mixdog 0.9.171 → 0.9.173

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -1,495 +1,52 @@
-import { loadConfig, createProvider } from './config.mjs';
-import { WebhookServer } from './webhook.mjs';
-import { EventPipeline } from './event-pipeline.mjs';
-import { startSnapshotWriter, stopSnapshotWriter } from './status-snapshot.mjs';
-import { initProviders } from '../../agent/orchestrator/providers/registry.mjs';
-import { loadConfig as loadAgentConfig } from '../../agent/orchestrator/config.mjs';
-import { refreshActiveInstance, releaseOwnedChannelLocks, clearActiveInstance } from './runtime-paths.mjs';
-// Owned-runtime lifecycle: bridge-ownership claim/refresh/loss, provider connect/disconnect,
-// scheduler + webhook/event runtime, owner heartbeat gating, and config
-// hot-reload. Owns its own in-flight flags + timers; shares config / provider /
-// bridgeRuntimeConnected / webhookServer / eventPipeline with the worker via
-// get/set so file-level reference semantics are preserved.
-export function createOwnedRuntime({
-  getConfig,
-  setConfig,
-  getProvider,
-  setProvider,
-  getBridgeRuntimeConnected,
-  setBridgeRuntimeConnected,
-  getWebhookServer,
-  setWebhookServer,
-  getEventPipeline,
-  setEventPipeline,
-  getChannelBridgeActive,
-  instanceId,
-  TERMINAL_LEAD_PID,
-  sendNotifyToParent,
-  scheduler,
-  statusState,
-  logOwnership,
-  currentOwnerState,
-  wireWebhookHandlers,
-  wireEventQueueHandlers,
-}) {
-  let bridgeRuntimeStarting = false;
-  let _ownedRuntimeStopRequested = false;
-  let bridgeOwnershipRefreshInFlight = null;
-  // Automation (scheduler + webhook server + relay tunnel) can outlive a
-  // failed/absent messaging provider: it is tracked separately so teardown and
-  // reload know it is running even while bridgeRuntimeConnected stays false.
-  let automationRunning = false;
-  let automationStartPromise = null;
-  // Promise that resolves when the current startOwnedRuntime() run fully
-  // settles (bridgeRuntimeStarting -> false). reloadRuntimeConfig awaits this
-  // before issuing a restart so a provider swap that lands mid-start is not
-  // dropped by startOwnedRuntime's in-flight guard (lost-restart race).
-  let _inFlightStart = null;
-  // Daemon model: the machine-global service (singleton-owner lock in
-  // src/standalone) guarantees exactly one runtime per machine, so this process
-  // is the unconditional bridge owner. The OS seat lock is retired — no takeover
-  // handler, no vacant-reacquire poll, no cross-process ownership-loss detection.
-  function clearBridgeOwnershipTimer() {
-    // No ownership timer under the daemon model; kept as a no-op so the worker
-    // teardown call site stays unchanged.
-  }
-  function shouldStartEventPipelineRuntime() {
-    return (
-      getConfig().webhook?.enabled === true ||
-      (Array.isArray(getConfig().events?.rules) && getConfig().events.rules.length > 0)
-    );
-  }
-  function ensureEventPipelineRuntime() {
-    if (!getEventPipeline()) {
-      setEventPipeline(new EventPipeline(getConfig().events, getConfig().channelId));
-      wireEventQueueHandlers(getEventPipeline().getQueue());
-    }
-    return getEventPipeline();
-  }
-  function ensureWebhookServerRuntime() {
-    if (!getWebhookServer()) {
-      setWebhookServer(new WebhookServer(getConfig().webhook));
-    }
-    wireWebhookHandlers();
-    return getWebhookServer();
-  }
-  async function stopWebhookAndEventRuntime() {
-    if (getWebhookServer()) {
-      await getWebhookServer().stop();
-      setWebhookServer(null);
-    }
-    if (getEventPipeline()) {
-      getEventPipeline().stop();
-      setEventPipeline(null);
-    }
-  }
-  function syncOwnedWebhookAndEventRuntime({ reload = false } = {}) {
-    if (shouldStartEventPipelineRuntime()) {
-      const pipeline = ensureEventPipelineRuntime();
-      if (reload) {
-        pipeline.reloadConfig(getConfig().events, getConfig().channelId);
-        wireEventQueueHandlers(pipeline.getQueue());
-      }
-      pipeline.start();
-    } else if (getEventPipeline()) {
-      getEventPipeline().stop();
-      setEventPipeline(null);
-    }
+// Owned-runtime lifecycle: provider connect/disconnect, automation runtime
+// (scheduler + webhook/event runtime), ownership refresh and config
+// hot-reload. The phases live under owned-runtime/ and share one explicit
+// state object; config / provider / bridgeRuntimeConnected / webhookServer /
+// eventPipeline stay on the worker (get/set) so file-level reference
+// semantics are preserved.
+import { createOwnedRuntimeState } from './owned-runtime/state.mjs';
+import { createAutomationServices } from './owned-runtime/automation-services.mjs';
+import { createAutomationStarter } from './owned-runtime/automation-start.mjs';
+import { createOwnedStarter } from './owned-runtime/owned-start.mjs';
+import { createOwnedStopper } from './owned-runtime/owned-stop.mjs';
+import { createOwnershipRefresh } from './owned-runtime/ownership-refresh.mjs';
+import { createConfigReloader } from './owned-runtime/config-reload.mjs';
 
-    if (getConfig().webhook?.enabled === true) {
-      const server = ensureWebhookServerRuntime();
-      if (reload) {
-        // server.reloadConfig is async (it awaits the current server's
-        // close() before re-listening). Chain start() onto its resolution
-        // so we don't race the bound port — calling start() synchronously
-        // here would re-listen before close() finishes and surface
-        // EADDRINUSE on the same port.
-        server
-          .reloadConfig(getConfig().webhook, {
-            autoStart: false,
-          })
-          .then(() => {
-            // A stopWebhookAndEventRuntime() / deactivate landing during the async
-            // close()+reload window nulls out getWebhookServer() (and webhook.enabled may
-            // have flipped off). Without this guard the resolved continuation would
-            // re-listen and resurrect an orphan listener that no teardown tracks.
-            if (getWebhookServer() !== server || getConfig().webhook?.enabled !== true) {
-              try {
-                server.stop();
-              } catch {}
-              return;
-            }
-            wireWebhookHandlers();
-            server.start();
-          })
-          .catch((err) => {
-            process.stderr.write(
-              `mixdog channels: webhook reload failed: ${err instanceof Error ? err.message : String(err)}\n`
-            );
-          });
-      } else {
-        server.start();
-      }
-    } else if (getWebhookServer()) {
-      getWebhookServer().stop();
-      setWebhookServer(null);
-    }
-  }
-  async function startAutomationRuntime() {
-    if (automationRunning) {
-      syncOwnedWebhookAndEventRuntime();
-      return;
-    }
-    if (automationStartPromise) return automationStartPromise;
-    if (!bridgeRuntimeStarting) _ownedRuntimeStopRequested = false;
-    const run = (async () => {
-      try {
-        const agentCfg = loadAgentConfig();
-        await initProviders(agentCfg.providers || {});
-      } catch (e) {
-        process.stderr.write(
-          `mixdog: initProviders failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`
-        );
-      }
-      if (_ownedRuntimeStopRequested) return;
-      scheduler.start();
-      startSnapshotWriter(scheduler);
-      syncOwnedWebhookAndEventRuntime();
-      automationRunning = true;
-      process.stderr.write('mixdog: automation runtime up without messaging provider\n');
-    })();
-    automationStartPromise = run;
-    try {
-      return await run;
-    } finally {
-      if (automationStartPromise === run) automationStartPromise = null;
-    }
-  }
-  let _ownedRuntimeSelfHealing = false;
-  // Explicit restore path for an already-connected owner. The 3s ownership tick
-  // must not run this implicitly: re-binding status on every tick can move the
-  // transcript cursor to EOF, and probing the gateway during Discord's own
-  // reconnect window can reset a healthy reconnect loop. Keep this for explicit
-  // activation/reload recovery only.
-  async function selfHealOwnedRuntime(options = {}) {
-    const shouldResetProvider = options.resetProvider === true;
-    if (!shouldResetProvider) return;
-    if (_ownedRuntimeSelfHealing) return;
-    _ownedRuntimeSelfHealing = true;
-    try {
-      if (typeof getProvider()?._resetClient === 'function') {
-        await getProvider()
-          ._resetClient()
-          .catch((e) => {
-            process.stderr.write(
-              `mixdog: self-heal getProvider() reset failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`
-            );
-          });
-      }
-    } finally {
-      _ownedRuntimeSelfHealing = false;
-    }
-  }
-  async function startOwnedRuntime(options = {}) {
-    if (getBridgeRuntimeConnected()) {
-      if (!bridgeRuntimeStarting) await selfHealOwnedRuntime(options);
-      return;
-    }
-    if (bridgeRuntimeStarting) return;
-    if (!getChannelBridgeActive()) return;
-    bridgeRuntimeStarting = true;
-    _ownedRuntimeStopRequested = false;
-    let _settleStart;
-    _inFlightStart = new Promise((r) => {
-      _settleStart = r;
-    });
-    const settleInFlightStart = () => {
-      bridgeRuntimeStarting = false;
-      _inFlightStart = null;
-      const done = _settleStart;
-      _settleStart = null;
-      done?.();
-    };
-    // Capture the getProvider() instance that THIS start operation will connect. A
-    // reloadRuntimeConfig() hot-swap can replace the global `getProvider()` while this
-    // start is still awaiting connect(); using the captured instance for both
-    // connect() and the bail-path disconnect() guarantees we tear down the
-    // getProvider() WE started (not the freshly-swapped one), closing the
-    // both-providers-live window.
-    const startingProvider = getProvider();
-    // Daemon model: this runtime is the singleton bridge owner (enforced by the
-    // standalone daemon's singleton-owner lock), so there is no seat to claim and
-    // no cross-process contender to back off from. Just advertise metadata
-    // (pg_*/channelId/... preserved inside refreshActiveInstance);
-    // active-instance.json is a pure advert. Wrapped so any throw resets
-    // bridgeRuntimeStarting.
-    try {
-      refreshActiveInstance(instanceId, { providerReady: false });
-    } catch (e) {
-      settleInFlightStart();
-      process.stderr.write(
-        `mixdog: pre-connect metadata advert aborted (${e instanceof Error ? e.message : String(e)})\n`
-      );
-      return;
-    }
-    // Re-check after each post-connect await so a stopOwnedRuntime() landing
-    // mid-start cannot be overridden by the resuming start (scheduler/snapshot/
-    // webhook/binding launches below would revive owner state after stop).
-    // Idempotent: stop's sync teardown already ran; re-running disconnect +
-    // teardown is safe and covers both the pre-connected window (stop could
-    // not disconnect an in-flight getProvider()) and the post-connected window
-    // (stop did disconnect; redo to be defensive).
-    const bailIfStopRequested = async () => {
-      if (!_ownedRuntimeStopRequested) return false;
-      try {
-        await startingProvider.disconnect();
-      } catch {}
-      try {
-        releaseOwnedChannelLocks(instanceId);
-      } catch {}
-      try {
-        clearActiveInstance(instanceId);
-      } catch {}
-      setBridgeRuntimeConnected(false);
-      _ownedRuntimeStopRequested = false;
-      return true;
-    };
-    // Await getProvider().connect() so callers (and bindingReady) only resolve after
-    // the Discord binding is real. Previously this was fire-and-forget and
-    // refreshBridgeOwnership returned immediately, letting bindingReady fire
-    // before getProvider() listeners were attached.
-    try {
-      await startingProvider.connect();
-      if (await bailIfStopRequested()) {
-        return;
-      }
-      // Advertise provider readiness (metadata advert).
-      try {
-        refreshActiveInstance(instanceId, { providerReady: true });
-      } catch {}
-      setBridgeRuntimeConnected(true);
-      // Fresh confirmed connection — tell the parent to flip remote ON. Reached
-      // ONLY on a not-connected -> connected transition (the top-of-fn
-      // early-return skips already-connected re-ticks), so this fires exactly once
-      // per connect and covers EVERY start path (boot + reload restart + activate).
-      // The parent's acquired handler is idempotent (no-op when already remote),
-      // so notifying post-connect — never pre-connect — means a connect FAILURE
-      // below leaves the parent non-remote instead of stuck remote-with-no-bridge
-      // (finding 2).
-      notifyRemoteAcquired();
-      // initProviders must complete before scheduler.start() — otherwise the
-      // scheduler's first fire can land before the registry is populated and
-      // return `Provider "<name>" not found or not enabled`. The previous
-      // fire-and-forget call let scheduler.start() race ahead of init.
-      try {
-        const agentCfg = loadAgentConfig();
-        await initProviders(agentCfg.providers || {});
-      } catch (e) {
-        process.stderr.write(
-          `mixdog: initProviders failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`
-        );
-      }
-      if (await bailIfStopRequested()) {
-        return;
-      }
-      // Reconnect after a degraded (automation-only) start must not double-arm
-      // the scheduler/snapshot timers; the webhook/event sync is idempotent.
-      if (!automationRunning) {
-        scheduler.start();
-        startSnapshotWriter(scheduler);
-      }
-      syncOwnedWebhookAndEventRuntime();
-      automationRunning = true;
-      process.stderr.write(`mixdog: running with ${getProvider().name} getProvider()\n`);
-      logOwnership(`active owner lead=${TERMINAL_LEAD_PID} pid=${process.pid}`);
-    } catch (e) {
-      process.stderr.write(
-        `mixdog: getProvider() connect failed (non-fatal, cycle1/MCP still up): ${e instanceof Error ? e.message : String(e)}\n`
-      );
-      // Roll back partial owner-side state advertised before connect() ran:
-      // disconnect the provider WE started (a post-connect startup step may have
-      // thrown while the gateway is live), then release the channel locks + clear
-      // the active-instance advert.
-      try {
-        await startingProvider.disconnect();
-      } catch {}
-      try {
-        releaseOwnedChannelLocks(instanceId);
-      } catch {}
-      try {
-        clearActiveInstance(instanceId);
-      } catch {}
-      // DEGRADED MODE (automation decoupling): a messaging connect failure —
-      // packaged runtime without discord.js, bad token, gateway outage — must
-      // not take schedules/webhooks down with it. Start the automation runtime
-      // anyway; sends stay dead (bridgeRuntimeConnected=false) but session
-      // runs, the webhook server, and the relay tunnel work.
-      if (!_ownedRuntimeStopRequested) {
-        if (automationRunning) {
-          // Already degraded-started by an earlier attempt; this run was only a
-          // messaging reconnect retry — the finally below settles the start.
-          return;
-        }
-        try {
-          await startAutomationRuntime();
-        } catch (e3) {
-          process.stderr.write(
-            `mixdog: degraded automation start failed: ${e3 instanceof Error ? e3.message : String(e3)}\n`
-          );
-        }
-      }
-    } finally {
-      settleInFlightStart();
-    }
-  }
-  async function stopOwnedRuntime(reason) {
-    // startOwnedRuntime() advertises owner HTTP/heartbeat/active-instance and
-    // claims channel locks BEFORE awaiting getProvider().connect(). If shutdown lands
-    // during that window (bridgeRuntimeStarting=true, getBridgeRuntimeConnected()
-    // still false) we still need to tear that partial state down — otherwise
-    // the port stays bound and active-instance.json stays stale.
-    if (!getBridgeRuntimeConnected() && !bridgeRuntimeStarting && !automationRunning && !automationStartPromise) return;
-    // If a start is in flight (bridgeRuntimeStarting=true), signal the in-flight
-    // startOwnedRuntime() to abort right after its getProvider().connect() resolves.
-    // Without this the in-flight start re-marks connected and re-launches
-    // scheduler/webhook/heartbeat after we tear them down here.
-    if (bridgeRuntimeStarting || automationStartPromise) _ownedRuntimeStopRequested = true;
-    if (automationStartPromise) {
-      try {
-        await automationStartPromise;
-      } catch {}
-    }
-    const wasConnected = getBridgeRuntimeConnected();
-    scheduler.stop();
-    stopSnapshotWriter();
-    await stopWebhookAndEventRuntime();
-    automationRunning = false;
-    releaseOwnedChannelLocks(instanceId);
-    clearActiveInstance(instanceId);
-    try {
-      // Only disconnect the getProvider() when connect() actually completed; calling
-      // disconnect() mid-connect races the connect promise.
-      if (wasConnected) {
-        // Drain in-flight outbound sends before disconnecting so a handoff
-        // (owned=false observed → ownership lost) never cuts off a reply
-        // mid-delivery. Bounded inside drainPendingSends so a wedged send can
-        // not stall teardown — we still disconnect promptly.
-        try {
-          await getProvider().drainPendingSends?.();
-        } catch {}
-        await getProvider().disconnect();
-      }
-    } finally {
-      setBridgeRuntimeConnected(false);
-      logOwnership(`standby: ${reason}`);
-    }
-  }
-  function refreshBridgeOwnershipSafe(options = {}) {
-    refreshBridgeOwnership(options).catch((err) =>
-      process.stderr.write(`[channels] refreshBridgeOwnership rejected: ${err?.message || err}\n`)
-    );
-  }
-  // Daemon model: no ownership timer or takeover handler. Kept as a no-op so the
-  // worker start() call site stays unchanged.
-  function armBridgeOwnershipTimer() {}
+export function createOwnedRuntime(deps) {
+  const state = createOwnedRuntimeState();
+  const services = createAutomationServices(deps);
   // Tell the parent session this worker ACQUIRED the bridge so it flips remote
-  // mode ON (badge/transcript writer). Callers fire this only on a genuine
-  // not-connected -> connected transition — never on a refresh — so the parent's
-  // idempotent handler sees it once. Cross-process supersede is a transport-level
-  // concern (daemon), not emitted here.
+  // mode ON. Fired only on a genuine not-connected -> connected transition via
+  // the sink-aware path, so the daemon replays it to every TUI.
   function notifyRemoteAcquired() {
-    // Sink-aware path so the daemon replays this to every TUI (the transport
-    // sticky-caches 'acquired'). Raw sendToParent would reach only the node-IPC
-    // spawner and be ignored.
-    sendNotifyToParent('notifications/mixdog/remote', { state: 'acquired' });
-  }
-  async function refreshBridgeOwnership(options = {}) {
-    // Coalesce concurrent callers onto the in-flight refresh so getProvider() tool
-    // calls landing during normal login wait for the same connect attempt
-    // instead of returning early and observing spurious auto-connect failure.
-    if (bridgeOwnershipRefreshInFlight) return bridgeOwnershipRefreshInFlight;
-    bridgeOwnershipRefreshInFlight = (async () => {
-      // Daemon model: this runtime is the unconditional bridge owner, so refresh
-      // just keeps the owned runtime in sync with channelBridgeActive.
-      if (!getChannelBridgeActive()) {
-        if (getBridgeRuntimeConnected()) await stopOwnedRuntime('bridge inactive');
-        return;
-      }
-      // Active -> ensure the owned runtime is up (idempotent; early-returns when
-      // already connected).
-      await startOwnedRuntime(options);
-    })();
-    try {
-      return await bridgeOwnershipRefreshInFlight;
-    } finally {
-      bridgeOwnershipRefreshInFlight = null;
-    }
-  }
-
-  async function reloadRuntimeConfig() {
-    const previousProvider = getProvider();
-    const previousProviderName = previousProvider?.name || '';
-    // File-watch/tool-triggered reloads must bypass the short keychain hit cache:
-    // another process may have just saved or rotated the channel credential.
-    setConfig(await loadConfig({ freshSecrets: true }));
-    scheduler.reloadConfig(
-      getConfig().nonInteractive ?? [],
-      getConfig().interactive ?? [],
-      // Single resolved main-channel id used for the schedule `channel` flag.
-      getConfig().channelId,
-      // The scheduler must be RE-ARMED by the reload whenever it is supposed to
-      // be running. `restart: false` only destroys the cron/one-shot bindings and
-      // hands lifecycle back to the caller — but on an automation-only install
-      // (no messaging provider) startAutomationRuntime() is already past its
-      // `automationRunning` guard, so nobody would ever call scheduler.start()
-      // again and every saved/edited schedule stayed silently disarmed until the
-      // daemon restarted.
-      { restart: automationRunning || getBridgeRuntimeConnected() }
-    );
-    const nextProvider = createProvider(getConfig());
-    const providerTypeChanged = (nextProvider?.name || '') !== previousProviderName;
-    const credentialsChanged =
-      !providerTypeChanged && String(nextProvider?.token || '') !== String(previousProvider?.token || '');
-    const providerChanged = providerTypeChanged || credentialsChanged;
-    if (providerChanged) {
-      const shouldRestart = getBridgeRuntimeConnected() || bridgeRuntimeStarting;
-      if (shouldRestart) await stopOwnedRuntime('getProvider() getConfig() changed');
-      // A start that was in flight when stopOwnedRuntime landed was signalled to
-      // bail (and disconnects the OLD provider it was connecting). Wait for it to
-      // FULLY settle before issuing the fresh start below — otherwise
-      // startOwnedRuntime's `if (bridgeRuntimeStarting) return` guard would drop
-      // the restart and the NEW provider would never connect (lost-restart race).
-      if (_inFlightStart) {
-        try {
-          await _inFlightStart;
-        } catch {}
-      }
-      setProvider(nextProvider);
-      // Provider-type change wipes the persisted routing ids; messaging is
-      // retired, so only the status snapshot needs clearing.
-      if (providerTypeChanged) {
-        try {
-          statusState.update((state) => {
-            state.channelId = '';
-            state.transcriptPath = '';
-          });
-        } catch {}
-      }
-      // stopOwnedRuntime above tore the owned runtime down; a same-session reload
-      // reconnects the NEW provider here. The in-flight start (if any) has already
-      // settled above, so this start is not dropped by the in-flight guard.
-      if (shouldRestart) refreshBridgeOwnershipSafe({ restoreBinding: !providerTypeChanged });
-    } else if (nextProvider !== previousProvider) {
-      try {
-        await nextProvider.disconnect?.();
-      } catch {}
-    }
-    if (getBridgeRuntimeConnected() || automationRunning) {
-      syncOwnedWebhookAndEventRuntime({ reload: true });
-    } else {
-      await stopWebhookAndEventRuntime();
-    }
+    deps.sendNotifyToParent('notifications/mixdog/remote', { state: 'acquired' });
   }
+  const startAutomationRuntime = createAutomationStarter({ state, scheduler: deps.scheduler, services });
+  const { startOwnedRuntime } = createOwnedStarter({
+    ...deps,
+    state,
+    services,
+    startAutomationRuntime,
+    notifyRemoteAcquired,
+  });
+  const stopOwnedRuntime = createOwnedStopper({ ...deps, state, services });
+  const { refreshBridgeOwnership, refreshBridgeOwnershipSafe } = createOwnershipRefresh({
+    ...deps,
+    state,
+    startOwnedRuntime,
+    stopOwnedRuntime,
+  });
+  const reloadRuntimeConfig = createConfigReloader({
+    ...deps,
+    state,
+    services,
+    stopOwnedRuntime,
+    refreshBridgeOwnershipSafe,
+  });
+  // Daemon model: no ownership timer or takeover handler. Kept as no-ops so
+  // the worker start()/teardown call sites stay unchanged.
+  const armBridgeOwnershipTimer = () => {};
+  const clearBridgeOwnershipTimer = () => {};
   return {
     startAutomationRuntime,
     startOwnedRuntime,

package/src/runtime/channels/lib/owner-heartbeat.mjs

@@ -17,14 +17,10 @@ function createOwnerHeartbeat() {
     // Daemon singleton: this runtime always owns the bridge.
     return { owned: true };
   }
-  function getBridgeOwnershipSnapshot() {
-    return currentOwnerState();
-  }
 
   return {
     logOwnership,
     currentOwnerState,
-    getBridgeOwnershipSnapshot,
   };
 }
 

package/src/runtime/channels/lib/parent-bridge.mjs

@@ -38,7 +38,7 @@ function createParentBridge({ getInstanceId, ipcProcess = process }) {
         _notifySink(method, outParams);
       } catch (err) {
         try {
-          process.stderr.write(`mixdog channels: notify sink failed: ${(err && err.message) || err}\n`);
+          process.stderr.write(`mixdog channels: notify sink failed: ${err?.message || err}\n`);
         } catch {}
       }
       return;
@@ -55,7 +55,7 @@ function createParentBridge({ getInstanceId, ipcProcess = process }) {
       {
         onError: (err) => {
           try {
-            process.stderr.write(`mixdog channels: notify IPC send failed: ${(err && err.message) || err}\n`);
+            process.stderr.write(`mixdog channels: notify IPC send failed: ${err?.message || err}\n`);
           } catch {}
         },
       }