePatternStringValues(a[k]);
-        if (hasOwn(a, k) && !isString(a[k])) {
-            return `Error: glob arg "${k}" must be string (got ${describeType(a[k])})`;
+        if (hasOwn(a, k) && !isStringOrStringArray(a[k])) {
+            return `Error: glob arg "${k}" must be string or string[] (got ${describeType(a[k])})`;
         }
-        if (hasOwn(a, k) && a[k].trim().length === 0) {
+        if (hasOwn(a, k) && typeof a[k] === 'string' && a[k].trim().length === 0) {
             return `Error: glob arg "${k}" must be a non-empty string`;
         }
     }

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -5,7 +5,7 @@
 // behavior, argument shapes, and the usage boundaries that only apply to that
 // tool; cross-tool policy lives in rules/shared/*.md.
 // Platform-specific command syntax belongs next to the command argument.
-import { GIT_TOOL_DEF } from './git-command-tool.mjs';
+import { GIT_STAGE_TOOL_DEF, GIT_TOOL_DEF } from './git-command-tool.mjs';
 import { SHELL_MONITOR_INTERVAL_MAX_MS } from './shell-monitor.mjs';
 const _shellSyntaxCheat =
     process.platform === 'win32'
@@ -81,7 +81,7 @@ export const BUILTIN_TOOLS = [
         name: 'shell',
         title: 'Shell',
         annotations: { title: 'Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: `Run programs, runtime/state operations, calculations, transformations, file generation, and unsupported-format inspection. ${_shellToolRouting} Avoid file operations covered by dedicated tools unless explicitly instructed or after verifying that a dedicated tool cannot do the job. An already-open shell is never a reason to route work to it. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'Commands use a 10s foreground window by default—not a timeout. Still-running work continues as a tracked task_id and completes by notification. Use task monitor only after promotion when periodic progress is needed, task read for an extra current snapshot, and never poll in a loop.'}`,
+        description: `Run programs, runtime/state operations, calculations, transformations, file generation, and unsupported-format inspection. ${_shellToolRouting} Avoid file operations covered by dedicated tools unless explicitly instructed or after verifying that a dedicated tool cannot do the job. An already-open shell is never a reason to route work to it. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'Commands use a 10s foreground window by default—not a timeout. Still-running work continues as a tracked task_id. Completion is automatic; do not poll with task read/monitor unless the user explicitly requests polling or periodic progress. Otherwise, use task read only for an immediate decision and task monitor only for explicitly requested periodic progress.'}`,
         inputSchema: {
             type: 'object',
             properties: {
@@ -97,11 +97,12 @@ export const BUILTIN_TOOLS = [
         },
     },
     GIT_TOOL_DEF,
+    GIT_STAGE_TOOL_DEF,
     {
         name: 'task',
         title: 'Task',
         annotations: { title: 'Task', readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
-        description: 'List shell tasks, read one current output snapshot, change periodic monitoring, or cancel by task_id. Call it only when a snapshot must drive a decision; never poll in a loop — completion always arrives by notification.',
+        description: 'List shell tasks, read one current snapshot, change periodic monitoring, or cancel by task_id. Completion is automatic; do not poll with read/monitor unless the user explicitly requests polling or periodic progress. Otherwise, use read only for an immediate decision and monitor only for explicitly requested periodic progress.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -157,7 +158,11 @@ export const BUILTIN_TOOLS = [
             type: 'object',
             properties: {
                 pattern: {
-                    type: 'string',                    description: 'Glob.',
+                    anyOf: [
+                        { type: 'string' },
+                        { type: 'array', items: { type: 'string' }, maxItems: 10 },
+                    ],
+                    description: 'Glob or array of globs (max 10).',
                 },
                 path: {
                     type: 'string',                    description: 'Known existing base directory; omit for the current Project; unknown location → find.',

package/src/runtime/agent/orchestrator/tools/builtin/git-command-policy.test.mjs

@@ -23,5 +23,8 @@ test('git mutation policy is shared by orchestration and evidence projection', (
         assert.equal(_isGitMutationTool('git', { command }), true, command);
     }
     assert.equal(gitCommandMutates({ command: 'git status && git clean -fd' }), true);
+    const stage = { diff_id: 'diff_test', change_ids: ['chg_test'] };
+    assert.equal(_isMutationTool('git_stage', stage), true);
+    assert.equal(_isGitMutationTool('git_stage', stage), true);
     assert.equal(_isMutationTool('apply_patch', {}), true);
 });