mixdog 0.9.20 → 0.9.22

package/src/standalone/channel-worker.mjs

@@ -252,6 +252,13 @@ export function createStandaloneChannelWorker({
         MIXDOG_STANDALONE: '1',
         MIXDOG_WORKER_MODE: '1',
         MIXDOG_CLI_OWNED: '0',
+        // Preserve the real terminal-lead PID (host TUI, or an outer run-mcp
+        // supervisor if one injected MIXDOG_SUPERVISOR_PID) through the fork.
+        // Without this the worker resolves getTerminalLeadPid() to its OWN pid,
+        // so the seat's ownerLeadPid tracks the headless worker instead of the
+        // terminal that owns it — and the seat can never be evicted when the
+        // owning terminal/TUI dies while the worker stays alive.
+        MIXDOG_SUPERVISOR_PID: process.env.MIXDOG_SUPERVISOR_PID || String(process.pid),
         MIXDOG_QUIET_SESSION_LOG: process.env.MIXDOG_QUIET_SESSION_LOG ?? '1',
       },
       windowsHide: true,
@@ -416,6 +423,12 @@ export function createStandaloneChannelWorker({
 
   function uninstallParentExitHook() {
     if (!parentExitCleanup) return;
+    // Refcount-aware: never strip the shared parent-exit protection while any
+    // owned child PID is still tracked. A newer worker may have been spawned
+    // (new PID added, hook install is a no-op because it is already present)
+    // before an older worker finishes its async teardown; letting that old
+    // teardown uninstall here would leave the live newer PID unprotected.
+    if (ownedChildPids.size > 0) return;
     const unregister = parentExitCleanup;
     parentExitCleanup = null;
     unregister();
@@ -458,27 +471,70 @@ export function createStandaloneChannelWorker({
     child = null;
     if (!waitForExit) {
       rejectPending(new Error(`channels runtime shutdown requested (${reason})`));
-      if (targetPid) ownedChildPids.delete(targetPid);
+      // Fast/detached path is still TERMINAL: the caller does not block on the
+      // full teardown, but a background escalation ladder guarantees the worker
+      // dies so no zombie survives. Exit-hook + PID tracking stay installed
+      // until the process ACTUALLY exits (not on IPC ack), so a parent that
+      // force-exits mid-grace still force-kills the tree via the exit cleanup.
+      let torn = false;
+      const teardown = () => {
+        if (torn) return;
+        torn = true;
+        clearTimeout(termTimer);
+        clearTimeout(killTimer);
+        if (targetPid) ownedChildPids.delete(targetPid);
+        unrefChildHandles(target);
+        uninstallParentExitHook();
+      };
+      // Bounded grace after IPC shutdown, then SIGTERM.
+      const termTimer = setTimeout(() => {
+        try {
+          if (target.exitCode == null && !target.killed) target.kill('SIGTERM');
+        } catch {}
+      }, 1500);
+      // Hard fallback: taskkill /T /F the whole tree, then SIGKILL the handle.
+      const killTimer = setTimeout(() => {
+        try {
+          if (target.exitCode == null) forceKillTree(targetPid);
+        } catch {}
+        try {
+          if (target.exitCode == null && !target.killed) target.kill('SIGKILL');
+        } catch {}
+        teardown();
+      }, 3000);
+      // Unref so these background escalation timers never keep the event loop
+      // (or a pending /exit) alive waiting out the grace/hard-kill window.
+      termTimer.unref?.();
+      killTimer.unref?.();
+      // Actual exit (or spawn error) is the only thing that tears down tracking.
+      target.once('exit', teardown);
+      target.once('error', teardown);
       stopPromise = new Promise((resolve) => {
         let settled = false;
-        const finish = (ok) => {
+        const settle = (ok) => {
           if (settled) return;
           settled = true;
           clearTimeout(sendTimer);
           stopPromise = null;
-          unrefChildHandles(target);
-          uninstallParentExitHook();
           resolve(ok);
         };
-        const sendTimer = setTimeout(() => finish(false), 250);
+        // Resolve the caller quickly once the IPC shutdown is acked/timed out;
+        // the escalation ladder above keeps running in the background.
+        const sendTimer = setTimeout(() => settle(true), 250);
+        sendTimer.unref?.();
+        target.once('exit', () => settle(true));
         try {
           target.send?.({ type: 'shutdown', reason }, () => {
             try { target.disconnect?.(); } catch {}
-            finish(true);
+            settle(true);
           });
         } catch {
           try { target.disconnect?.(); } catch {}
-          finish(false);
+          // IPC unavailable: skip the grace window and escalate now.
+          try {
+            if (target.exitCode == null && !target.killed) target.kill('SIGTERM');
+          } catch {}
+          settle(false);
         }
       });
       return stopPromise;

package/src/standalone/folder-dialog.mjs

@@ -232,7 +232,10 @@ namespace Mixdog {
   }
 }
 '@`,
-    'Add-Type -TypeDefinition $code -ReferencedAssemblies System.Windows.Forms | Out-Null',
+    // System.Drawing is required too: GetDialogOwnerCenter uses
+    // Screen.PrimaryScreen.WorkingArea (System.Drawing.Rectangle) — without it
+    // the Add-Type compile fails and the dialog silently falls back to typing.
+    'Add-Type -TypeDefinition $code -ReferencedAssemblies System.Windows.Forms,System.Drawing | Out-Null',
     // Invisible TopMost owner anchored to the TUI console (or foreground window)
     // so IFileOpenDialog is modal, centered, and not detached on another monitor.
     '$owner = New-Object System.Windows.Forms.Form',

package/src/standalone/memory-runtime-proxy.mjs

@@ -81,7 +81,7 @@ function isConnResetLikeError(err) {
 
 function isMemoryWorkerNotReadyError(err) {
   const msg = String(err?.message || err || '');
-  return /memory worker exited before ready|memory worker ready timeout|memory runtime did not become ready|memory worker degraded/i.test(msg);
+  return /memory worker exited before ready|memory worker ready timeout|memory runtime did not become ready|memory worker degraded|memory worker draining/i.test(msg);
 }
 
 function isTransientMemoryRpcError(err) {
@@ -166,9 +166,67 @@ export function createStandaloneMemoryRuntime({
   let child = null;
   let nextCallId = 1;
   let crashState = null; // { reason, at } — cached deterministic spawn crash
+  // Port we have registered this proxy pid with (so the shared daemon can
+  // reap itself promptly once every client deregisters). Re-registers when
+  // the daemon respawns on a new port.
+  let registeredWithPort = null;
+
+  async function ensureClientRegistered(port) {
+    // Returns the port the pending RPC should target. When an internal respawn
+    // happens the daemon moves to a fresh port, so the caller MUST use the
+    // returned value rather than the port it captured before registering.
+    if (!port || registeredWithPort === port) return port;
+    // The register RPC is provably side-effect-free from the caller's point of
+    // view: a refused/reset connection means the daemon never received it, and
+    // a draining 503 means it refused it. So a register-phase transient is ALWAYS
+    // safe to recover from by respawning a fresh daemon and retrying — even for a
+    // pending WRITE RPC. We do that respawn-and-retry HERE, before the write RPC
+    // is ever attempted, rather than leaning on the outer retry (which must not
+    // blanket-retry refused/reset on the write RPC itself).
+    let curPort = port;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await requestJson({
+          port: curPort,
+          method: 'POST',
+          path: '/client/register',
+          body: { clientPid: process.pid },
+          timeoutMs: 2000,
+        });
+        registeredWithPort = curPort;
+        return curPort;
+      } catch (err) {
+        // Benign failures (e.g. request timeout against a busy-but-live daemon)
+        // are not fatal: registration is best-effort and the idle TTL backstops
+        // a missed register. Only recover from genuine "daemon is gone/dying".
+        if (!isTransientMemoryRpcError(err)) return curPort;
+        if (attempt >= 3) throw err;
+        invalidateMemoryRuntimeAfterTransient(err);
+        await delay(TRANSIENT_MEMORY_RPC_BACKOFF_MS);
+        const started = await start();
+        curPort = started.port;
+      }
+    }
+  }
+
+  async function deregisterClient() {
+    const port = registeredWithPort || portCache;
+    registeredWithPort = null;
+    if (!port) return;
+    try {
+      await requestJson({
+        port,
+        method: 'POST',
+        path: '/client/deregister',
+        body: { clientPid: process.pid },
+        timeoutMs: 1500,
+      });
+    } catch { /* best-effort; sweep + idle TTL reap us anyway */ }
+  }
 
   function invalidateMemoryRuntimeAfterTransient(err) {
     portCache = null;
+    registeredWithPort = null;
     if (!isMemoryWorkerNotReadyError(err)) return;
     startPromise = null;
     const proc = child;
@@ -289,14 +347,34 @@ export function createStandaloneMemoryRuntime({
     }
 
     startPromise = (async () => {
-      const claim = claimOwner();
+      let claim = claimOwner();
       if (!claim.owned) {
-        const owner = readSingletonOwner(ownerPath);
-        if (owner.alive) {
-          const live = await waitForPort(30_000);
-          return live;
+        // Another owner holds the singleton. If it is live AND serving a
+        // healthy port, use it. If it is live but NOT healthy (a daemon that is
+        // draining/shutting down never revives — see getDraining/health in
+        // lib/http-router.mjs), poll: reclaim the instant the old owner exits so
+        // a quick restart still ends with a fresh, working daemon instead of
+        // binding to the dying one and failing the pending RPC.
+        const deadline = Date.now() + 30_000;
+        while (Date.now() < deadline) {
+          const livePort = await findLivePort({ allowStarting: true });
+          if (livePort) {
+            try {
+              const health = await requestJson({ port: livePort, path: '/health', timeoutMs: 1500 });
+              if (health?.status === 'ok') return livePort;
+            } catch { /* dying/unreachable — fall through to reclaim */ }
+          }
+          const reclaim = claimOwner();
+          if (reclaim.owned) { claim = reclaim; break; }
+          await delay(150);
+        }
+        if (!claim.owned) {
+          const owner = readSingletonOwner(ownerPath);
+          if (owner.alive) throw new Error('memory runtime did not become ready');
+          releaseOwnerIfSelf();
+          claim = claimOwner();
+          if (!claim.owned) throw new Error('memory runtime did not become ready');
         }
-        releaseOwnerIfSelf();
       }
 
       const daemonEnv = { ...process.env };
@@ -354,6 +432,7 @@ export function createStandaloneMemoryRuntime({
         if (singletonEnabled && childPid) releaseSingletonOwner(ownerPath, childPid);
         if (child?.pid === childPid) child = null;
         portCache = null;
+        registeredWithPort = null;
       });
 
       const ready = new Promise((resolveReady, rejectReady) => {
@@ -417,7 +496,11 @@ export function createStandaloneMemoryRuntime({
     const callId = `mem_${process.pid}_${nextCallId++}`;
     return await withTransientMemoryRpcRetry(async () => {
       await start();
-      const port = portCache || await findLivePort({ allowStarting: true });
+      let port = portCache || await findLivePort({ allowStarting: true });
+      if (!port) throw new Error('memory runtime is not available');
+      // ensureClientRegistered may respawn onto a fresh daemon/port; target the
+      // port it hands back so the RPC and registration always hit the same one.
+      port = await ensureClientRegistered(port);
       if (!port) throw new Error('memory runtime is not available');
       return await requestJson({
         port,
@@ -433,7 +516,9 @@ export function createStandaloneMemoryRuntime({
   async function buildSessionCoreMemoryPayload(sessionCwd) {
     return await withTransientMemoryRpcRetry(async () => {
       await start();
-      const port = portCache || await findLivePort({ allowStarting: true });
+      let port = portCache || await findLivePort({ allowStarting: true });
+      if (!port) throw new Error('memory runtime is not available');
+      port = await ensureClientRegistered(port);
       if (!port) throw new Error('memory runtime is not available');
       return await requestJson({
         port,
@@ -446,8 +531,10 @@ export function createStandaloneMemoryRuntime({
   }
 
   async function stop() {
-    // Detach only. The daemon owns its own idle lifetime; CLI shutdown must not
-    // tear it down out from under another tab.
+    // Deregister this client so a shared daemon can reap itself within the
+    // seconds-scale client grace once no clients remain, then detach. We never
+    // hard-kill the daemon here — another tab/session may still be using it.
+    await deregisterClient();
     try { child?.disconnect?.(); } catch {}
     try { child?.unref?.(); } catch {}
     child = null;

package/src/standalone/seeds.mjs

@@ -1,4 +1,5 @@
-import { mkdirSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
 
 export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   if (!rootDir) throw new Error('standalone rootDir is required');
@@ -14,4 +15,30 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   process.env.MIXDOG_PATCH_NATIVE_PREWARM ??= '0';
 
   mkdirSync(dataDir, { recursive: true });
+  seedBundledSkills({ rootDir, dataDir });
+}
+
+// Copy skills bundled in the package (src/defaults/skills/<name>/) into the
+// user data skills dir, but only when the target dir does not already exist —
+// never overwrite user-owned skill dirs.
+export function seedBundledSkills({ rootDir, dataDir }) {
+  const bundledDir = join(rootDir, 'defaults', 'skills');
+  if (!existsSync(bundledDir)) return;
+  const targetRoot = join(dataDir, 'skills');
+  let names;
+  try {
+    names = readdirSync(bundledDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of names) {
+    if (!entry.isDirectory()) continue;
+    const dest = join(targetRoot, entry.name);
+    if (existsSync(dest)) continue;
+    try {
+      cpSync(join(bundledDir, entry.name), dest, { recursive: true });
+    } catch {
+      // best-effort seeding; ignore individual copy failures
+    }
+  }
 }

package/src/tui/App.jsx

@@ -720,6 +720,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false })
     openContextPicker: (...a) => openContextPicker(...a),
     openProfilePicker: (...a) => openProfilePicker(...a),
     openUpdatePicker: (...a) => openUpdatePicker(...a),
+    runDoctor: (...a) => store.runDoctor?.(...a),
     requestExit: (...a) => requestExit(...a),
   });
   const promptHintTimerRef = useRef(null);

package/src/tui/app/doctor.mjs

@@ -0,0 +1,175 @@
+/**
+ * doctor.mjs — /doctor installation health report builder.
+ *
+ * buildDoctorReport(runtime, getState) runs a fixed set of best-effort
+ * diagnostics against the live runtime accessors and returns a single
+ * multi-line string (one glyph-prefixed row per check). Every check is
+ * individually try/caught so one failure degrades to a single FAIL row
+ * instead of killing the whole report. No secrets are ever printed — only
+ * whether a token/auth is configured. The only network touch is the
+ * best-effort npm update check already used by /update; an unreachable
+ * registry downgrades to a WARN "check skipped" row, never a throw.
+ */
+import { compareSemver } from '../../runtime/shared/update-checker.mjs';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const GLYPH = { ok: '✓', warn: '⚠', fail: '✗' };
+
+function readPackageJson() {
+  try {
+    const dir = dirname(fileURLToPath(import.meta.url));
+    const raw = JSON.parse(readFileSync(join(dir, '..', '..', '..', 'package.json'), 'utf8'));
+    return raw && typeof raw === 'object' ? raw : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function buildDoctorReport(runtime = {}, getState = () => ({})) {
+  const rows = [];
+  const check = async (label, fn) => {
+    const row = (level, detail) => {
+      rows.push(`${GLYPH[level] || GLYPH.warn} ${label}: ${detail}`);
+    };
+    try {
+      await fn(row);
+    } catch (e) {
+      row('fail', `check failed: ${e?.message || e}`);
+    }
+  };
+  const pkg = readPackageJson();
+
+  // 1. mixdog version + update availability (best-effort registry check).
+  await check('mixdog', async (row) => {
+    const upd = (await runtime.checkForUpdate?.({})) || {};
+    const current = upd.currentVersion || pkg?.version || 'unknown';
+    const latest = upd.latestVersion;
+    if (latest == null) {
+      row('warn', `v${current} · update check skipped (registry unreachable)`);
+      return;
+    }
+    if (upd.updateAvailable) row('warn', `v${current} · update available → v${latest}`);
+    else row('ok', `v${current} · up to date`);
+  });
+
+  // 2. node version vs package.json engines (only when engines present).
+  await check('node', async (row) => {
+    const nodeVer = process.versions?.node || '0.0.0';
+    const engines = pkg?.engines?.node;
+    if (!engines) {
+      row('ok', `v${nodeVer}`);
+      return;
+    }
+    const m = String(engines).match(/(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+    if (!m) {
+      row('warn', `v${nodeVer} · engines "${engines}" unparsed`);
+      return;
+    }
+    const required = `${m[1]}.${m[2] || 0}.${m[3] || 0}`;
+    const ok = compareSemver(nodeVer, required) >= 0;
+    row(ok ? 'ok' : 'fail', `v${nodeVer} · requires node ${engines}`);
+  });
+
+  // 3. providers: configured auth count; FAIL if the active route provider
+  //    has no auth.
+  await check('providers', async (row) => {
+    const setup = (await runtime.getProviderSetup?.()) || {};
+    const lists = [...(setup.api || []), ...(setup.oauth || []), ...(setup.local || [])];
+    const isAuthed = (p) => Boolean(p && (p.authenticated || p.enabled || p.detected));
+    const authed = lists.filter(isAuthed);
+    const active = getState()?.provider || '';
+    const activeEntry = active ? lists.find((p) => p.id === active) : null;
+    if (activeEntry && !isAuthed(activeEntry)) {
+      row('fail', `route ${active} has no auth · ${authed.length} configured`);
+      return;
+    }
+    if (active && !activeEntry) {
+      row('warn', `${authed.length} authed · route ${active} (not listed)`);
+      return;
+    }
+    row('ok', `${authed.length} authed · route ${active || 'unknown'}`);
+  });
+
+  // 4. MCP: connected/configured, failed servers named.
+  await check('mcp', async (row) => {
+    const m = runtime.mcpStatus?.() || {};
+    const servers = Array.isArray(m.servers) ? m.servers : [];
+    const conn = Number(m.connectedCount || 0);
+    const conf = Number(m.configuredCount || 0);
+    if (conf === 0) {
+      row('ok', 'no servers configured');
+      return;
+    }
+    const failed = servers
+      .filter((s) => s && (s.error || s.status === 'failed'))
+      .map((s) => s.name || s.id)
+      .filter(Boolean);
+    const detail = `${conn}/${conf} connected${failed.length ? ` · failed: ${failed.join(', ')}` : ''}`;
+    row(failed.length || conn < conf ? 'warn' : 'ok', detail);
+  });
+
+  // 5. memory: enabled/disabled (+ backend health only if the accessor
+  //    already exposes it; no new probing).
+  await check('memory', async (row) => {
+    const mem = runtime.getMemorySettings?.() || {};
+    const enabled = mem.enabled !== false;
+    let detail = enabled ? 'enabled' : 'disabled';
+    if (mem.backend) detail += ` · backend ${mem.backend}`;
+    const health = mem.backendHealth || mem.health;
+    if (health != null) {
+      detail += ` · ${typeof health === 'string' ? health : (health.ok ? 'healthy' : 'unhealthy')}`;
+    }
+    row(enabled ? 'ok' : 'warn', detail);
+  });
+
+  // 6. channels: enabled + worker status + configured tokens (names only).
+  await check('channels', async (row) => {
+    const settings = runtime.getChannelSettings?.({ includeStatus: true }) || {};
+    const enabled = settings.enabled !== false;
+    if (!enabled) {
+      row('ok', 'disabled');
+      return;
+    }
+    const worker = settings.status || runtime.getChannelWorkerStatus?.() || {};
+    const setup = runtime.getChannelSetup?.() || {};
+    const tokens = [];
+    if (setup.discord?.authenticated) tokens.push('discord');
+    if (setup.telegram?.authenticated) tokens.push('telegram');
+    if (setup.webhook?.authenticated) tokens.push('webhook');
+    const running = worker.running === true;
+    const detail = `enabled · worker ${running ? 'running' : 'stopped'} · tokens: ${tokens.length ? tokens.join(', ') : 'none'}`;
+    row(running ? 'ok' : 'warn', detail);
+  });
+
+  // 7. skills / plugins / hooks: counts + broken/disabled entries.
+  await check('skills', async (row) => {
+    const s = runtime.skillsStatus?.() || {};
+    const skills = Array.isArray(s.skills) ? s.skills : [];
+    const broken = skills.filter((x) => x && (x.broken || x.error || x.invalid));
+    const disabled = skills.filter((x) => x && x.disabled);
+    let detail = `${s.count ?? skills.length} available`;
+    if (disabled.length) detail += ` · ${disabled.length} disabled`;
+    if (broken.length) detail += ` · broken: ${broken.map((x) => x.name || x.id).filter(Boolean).join(', ')}`;
+    row(broken.length ? 'warn' : 'ok', detail);
+  });
+  await check('plugins', async (row) => {
+    const p = runtime.pluginsStatus?.() || {};
+    const plugins = Array.isArray(p.plugins) ? p.plugins : [];
+    const broken = plugins.filter((x) => x && (x.broken || x.error));
+    const disabled = plugins.filter((x) => x && x.disabled);
+    let detail = `${p.count ?? plugins.length} detected`;
+    if (disabled.length) detail += ` · ${disabled.length} disabled`;
+    if (broken.length) detail += ` · broken: ${broken.map((x) => x.title || x.name || x.id).filter(Boolean).join(', ')}`;
+    row(broken.length ? 'warn' : 'ok', detail);
+  });
+  await check('hooks', async (row) => {
+    const h = runtime.hooksStatus?.() || {};
+    const events = Array.isArray(h.events) ? h.events : [];
+    const enabled = h.enabled === true;
+    row('ok', `${enabled ? 'enabled' : 'disabled'} · ${events.length} event${events.length === 1 ? '' : 's'}`);
+  });
+
+  return ['mixdog doctor — installation health', ...rows].join('\n');
+}

package/src/tui/app/slash-commands.mjs

@@ -32,6 +32,7 @@ export const SLASH_COMMANDS = [
   { name: 'settings', usage: '/setting', aliases: ['setting', 'config'], aliasUsage: ['settings', 'config'], showAliasUsage: false, description: 'Open runtime settings' },
   { name: 'profile', usage: '/profile', description: 'Set your title and response language' },
   { name: 'update', usage: '/update', description: 'Check version and update mixdog' },
+  { name: 'doctor', usage: '/doctor', description: 'Diagnose installation health' },
   { name: 'quit', usage: '/quit', aliases: ['exit', 'q'], aliasUsage: ['exit', 'q'], description: 'Quit the TUI' },
 ];
 

package/src/tui/app/slash-dispatch.mjs

@@ -46,6 +46,7 @@ export function createSlashDispatch({
   openContextPicker,
   openProfilePicker,
   openUpdatePicker,
+  runDoctor,
   requestExit,
 }) {
   const runSlashCommand = (cmd, arg = '') => {
@@ -383,6 +384,14 @@ export function createSlashDispatch({
       case 'update':
         openUpdatePicker();
         return true;
+      case 'doctor':
+        if (state.commandBusy) {
+          store.pushNotice('wait for the current command to finish before /doctor', 'warn');
+          return false;
+        }
+        void Promise.resolve(runDoctor?.())
+          .catch((e) => store.pushNotice(`doctor failed: ${e?.message || e}`, 'error'));
+        return true;
       case 'quit':
         requestExit();
         return true;