mixdog 0.9.22 → 0.9.24

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -33,6 +33,62 @@ export function isAgentProgressWatchdogAbortError(err) {
     return typeof msg === 'string' && WATCHDOG_ABORT_RE.test(msg);
 }
 
+// Tools that enforce their own execution deadline: 'shell' kills the process
+// at its configured timeout; 'task' wait is bounded by its own wait budget.
+// These are NOT blanket-exempted from the tool-running watchdog — if their own
+// deadline timer dies the session would otherwise hang forever. Instead the
+// watchdog raises the tool-running ceiling to their self-deadline + a grace
+// window (below), so normal long runs are allowed but a dead timer is still
+// caught. Unknown/missing self-deadline falls back to the plain toolRunningMs.
+const SELF_DEADLINE_TOOLS = new Set(['shell', 'task']);
+// Grace added on top of a tool's own deadline before the watchdog steps in, so
+// the tool's in-process kill always fires first under normal operation.
+const TOOL_SELF_DEADLINE_GRACE_MS = 60_000;
+// Fallback deadlines matching the tool implementations (bash-tool.mjs default
+// 120s foreground timeout; task/shell-job wait default 30s budget).
+const SHELL_DEFAULT_TIMEOUT_MS = 120_000;
+const TASK_DEFAULT_WAIT_MS = 30_000;
+
+function bareToolName(toolName) {
+    if (typeof toolName !== 'string' || !toolName) return '';
+    // Strip any MCP/server prefix (e.g. 'server__shell' or 'server.shell').
+    return toolName.split(/[.]|__/).pop();
+}
+
+function isSelfDeadlineTool(toolName) {
+    const bare = bareToolName(toolName);
+    return SELF_DEADLINE_TOOLS.has(bare) || SELF_DEADLINE_TOOLS.has(toolName);
+}
+
+/**
+ * Resolve the self-enforced deadline (ms) for a tool call from its arguments,
+ * recorded into the progress snapshot at dispatch time. Returns a positive
+ * number when the tool enforces its own deadline, or null when unknown/missing
+ * (caller then falls back to the plain toolRunningMs ceiling).
+ *   - shell: explicit `timeout` (ms) if positive, else the 120s default.
+ *   - task:  explicit `timeout_ms` if positive, else 30s for the `wait` action
+ *            (other actions carry no wait budget -> null).
+ */
+export function resolveToolSelfDeadlineMs(toolName, args) {
+    if (!isSelfDeadlineTool(toolName)) return null;
+    const bare = bareToolName(toolName);
+    const a = (args && typeof args === 'object') ? args : {};
+    if (bare === 'shell') {
+        const t = Number(a.timeout);
+        if (Number.isFinite(t) && t > 0) return t;
+        const envDefault = parseInt(process.env.BASH_DEFAULT_TIMEOUT_MS ?? '', 10);
+        return envDefault > 0 ? envDefault : SHELL_DEFAULT_TIMEOUT_MS;
+    }
+    if (bare === 'task') {
+        const t = Number(a.timeout_ms);
+        if (Number.isFinite(t) && t > 0) return t;
+        const action = typeof a.action === 'string' ? a.action : '';
+        if (action === 'wait') return TASK_DEFAULT_WAIT_MS;
+        return null;
+    }
+    return null;
+}
+
 function assistantMessageText(content) {
     if (typeof content === 'string') return content;
     if (!Array.isArray(content)) return '';
@@ -209,7 +265,26 @@ export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
         && policy.toolRunningMs > 0
         && now - snapshot.toolStartedAt > policy.toolRunningMs
     ) {
-        return new AgentStallAbortError(`agent tool running stale (${policy.toolRunningMs}ms)`);
+        // Deadline-aware ceiling for tools that self-enforce their own deadline
+        // ('shell'/'task'). Rather than a blanket exemption (which would hang
+        // forever if the tool's own timer died), raise the tool-running ceiling
+        // to max(toolRunningMs, selfDeadlineMs + grace): normal long runs are
+        // allowed because the tool kills itself first, but a dead deadline timer
+        // is still caught after the grace window. Unknown/missing self-deadline
+        // (selfDeadlineMs <= 0) keeps the plain toolRunningMs behavior. All
+        // other tools are unaffected.
+        let ceilingMs = policy.toolRunningMs;
+        const selfDeadlineMs = Number(snapshot.toolSelfDeadlineMs);
+        if (
+            isSelfDeadlineTool(snapshot.currentTool)
+            && Number.isFinite(selfDeadlineMs)
+            && selfDeadlineMs > 0
+        ) {
+            ceilingMs = Math.max(policy.toolRunningMs, selfDeadlineMs + TOOL_SELF_DEADLINE_GRACE_MS);
+        }
+        if (now - snapshot.toolStartedAt > ceilingMs) {
+            return new AgentStallAbortError(`agent tool running stale (${ceilingMs}ms)`);
+        }
     }
 
     return null;

package/src/runtime/agent/orchestrator/config.mjs

@@ -1,5 +1,5 @@
 import { resolvePluginData } from '../../shared/plugin-paths.mjs';
-import { readSection, updateSection, getAgentApiKey, AGENT_PROVIDER_ENV } from '../../shared/config.mjs';
+import { readSection, updateSection, updateSectionAsync, getAgentApiKey, AGENT_PROVIDER_ENV } from '../../shared/config.mjs';
 import { OPENAI_COMPAT_PRESETS } from './providers/openai-compat-presets.mjs';
 import {
     hasAnthropicOAuthCredentials,
@@ -241,6 +241,14 @@ function persistAgentConfig(build) {
     updateSection('agent', (current) => build(hasKeys(current) ? current : {}));
 }
 
+// Async twin of persistAgentConfig: same in-lock rebase-on-current semantics,
+// but the whole-section RMW runs through updateSectionAsync so a debounced
+// timer flush never blocks the event loop on icacls/backup. Reuses the same
+// config lock file, so it stays linearizable with the sync writers.
+async function persistAgentConfigAsync(build) {
+    await updateSectionAsync('agent', (current) => build(hasKeys(current) ? current : {}));
+}
+
 // Recap toggle (recap.enabled, default true) gates ONLY the background memory
 // cycles. The memory module itself is always-on. On load we fold a legacy
 // `modules.memory === false` flag into recap.enabled=false one time; the caller
@@ -506,23 +514,34 @@ export function loadConfig(options = {}) {
  * concurrent instance's edits are not reverted.
  */
 /** In-lock patch of `skills.disabled` only (avoids whole-config lost-update). */
-export function patchSkillsDisabled(disabledNames) {
+function buildSkillsDisabledPatch(disabledNames) {
     const names = disabledNames instanceof Set
         ? [...disabledNames]
         : (Array.isArray(disabledNames) ? disabledNames : []);
     const nextSkills = normalizeSkillsConfig({ disabled: names });
-    persistAgentConfig((current) => {
+    const build = (current) => {
         const cur = { ...current };
         const target = (cur.agent && cur.agent.providers)
             ? (cur.agent = { ...cur.agent })
             : cur;
         target.skills = nextSkills;
         return cur;
-    });
+    };
+    return { build, nextSkills };
+}
+export function patchSkillsDisabled(disabledNames) {
+    const { build, nextSkills } = buildSkillsDisabledPatch(disabledNames);
+    persistAgentConfig(build);
+    return nextSkills;
+}
+// Async twin used by the debounced skills flush timer.
+export async function patchSkillsDisabledAsync(disabledNames) {
+    const { build, nextSkills } = buildSkillsDisabledPatch(disabledNames);
+    await persistAgentConfigAsync(build);
     return nextSkills;
 }
 
-export function saveConfig(config) {
+function buildAgentSaveBuilder(config) {
     // Strip ephemeral defaults from providers but preserve any unknown
     // per-provider subkey so future schema additions round-trip through the
     // setup UI without changes here. apiKey is intentionally omitted —
@@ -556,7 +575,7 @@ export function saveConfig(config) {
     // Build the replacement from `existingRaw` — the section read INSIDE the
     // file lock — not a snapshot taken before it, so unmanaged keys written by
     // a concurrent instance survive the save (lost-update guard).
-    persistAgentConfig((existingRaw) => ({
+    return (existingRaw) => ({
         ...existingRaw,
         guide: config.guide || existingRaw.guide || undefined,
         providers: persistedProviders,
@@ -582,7 +601,14 @@ export function saveConfig(config) {
         update: config.update || {},
         recap: config.recap || {},
         modules: config.modules || existingRaw.modules || {},
-    }));
+    });
+}
+export function saveConfig(config) {
+    persistAgentConfig(buildAgentSaveBuilder(config));
+}
+// Async twin used by the debounced config-save flush timer.
+export async function saveConfigAsync(config) {
+    await persistAgentConfigAsync(buildAgentSaveBuilder(config));
 }
 // --- Preset helpers ---
 // preset shape: { id, name, type: 'agent', provider, model, effort?, fast?, tools? }

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -407,9 +407,38 @@ export function stripDeferredToolManifestBlock(text) {
         .trimEnd();
 }
 
-/** Inject the skill-style deferred pool (name + description) into BP1 once at session start; never rewrite BP1 after. */
-export function applyInitialDeferredToolManifestToBp1(session, poolNames) {
-    if (!session || !Array.isArray(session.messages) || session.deferredToolBp1Applied) return false;
+// Rebuild path: replace the FIRST previously-injected <available-deferred-tools>
+// block (with its leading `---` separator) with the fresh manifest IN PLACE, so
+// the block keeps its original position and no sibling BP1 block (skills
+// manifest, agent rules, …) is reordered or dropped. The fresh manifest already
+// carries the mcp-instructions companion, so any pre-existing standalone one is
+// removed first to avoid duplication.
+export function rebuildDeferredToolManifestBlock(text, manifest) {
+    let out = String(text || '').replace(MCP_INSTRUCTIONS_BLOCK_RE, '');
+    let replaced = false;
+    out = out.replace(DEFERRED_TOOLS_BLOCK_RE, (match, sep) => {
+        if (replaced) return '';
+        replaced = true;
+        return `${sep || ''}${manifest}`;
+    });
+    if (!replaced) {
+        const base = out.trimEnd();
+        out = base ? `${base}\n\n---\n\n${manifest}` : manifest;
+    }
+    return out;
+}
+
+/**
+ * Inject the skill-style deferred pool (name + description) into BP1 at session
+ * start. Normally once; with `{ rebuild: true }` it strips any existing
+ * <available-deferred-tools>/<mcp-instructions> block and re-injects the fresh
+ * pool in place (used by the first-turn MCP refresh, before the prompt renders,
+ * so late-connected MCP tools land in the INITIAL manifest — never duplicated).
+ */
+export function applyInitialDeferredToolManifestToBp1(session, poolNames, options = {}) {
+    const rebuild = options?.rebuild === true;
+    if (!session || !Array.isArray(session.messages)) return false;
+    if (session.deferredToolBp1Applied && !rebuild) return false;
     const pool = Array.isArray(poolNames) ? poolNames : [];
     const descByName = new Map();
     for (const tool of Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : []) {
@@ -432,15 +461,21 @@ export function applyInitialDeferredToolManifestToBp1(session, poolNames) {
     }
     if (idx === -1) return false;
     const raw = typeof session.messages[idx].content === 'string' ? session.messages[idx].content : '';
-    if (bp1HasDeferredToolManifestBlock(raw)) {
+    if (bp1HasDeferredToolManifestBlock(raw) && !rebuild) {
         session.deferredToolBp1Applied = true;
         return true;
     }
     if (manifest) {
-        const base = stripDeferredToolManifestBlock(raw);
-        session.messages[idx].content = base
-            ? `${base}\n\n---\n\n${manifest}`
-            : manifest;
+        if (rebuild && bp1HasDeferredToolManifestBlock(raw)) {
+            // Anchored in-place rebuild: swap the previously injected manifest
+            // block for the fresh one at its EXISTING position.
+            session.messages[idx].content = rebuildDeferredToolManifestBlock(raw, manifest);
+        } else {
+            const base = stripDeferredToolManifestBlock(raw);
+            session.messages[idx].content = base
+                ? `${base}\n\n---\n\n${manifest}`
+                : manifest;
+        }
     }
     session.deferredToolBp1Applied = true;
     session.updatedAt = Date.now();

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -0,0 +1,226 @@
+// Full-tree shutdown for stdio MCP child processes.
+//
+// The MCP SDK's StdioClientTransport.close() closes stdin, waits ~2s, then
+// SIGTERMs / SIGKILLs the *direct* child only. On Windows that maps to
+// TerminateProcess on the spawned wrapper (uvx/npx/uv) and leaves its
+// grandchildren (uv.exe -> mcp-for-unity.exe -> python.exe) orphaned. This
+// module implements the MCP spec shutdown order over the whole process tree:
+// close stdin -> grace wait for voluntary exit -> force-kill the recorded
+// tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
+// POSIX). No external dependencies.
+import { spawn } from 'node:child_process';
+
+const isWin = process.platform === 'win32';
+
+function delay(ms) {
+    return new Promise((resolve) => {
+        const t = setTimeout(resolve, ms);
+        if (t.unref) t.unref();
+    });
+}
+
+// Spawn a helper command and resolve its stdout (empty string on any error).
+function run(cmd, args) {
+    return new Promise((resolve) => {
+        let out = '';
+        let cp;
+        try {
+            cp = spawn(cmd, args, { windowsHide: true });
+        }
+        catch {
+            resolve('');
+            return;
+        }
+        cp.stdout?.on('data', (d) => { out += String(d); });
+        cp.on('error', () => resolve(out));
+        cp.on('close', () => resolve(out));
+    });
+}
+
+// Snapshot the whole process table once: parent map + a per-pid identity
+// token (Windows CreationDate, POSIX lstart) so a later kill can prove a pid
+// number was not recycled onto a different process before signalling it.
+async function enumerate() {
+    const childrenOf = new Map();
+    const tokenOf = new Map();
+    const out = isWin
+        ? await run('powershell.exe', [
+            '-NoProfile', '-NonInteractive', '-Command',
+            `Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.ToString('o'))" }`,
+        ])
+        : await run('ps', ['-A', '-o', 'pid=,ppid=,lstart=']);
+    for (const line of out.split(/\r?\n/)) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.+))?$/);
+        if (!m) continue;
+        const pid = Number(m[1]);
+        const ppid = Number(m[2]);
+        const token = (m[3] || '').trim() || null;
+        if (!childrenOf.has(ppid)) childrenOf.set(ppid, []);
+        childrenOf.get(ppid).push(pid);
+        tokenOf.set(pid, token);
+    }
+    return { childrenOf, tokenOf };
+}
+
+// BFS every descendant pid of rootPid (excludes rootPid).
+function descendantsOf(childrenOf, rootPid) {
+    const result = [];
+    const seen = new Set([rootPid]);
+    const stack = [rootPid];
+    while (stack.length) {
+        const cur = stack.pop();
+        for (const child of childrenOf.get(cur) ?? []) {
+            if (!seen.has(child)) {
+                seen.add(child);
+                result.push(child);
+                stack.push(child);
+            }
+        }
+    }
+    return result;
+}
+
+// Exposed for tests: descendant pid list captured while the tree is intact.
+export async function collectDescendants(rootPid) {
+    const { childrenOf } = await enumerate();
+    return descendantsOf(childrenOf, rootPid);
+}
+
+/**
+ * Immediate, non-blocking tree kill for a transport whose MCP handshake never
+ * completed (shutdown-during-connect). Unlike shutdownStdioChild there is no
+ * grace wait and no identity-checked enumeration on Windows — the ChildProcess
+ * handle is live, so the pid is current, and taskkill /T reaps the still-
+ * parented tree. Everything is unref'd/fire-and-forget so the kill can never
+ * hold the caller's event loop open (the caller is a process about to exit).
+ */
+export function killStdioChildTreeFast(transport) {
+    const proc = transport?._process;
+    const pid = (typeof transport?.pid === 'number' ? transport.pid : null) ?? proc?.pid ?? null;
+    if (!pid) return false;
+    if (proc && (proc.exitCode !== null || proc.signalCode !== null)) return false;
+    try { proc?.unref?.(); } catch { /* ignore */ }
+    for (const s of [proc?.stdin, proc?.stdout, proc?.stderr]) {
+        try { s?.unref?.(); } catch { /* ignore */ }
+        try { s?.destroy?.(); } catch { /* ignore */ }
+    }
+    if (isWin) {
+        try {
+            const cp = spawn('taskkill', ['/PID', String(pid), '/T', '/F'], {
+                windowsHide: true,
+                detached: true,
+                stdio: 'ignore',
+            });
+            cp.unref();
+        } catch { /* ignore */ }
+        return true;
+    }
+    // POSIX: cheap ps enumerate, then SIGKILL descendants + root. Best-effort
+    // and un-awaited; a straggler orphan is reparented to init, not leaked by us.
+    void collectDescendants(pid).then((pids) => {
+        for (const p of [...pids, pid]) {
+            try { process.kill(p, 'SIGKILL'); } catch { /* ignore */ }
+        }
+    }).catch(() => { /* ignore */ });
+    return true;
+}
+
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        // EPERM => exists but not signalable by us; ESRCH => gone.
+        return Boolean(e && e.code === 'EPERM');
+    }
+}
+
+function waitExit(proc, ms) {
+    if (!proc || proc.exitCode !== null || proc.signalCode !== null) {
+        return Promise.resolve(true);
+    }
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (v) => { if (!done) { done = true; resolve(v); } };
+        const t = setTimeout(() => finish(false), ms);
+        if (t.unref) t.unref();
+        proc.once('exit', () => { clearTimeout(t); finish(true); });
+        proc.once('close', () => { clearTimeout(t); finish(true); });
+    });
+}
+
+// A pid is safe to signal only if its CURRENT identity token equals the one
+// recorded at snapshot time. Both must be present; a gone/recycled pid has a
+// missing or mismatched token and is skipped. Tokens come from batched table
+// reads (Map), so verification is O(1) with zero extra process spawns.
+function stillSame(pid, snapshotToken, currentTokens) {
+    const want = snapshotToken.get(pid);
+    const cur = currentTokens.get(pid);
+    return Boolean(want && cur && want === cur);
+}
+
+// Force-kill the given pids, identity-checked against a batched current-token
+// table captured immediately before signalling so a recycled pid is never hit.
+async function killVerified(pids, snapshotToken, currentTokens) {
+    const verified = pids.filter((pid) => stillSame(pid, snapshotToken, currentTokens));
+    if (verified.length === 0) return;
+    if (isWin) {
+        // /T also reaps any still-live children spawned since enumeration;
+        // every listed /PID was identity-checked just above.
+        const args = ['/F', '/T'];
+        for (const p of verified) args.push('/PID', String(p));
+        await run('taskkill', args);
+        return;
+    }
+    // POSIX: terminate, brief wait, then hard-kill survivors. Re-verify with a
+    // single fresh batched table read (not per-pid) before the SIGKILL pass.
+    for (const p of verified) { try { process.kill(p, 'SIGTERM'); } catch { /* ignore */ } }
+    await delay(500);
+    const { tokenOf: fresh } = await enumerate().catch(() => ({ tokenOf: new Map() }));
+    for (const p of verified) {
+        if (isAlive(p) && stillSame(p, snapshotToken, fresh)) {
+            try { process.kill(p, 'SIGKILL'); } catch { /* ignore */ }
+        }
+    }
+}
+
+/**
+ * Shut down an stdio MCP transport's child process tree per MCP spec order.
+ * Returns false when the transport has no live child (non-stdio / already
+ * exited); true once the tree has been shut down.
+ */
+export async function shutdownStdioChild(transport, { graceMs = 2000 } = {}) {
+    const proc = transport?._process;
+    const pid = (typeof transport?.pid === 'number' ? transport.pid : null) ?? proc?.pid ?? null;
+    if (!pid) return false;
+    const empty = { childrenOf: new Map(), tokenOf: new Map() };
+    const snapshotToken = new Map();
+    // Snapshot #1: tree + identity tokens while it is still fully intact.
+    // Covers children that later get re-parented/orphaned during shutdown.
+    const before = await enumerate().catch(() => empty);
+    const initial = descendantsOf(before.childrenOf, pid);
+    snapshotToken.set(pid, before.tokenOf.get(pid) ?? null);
+    for (const d of initial) snapshotToken.set(d, before.tokenOf.get(d) ?? null);
+    // 1. Close stdin to request a voluntary shutdown.
+    try { proc?.stdin?.end(); } catch { /* ignore */ }
+    // 2. Grace period for the server to exit on its own.
+    const exited = await waitExit(proc, graceMs);
+    // 3. Snapshot #2 after the grace: catches children spawned late during
+    //    shutdown that were absent from the first snapshot.
+    const after = await enumerate().catch(() => empty);
+    const fresh = descendantsOf(after.childrenOf, pid);
+    for (const d of fresh) {
+        if (!snapshotToken.has(d)) snapshotToken.set(d, after.tokenOf.get(d) ?? null);
+    }
+    // 4. Candidate set = union of both snapshots' descendants; add the root
+    //    only when it did NOT exit on its own (skip stale-root kill per spec).
+    const candidates = new Set(initial);
+    for (const d of fresh) candidates.add(d);
+    if (!exited) candidates.add(pid);
+    if (candidates.size === 0) return true;
+    // 5. Force-kill. Snapshot #2 is the pre-kill verify table (captured just
+    //    now, immediately before signalling) — no per-pid queries.
+    await killVerified([...candidates], snapshotToken, after.tokenOf);
+    return true;
+}