mixdog 0.9.17 → 0.9.18

package/scripts/smoke-runtime-negative.ps1

@@ -1,106 +1,106 @@
-# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
-# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
-# boot, double-init refusal, hostile-env survival.
-#
-# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
-
-$ErrorActionPreference = 'Stop'
-
-$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
-$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
-$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
-$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
-$PgVer       = '16.4'
-$PgvectorVer = '0.8.2'
-
-$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
-$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
-
-$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
-
-try {
-    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
-
-    Write-Host "==> Test 1: HEAD reaches release asset"
-    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
-    Write-Host "  HTTP $($resp.StatusCode)"
-
-    Write-Host "==> Test 2: full download + sha256"
-    $TarPath = Join-Path $Work $Asset
-    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
-    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
-    Write-Host "  sha256=$sha"
-
-    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
-    $CorruptPath = "$Work\corrupt.tar.gz"
-    Copy-Item $TarPath $CorruptPath
-    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
-    $stream = [System.IO.File]::OpenWrite($CorruptPath)
-    $stream.Position = 102400
-    $stream.Write($bytes, 0, 1)
-    $stream.Close()
-    $CorruptDir = "$Work\corrupt"
-    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
-    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
-    if (-not $TarProc.WaitForExit(15000)) {
-        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
-        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
-    } elseif ($TarProc.ExitCode -eq 0) {
-        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
-    } else {
-        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
-    }
-
-    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
-    $FreshDir = "$Work\fresh"
-    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
-    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
-    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
-
-    $PgBin   = "$FreshDir\bin"
-    $Data    = "$FreshDir\pgdata"
-    $Log     = "$FreshDir\pg.log"
-    $Port    = 55897
-
-    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
-    $SavedPath = $env:PATH
-    $SavedPgRoot = $env:PGROOT
-    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
-    $env:PGROOT = $null
-    $env:PGDATA = $null
-
-    try {
-        & "$PgBin\postgres.exe" --version
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
-        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
-        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
-        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
-
-        try {
-            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
-            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
-            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
-            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
-            Write-Host "  PASS: fresh-extract boot + vector extension"
-        } finally {
-            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
-        }
-
-        Write-Host "==> Test 5: second initdb on initialized dir refused"
-        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
-        if ($rc -eq 0) {
-            Write-Host "  WARN: second initdb succeeded (unexpected)"
-        } else {
-            Write-Host "  PASS: second initdb refused (exit $rc)"
-        }
-    } finally {
-        $env:PATH   = $SavedPath
-        $env:PGROOT = $SavedPgRoot
-    }
-
-    Write-Host "==> All negative-path smokes: PASS"
-}
-finally {
-    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
-}
+# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
+# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
+# boot, double-init refusal, hostile-env survival.
+#
+# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
+
+$ErrorActionPreference = 'Stop'
+
+$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
+$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
+$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
+$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
+$PgVer       = '16.4'
+$PgvectorVer = '0.8.2'
+
+$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
+$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
+
+$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
+
+try {
+    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
+
+    Write-Host "==> Test 1: HEAD reaches release asset"
+    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
+    Write-Host "  HTTP $($resp.StatusCode)"
+
+    Write-Host "==> Test 2: full download + sha256"
+    $TarPath = Join-Path $Work $Asset
+    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
+    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
+    Write-Host "  sha256=$sha"
+
+    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
+    $CorruptPath = "$Work\corrupt.tar.gz"
+    Copy-Item $TarPath $CorruptPath
+    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
+    $stream = [System.IO.File]::OpenWrite($CorruptPath)
+    $stream.Position = 102400
+    $stream.Write($bytes, 0, 1)
+    $stream.Close()
+    $CorruptDir = "$Work\corrupt"
+    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
+    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
+    if (-not $TarProc.WaitForExit(15000)) {
+        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
+        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
+    } elseif ($TarProc.ExitCode -eq 0) {
+        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
+    } else {
+        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
+    }
+
+    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
+    $FreshDir = "$Work\fresh"
+    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
+    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
+    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
+
+    $PgBin   = "$FreshDir\bin"
+    $Data    = "$FreshDir\pgdata"
+    $Log     = "$FreshDir\pg.log"
+    $Port    = 55897
+
+    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
+    $SavedPath = $env:PATH
+    $SavedPgRoot = $env:PGROOT
+    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
+    $env:PGROOT = $null
+    $env:PGDATA = $null
+
+    try {
+        & "$PgBin\postgres.exe" --version
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
+        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
+        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
+        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
+
+        try {
+            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
+            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
+            Write-Host "  PASS: fresh-extract boot + vector extension"
+        } finally {
+            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
+        }
+
+        Write-Host "==> Test 5: second initdb on initialized dir refused"
+        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
+        if ($rc -eq 0) {
+            Write-Host "  WARN: second initdb succeeded (unexpected)"
+        } else {
+            Write-Host "  PASS: second initdb refused (exit $rc)"
+        }
+    } finally {
+        $env:PATH   = $SavedPath
+        $env:PGROOT = $SavedPgRoot
+    }
+
+    Write-Host "==> All negative-path smokes: PASS"
+}
+finally {
+    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}

package/scripts/tool-efficiency-diag.mjs

@@ -85,4 +85,4 @@ for (const target of ['heavy-worker', 'worker']) {
   console.log(`  single-call batches: ${batch1}/${batchTot} (${pct(batch1, batchTot)}%)`);
   console.log(`  content greps with -C/-A/-B: ${grepContentWithCtx}/${grepContent} (${pct(grepContentWithCtx, grepContent)}%)  grep->read follow-ups: ${grepThenRead}`);
   console.log(`  same-path re-reads >=3x: ${rereads}`);
-}
+}

package/src/rules/lead/02-channels.md

@@ -1,3 +1,3 @@
-# Channels
-
-- Channel features are handled by the runtime.
+# Channels
+
+- Channel features are handled by the runtime.

package/src/runtime/channels/backends/discord-attachments.mjs

@@ -5,13 +5,13 @@ import { join, sep } from "path";
 
 const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 
-async function downloadSingleAttachment(att, inboxDir) {
+async function downloadSingleAttachment(att, inboxDir, { timeoutMs = 180_000 } = {}) {
   if (att.size > MAX_ATTACHMENT_BYTES) {
     throw new Error(
       `attachment too large: ${(att.size / 1024 / 1024).toFixed(1)}MB, max ${MAX_ATTACHMENT_BYTES / 1024 / 1024}MB`
     );
   }
-  const res = await fetch(att.url, { signal: AbortSignal.timeout(180_000) });
+  const res = await fetch(att.url, { signal: AbortSignal.timeout(timeoutMs) });
   if (!res.ok) {
     throw new Error(`attachment download failed: HTTP ${res.status}`);
   }

package/src/runtime/channels/backends/discord-gateway.mjs

@@ -212,13 +212,23 @@ async function awaitLogin(self) {
       resolve();
     });
   });
+  // Observe the ready timer from the start: login() can hang past the 30s
+  // timer (gateway reconnect), and a rejection on an un-awaited readyPromise
+  // becomes a process-global unhandledRejection → fatal crash path
+  // (channels/index.mjs unhandledRejection → _fatalCrash → exit(1)). Racing
+  // login with readyPromise keeps the rejection inside this connect() chain,
+  // which every caller already catches non-fatally.
+  const loginPromise = self.client.login(self.token);
+  // A late login settlement after the timeout raced ahead must not itself
+  // become a second unhandled rejection.
+  loginPromise.catch(() => {});
   try {
-    await self.client.login(self.token);
+    await Promise.race([loginPromise, readyPromise]);
+    await readyPromise;
   } catch (err) {
     clearTimeout(readyTimeout);
     throw err;
   }
-  await readyPromise;
 }
 
 export {

package/src/runtime/channels/backends/discord.mjs

@@ -23,6 +23,14 @@ import { normalizeAccess, safeAttName } from "./discord-access.mjs";
 import { MAX_ATTACHMENT_BYTES, downloadSingleAttachment } from "./discord-attachments.mjs";
 import * as gateway from "./discord-gateway.mjs";
 const MAX_CHUNK_LIMIT = MAX_DISCORD_MESSAGE;
+// Per-attempt cap for a single discord.js fetch/send. Without it a wedged
+// socket (network blip, "other side closed") leaves the await pending forever,
+// which upstream leaves the forwarder's `sending` flag stuck and silences all
+// outbound. On timeout we treat the client as dead and reset+reconnect it.
+const SEND_ATTEMPT_TIMEOUT_MS = 30_000;
+// After a timed-out send is reset, cap how long we wait for the original
+// (abandoned) promise to actually settle before giving up with unknown outcome.
+const SETTLE_CAP_MS = 15_000;
 const RECENT_SENT_CAP = 200;
 class DiscordBackend {
   name = "discord";
@@ -74,11 +82,57 @@ class DiscordBackend {
     if (this.client) this.client.destroy();
     this._connectPromise = null;
   }
+  // ── Self-heal helpers ──────────────────────────────────────────────
+  /** Race a discord.js op-promise against a per-attempt timeout so a wedged
+   *  socket can't hang the outbound path. On timeout the rejection carries
+   *  `_timeout` so the caller knows the underlying op is still in flight (and
+   *  must be settled/adopted, not blindly retried → duplicate). */
+  _withTimeout(promise, label) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        const e = new Error(`${label} timed out after ${SEND_ATTEMPT_TIMEOUT_MS}ms`);
+        e._timeout = true;
+        reject(e);
+      }, SEND_ATTEMPT_TIMEOUT_MS);
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+  }
+  /** True when an error means the client is dead (aborted, "other side
+   *  closed", or our per-attempt timeout) and must be reset+reconnected. */
+  _shouldResetClient(err) {
+    if (err?.name === "AbortError" || err?.code === "ABORT_ERR") return true;
+    const msg = String(err?.message || err || "").toLowerCase();
+    return msg.includes("aborted") || msg.includes("other side closed") ||
+      msg.includes("socket hang up") || msg.includes("econnreset") || msg.includes("timed out");
+  }
+  /** Destroy the wedged client and rebuild it via connect() so the next
+   *  fetch/send (and the forwarder's queue-head-preserving retry) hits a fresh
+   *  gateway/REST client. Serialized behind a single in-flight reset so
+   *  concurrent callers await the SAME reconnect instead of racing multiple
+   *  destroy()/login() cycles. */
+  async _resetClient() {
+    if (this._resetPromise) return this._resetPromise;
+    this._resetPromise = (async () => {
+      try { this.client?.destroy?.(); } catch {}
+      this.client = null;
+      this._connectPromise = null;
+      await this.connect();
+    })().finally(() => { this._resetPromise = null; });
+    return this._resetPromise;
+  }
+  /** Health-check the gateway; reset+reconnect if the ws is not READY. Called
+   *  by the owner re-claim self-heal path. (discord.js Status.Ready === 0) */
+  async healthCheck() {
+    if (this.client && this.client.ws?.status === 0) return;
+    await this._resetClient();
+  }
   resetSendCount() {
     this.sendCount = 0;
   }
   startTyping(channelId) {
     this.stopTyping(channelId);
+    if (!this.client) return;
     const ch = this.client.channels.cache.get(channelId);
     if (ch && "sendTyping" in ch) {
       void ch.sendTyping().catch(() => {
@@ -172,13 +226,38 @@ class DiscordBackend {
         // resumes at this chunk index instead of re-sending 0..i-1.
         let attempt = 0;
         for (;;) {
+          const sendPromise = ch.send(payload);
           try {
-            const sent = await ch.send(payload);
+            const sent = await this._withTimeout(sendPromise, "discord send");
             this.noteSent(sent.id);
             sentIds.push(sent.id);
             break;
           } catch (err) {
             attempt++;
+            if (err?._timeout) {
+              // Watchdog abandoned the send but the socket may still deliver.
+              // Destroy the client to tear down the in-flight REST socket so the
+              // ORIGINAL promise settles, then AWAIT + adopt its real outcome:
+              // delivered → done (no retry → no duplicate); else requeue against
+              // the fresh client via a resume token.
+              try { await this._resetClient(); } catch {}
+              // Cap the settlement wait: destroy() should abort the in-flight
+              // socket, but never hang here if it doesn't. On unknown outcome
+              // throw retryable (duplicate risk accepted over a permanent hang).
+              sendPromise.catch(() => {}); // swallow a late rejection
+              const settled = await Promise.race([
+                sendPromise.then((v) => ({ ok: true, v }), () => ({ ok: false })),
+                new Promise((r) => setTimeout(() => r({ ok: false }), SETTLE_CAP_MS))
+              ]);
+              if (settled.ok) {
+                this.noteSent(settled.v.id);
+                sentIds.push(settled.v.id);
+                break;
+              }
+              const e = err instanceof Error ? err : new Error(String(err));
+              e.resumeToken = { hash: contentHash, nextChunkIdx: i, sentIds: [...sentIds], prefixed: applyPrefix, limit };
+              throw e;
+            }
             const status = err?.status ?? err?.code ?? err?.httpStatus;
             // Classify: PERMANENT = a 4xx client error (unknown channel/message,
             // missing access/permissions, 404 …) that will never succeed on
@@ -192,7 +271,15 @@ class DiscordBackend {
               e.permanent = true;
               throw e;
             }
-            if (attempt >= 3) {
+            // Dead client (abort / "other side closed" / per-attempt timeout):
+            // destroy + reconnect so the forwarder's transient-retry path hits a
+            // fresh client, and throw a resume token now instead of burning the
+            // remaining attempts on a stale channel handle bound to the old client.
+            const dead = this._shouldResetClient(err);
+            if (dead) {
+              try { await this._resetClient(); } catch {}
+            }
+            if (dead || attempt >= 3) {
               // Attach an opaque resume token pointing at the chunk that failed
               // (i). sentIds holds every chunk already delivered (including any
               // seeded from a prior token).
@@ -301,13 +388,13 @@ class DiscordBackend {
     const msg = await ch.messages.fetch(messageId);
     await msg.delete();
   }
-  async downloadAttachment(chatId, messageId) {
+  async downloadAttachment(chatId, messageId, opts = {}) {
     const ch = await this.fetchAllowedChannel(chatId);
     const msg = await ch.messages.fetch(messageId);
     if (msg.attachments.size === 0) return [];
     const results = [];
     for (const att of msg.attachments.values()) {
-      const path = await this.downloadSingleAttachment(att);
+      const path = await this.downloadSingleAttachment(att, opts);
       results.push({
         id: att.id,
         path,
@@ -526,7 +613,10 @@ class DiscordBackend {
   }
   // ── Channel helpers ────────────────────────────────────────────────
   async fetchTextChannel(id) {
-    const ch = await this.client.channels.fetch(id);
+    if (!this.client) await this.connect();
+    const p = this.client.channels.fetch(id);
+    p.catch(() => {}); // if the watchdog wins, don't leak an unhandled rejection
+    const ch = await this._withTimeout(p, "discord channels.fetch");
     if (!ch || !ch.isTextBased()) {
       throw new Error(`channel ${id} not found or not text-based`);
     }
@@ -571,8 +661,8 @@ class DiscordBackend {
       throw new Error(`refusing to send channel state: ${f}`);
     }
   }
-  async downloadSingleAttachment(att) {
-    return downloadSingleAttachment(att, this.inboxDir);
+  async downloadSingleAttachment(att, opts = {}) {
+    return downloadSingleAttachment(att, this.inboxDir, opts);
   }
 }
 export {