mixdog 0.9.24 → 0.9.26

package/src/runtime/shared/service-discovery.mjs

@@ -0,0 +1,169 @@
+// Per-service, SINGLE-WRITER port-advert files under RUNTIME_ROOT/discovery/.
+//
+// Motivation: service port discovery (memory_port, pg_port, ...) used to ride
+// inside the shared active-instance.json, whose write path takes a .lock. With
+// multiple terminals heartbeating and slow Windows renames, that lock could be
+// held long enough to starve a port advertise for an hour+. Splitting each
+// service's advert into its own file, written by its single owner via a plain
+// atomic rename (NO .lock), removes the shared-lock contention entirely.
+//
+// Each advert is stamped with the owner pid and updatedAt. Readers prefer the
+// discovery file (validating the owner pid is still alive) and callers may fall
+// back to the legacy active-instance fields for cross-version compat.
+import { readFileSync, unlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { writeJsonAtomicSync } from './atomic-file.mjs'
+
+export function discoveryRoot() {
+  const root = process.env.MIXDOG_RUNTIME_ROOT
+    ? resolve(process.env.MIXDOG_RUNTIME_ROOT)
+    : join(tmpdir(), 'mixdog')
+  return join(root, 'discovery')
+}
+
+export function discoveryPath(service) {
+  return join(discoveryRoot(), `${service}.json`)
+}
+
+function parsePid(value) {
+  const pid = Number(value)
+  return Number.isInteger(pid) && pid > 0 ? pid : null
+}
+
+export function isPidAlive(value) {
+  const pid = parsePid(value)
+  if (!pid) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (e) {
+    // EPERM: process exists but we lack permission → alive. ESRCH → dead.
+    return e?.code === 'EPERM'
+  }
+}
+
+// Per-process "unreachable port" distrust set: service → { port, updatedAt,
+// pid, ts } a consumer WITHOUT its own health probe proved dead this process
+// (connect-failure). pid-liveness alone cannot catch a recycled owner pid: the
+// advert's pid can be alive as an UNRELATED process while its advertised port
+// is dead, so a pid-validated advert would keep routing consumers to a corpse
+// port and suppress the legacy fallback. Consumers call markServiceUnreachable()
+// on a CONNECTION-level failure (see isConnRefuseError); readLiveServiceAdvert
+// then skips THAT port so the caller falls back to legacy/buffer.
+//
+// The entry records the advert IDENTITY at mark time (updatedAt + pid). A
+// daemon restarted on the SAME port re-stamps updatedAt / gets a new pid, so
+// readLiveServiceAdvert detects the change and clears the distrust — the old
+// port-only key otherwise stayed distrusted for the whole process lifetime. A
+// short TTL is a second self-heal so any residual false positive expires.
+const _DISTRUST_TTL_MS = 30_000
+const _unreachablePorts = new Map()
+
+// Connection-level failure classifier for distrust decisions: only "nothing is
+// listening / socket died on connect" justifies distrusting an advert port.
+// Timeouts (slow-but-alive daemon) and HTTP/handshake status errors must NOT —
+// they would false-distrust a healthy service.
+const _CONN_REFUSE_CODES = new Set([
+  'ECONNREFUSED', 'ECONNRESET', 'ENOTFOUND', 'EHOSTUNREACH', 'ENETUNREACH',
+])
+export function isConnRefuseError(err) {
+  if (!err) return false
+  const code = String(err.code || err.cause?.code || '')
+  if (_CONN_REFUSE_CODES.has(code)) return true
+  const msg = String(err.message || err.cause?.message || '')
+  return /socket hang up|ECONNREFUSED|ECONNRESET|ENOTFOUND|EHOSTUNREACH|ENETUNREACH/i.test(msg)
+}
+
+export function markServiceUnreachable(service, port) {
+  const p = Number(port)
+  if (!Number.isInteger(p) || p <= 0) return
+  // Snapshot the CURRENT advert identity so a later restart on the same port is
+  // detected (newer updatedAt / different pid) and the distrust auto-clears.
+  const raw = readServiceAdvert(service)
+  const same = raw && Number(raw.port) === p
+  _unreachablePorts.set(service, {
+    port: p,
+    updatedAt: same ? (Number(raw.updatedAt) || 0) : 0,
+    pid: same && raw.pid != null ? Number(raw.pid) : null,
+    ts: Date.now(),
+  })
+}
+
+// Raw read of a service advert (no validation). Returns the parsed object or
+// null when absent/unreadable/partial (mid-rename).
+export function readServiceAdvert(service) {
+  try {
+    const raw = JSON.parse(readFileSync(discoveryPath(service), 'utf8'))
+    return raw && typeof raw === 'object' ? raw : null
+  } catch {
+    return null
+  }
+}
+
+// Validated read: returns the advert only when it carries a live port whose
+// owner pid (field `pid`) is still alive. A dead owner → null (stale advert).
+export function readLiveServiceAdvert(service, { requirePid = true } = {}) {
+  const raw = readServiceAdvert(service)
+  if (!raw) return null
+  const port = Number(raw.port)
+  if (!Number.isInteger(port) || port <= 0 || port >= 65536) return null
+  // A port a consumer already proved unreachable this process is treated as an
+  // invalid advert (recycled-pid corpse guard) → fall back to legacy/buffer.
+  // Self-heal: a restart on the same port re-stamps updatedAt / changes pid,
+  // and a stale entry ages out — either clears the distrust and re-trusts.
+  const distrust = _unreachablePorts.get(service)
+  if (distrust && distrust.port === port) {
+    const curUpdatedAt = Number(raw.updatedAt) || 0
+    const curPid = raw.pid != null ? Number(raw.pid) : null
+    const restarted = curUpdatedAt > distrust.updatedAt || curPid !== distrust.pid
+    const expired = Date.now() - distrust.ts > _DISTRUST_TTL_MS
+    if (restarted || expired) _unreachablePorts.delete(service)
+    else return null
+  }
+  if (raw.pid != null) {
+    if (!isPidAlive(raw.pid)) return null
+  } else if (requirePid) {
+    return null
+  }
+  return raw
+}
+
+// Convenience: live port only (or null).
+export function readServicePort(service, opts) {
+  const raw = readLiveServiceAdvert(service, opts)
+  return raw ? Number(raw.port) : null
+}
+
+// Single-writer full-replace advert. Plain atomic rename, NO .lock. Always
+// stamps updatedAt; callers pass port/pid + any extra metadata fields.
+export function writeServiceAdvert(service, fields = {}) {
+  const file = discoveryPath(service)
+  writeJsonAtomicSync(
+    file,
+    { ...fields, updatedAt: Date.now() },
+    { compact: true, fsyncDir: true, renameFallback: 'truncate' },
+  )
+  return file
+}
+
+// Single-writer merge patch: read current advert, apply fields (null/undefined
+// value ⇒ delete key), re-stamp updatedAt. When the merged result no longer
+// advertises a port, the file is removed (clean shutdown). Read-modify-write is
+// race-free enough for a genuine single owner (only the service's supervisor
+// writes its own file).
+export function patchServiceAdvert(service, fields = {}) {
+  const cur = readServiceAdvert(service) ?? {}
+  const merged = { ...cur }
+  for (const [k, v] of Object.entries(fields)) {
+    if (v == null) delete merged[k]
+    else merged[k] = v
+  }
+  const port = Number(merged.port)
+  if (!Number.isInteger(port) || port <= 0) {
+    // No live port left → drop the advert entirely rather than leaving a husk.
+    try { unlinkSync(discoveryPath(service)) } catch {}
+    return null
+  }
+  return writeServiceAdvert(service, merged)
+}

package/src/runtime/shared/spawn-flags.mjs

@@ -0,0 +1,27 @@
+// Centralized child_process spawn/fork flag presets (win32 console-leak fix).
+//
+// win32 rule: DETACHED_PROCESS (Node `detached:true`) makes the OS IGNORE
+// CREATE_NO_WINDOW (Node `windowsHide:true`), so every descendant allocates
+// its own VISIBLE console window. On win32 we therefore NEVER set
+// `detached:true` for hidden background spawns — `windowsHide` alone gives the
+// child a hidden own console that descendants inherit; it survives the parent
+// console closing, and Windows does not kill children on parent exit anyway.
+//
+// POSIX has no console concept, so `windowsHide` is a no-op there and
+// `detached:true` stays REQUIRED: it makes the child a process-group leader so
+// the whole tree can be signalled / tree-killed.
+//
+// Modeled on hermes-agent's _subprocess_compat two-mode split.
+const isWin = process.platform === 'win32';
+
+// Background daemon / process-tree spawns: hidden window everywhere, plus
+// process-group detachment on POSIX only (dropped on win32 per the rule above).
+export const detachedSpawnOpts = Object.freeze({
+  windowsHide: true,
+  ...(isWin ? {} : { detached: true }),
+});
+
+// Short-lived helper spawns that only need the console window hidden on win32.
+export const hiddenSpawnOpts = Object.freeze({
+  windowsHide: true,
+});

package/src/runtime/shared/tool-primitives.mjs

@@ -54,7 +54,9 @@ export function titleCaseMcpServer(server) {
   return String(server || '')
     .split(/[_\s-]+/)
     .filter(Boolean)
-    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1).toLowerCase()}`)
+    .map((part) => (part === part.toLowerCase()
+      ? `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`
+      : part))
     .join(' ');
 }
 

package/src/runtime/shared/tool-surface.mjs

@@ -492,8 +492,14 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'web_search_call':
       return unitDescriptor('Web Research', { count: queryCount(a, 'query', 'queries', 'keywords') || 1, noun: 'query', pluralNoun: 'queries' });
     case 'web_fetch':
-    case 'fetch':
       return unitDescriptor('Web Research', { count: queryCount(a, 'url', 'urls', 'uri', 'uris') || 1, active: 'Fetching', done: 'Fetched', noun: 'URL', pluralNoun: 'URLs' });
+    case 'fetch': {
+      const fetchLimit = Number(a.limit ?? a.messages);
+      const fetchCount = Number.isFinite(fetchLimit) && fetchLimit > 0
+        ? Math.floor(fetchLimit)
+        : queryCount(a, 'messages') || 1;
+      return unitDescriptor('Web Research', { count: fetchCount, active: 'Fetching', done: 'Fetched', noun: 'message' });
+    }
     case 'recall':
     case 'recall_memory':
     case 'search_memories':
@@ -501,8 +507,15 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'remember':
     case 'save_memory':
     case 'update_memory':
-    case 'memory':
       return unitDescriptor('Memory', { count: queryCount(a, 'entries', 'items', 'memories', 'query', 'text', 'value') || 1, active: 'Writing', done: 'Wrote', noun: 'memory item' });
+    case 'memory': {
+      const action = String(a.action || '').toLowerCase();
+      const op = String(a.op || '').toLowerCase();
+      const isMutation = op === 'add' || op === 'edit' || op === 'delete' || op === 'promote' || op === 'dismiss'
+        || (action === 'core' && !op);
+      if (isMutation) return unitDescriptor('Memory', { count: queryCount(a, 'entries', 'items', 'memories', 'query', 'text', 'value') || 1, active: 'Writing', done: 'Wrote', noun: 'memory item' });
+      return unitDescriptor('Memory', { count: queryCount(a, 'entries', 'items', 'memories', 'query', 'text', 'value') || 1, active: 'Checking', done: 'Checked', noun: 'memory item' });
+    }
     case 'explore':
       return unitDescriptor('Explore', { count: queryCount(a, 'query', 'queries', 'prompt', 'task', 'goal') || 1, noun: 'query', pluralNoun: 'queries' });
     case 'shell':
@@ -514,8 +527,11 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'agent':
     case 'bridge':
       return unitDescriptor('Agent', { count: queryCount(a, 'agents', 'roles', 'role', 'tag', 'task_id', 'sessionId') || 1, noun: 'agent' });
-    case 'task':
+    case 'task': {
+      const action = String(a.action || '').toLowerCase();
+      if (action === 'cancel') return unitDescriptor('Task', { count: queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1, active: 'Cancelling', done: 'Cancelled', noun: 'task' });
       return unitDescriptor('Task', { count: queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1, noun: 'task' });
+    }
     case 'skill':
     case 'skill_execute':
     case 'skill_view':

package/src/runtime/shared/update-checker.mjs

@@ -13,11 +13,12 @@
  * the child exits, reporting the resolved version on success.
  */
 
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { resolvePluginData } from './plugin-paths.mjs';
+import { detachedSpawnOpts } from './spawn-flags.mjs';
 
 const PACKAGE_NAME = 'mixdog';
 const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
@@ -29,6 +30,22 @@ const CACHE_FILE_NAME = 'update-check-cache.json';
 // src/runtime/shared/).
 const _MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 const _PACKAGE_JSON_PATH = join(_MODULE_DIR, '..', '..', '..', 'package.json');
+const _PACKAGE_ROOT = dirname(_PACKAGE_JSON_PATH);
+
+/**
+ * isDevInstall() — true when the running mixdog is a git checkout / clone (or
+ * otherwise not a normal npm install), so auto-update must be skipped: an
+ * `npm install -g mixdog@latest` would fight a linked/working-tree package.
+ * Heuristics: a `.git` entry at the package root, OR the package directory not
+ * living under any `node_modules/` path (global & local installs always do).
+ */
+export function isDevInstall() {
+  try {
+    if (existsSync(join(_PACKAGE_ROOT, '.git'))) return true;
+  } catch { /* fall through to path heuristic */ }
+  const norm = _PACKAGE_ROOT.replace(/\\/g, '/').toLowerCase();
+  return !/\/node_modules\//.test(`/${norm}/`);
+}
 
 let _localVersionCache = null;
 export function localPackageVersion() {
@@ -175,23 +192,50 @@ export async function checkLatestVersion({ force = false, dataDir } = {}) {
   };
 }
 
+/**
+ * Resolve npm's JS entrypoint (npm-cli.js) next to the running node binary.
+ * Running `node npm-cli.js …` directly avoids cmd.exe/PowerShell entirely on
+ * Windows: no shell process means no console window can appear (and no
+ * `-WindowStyle Hidden` style flags that antivirus heuristics flag).
+ */
+function npmCliJsPath() {
+  const execDir = dirname(process.execPath);
+  const candidates = [
+    // Windows: npm ships beside node.exe.
+    join(execDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    // Unix layout: <prefix>/bin/node → <prefix>/lib/node_modules/npm.
+    join(execDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+  ];
+  // When launched via npm itself, npm_execpath is authoritative.
+  const envPath = process.env.npm_execpath;
+  if (envPath && /npm-cli\.js$/i.test(envPath)) candidates.unshift(envPath);
+  for (const candidate of candidates) {
+    try { if (existsSync(candidate)) return candidate; } catch { /* keep looking */ }
+  }
+  return null;
+}
+
 /**
  * runGlobalUpdate() — `npm install -g mixdog@latest` in a background child
- * process (windowsHide so no console flash on Windows). Resolves once the
- * child exits; never throws — failures come back as {ok:false, error}.
+ * process. Prefers spawning node.exe with npm-cli.js directly (shell-less, so
+ * Windows never opens a console window); falls back to npm.cmd via shell when
+ * npm-cli.js cannot be located. Resolves once the child exits; never throws —
+ * failures come back as {ok:false, error}.
  */
 export function runGlobalUpdate() {
   return new Promise((resolvePromise) => {
     let child;
     try {
-      const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-      child = spawn(npmCmd, ['install', '-g', `${PACKAGE_NAME}@latest`], {
+      const installArgs = ['install', '-g', `${PACKAGE_NAME}@latest`];
+      const cliJs = npmCliJsPath();
+      const isWin = process.platform === 'win32';
+      const [cmd, args, useShell] = cliJs
+        ? [process.execPath, [cliJs, ...installArgs], false]
+        : [isWin ? 'npm.cmd' : 'npm', installArgs, isWin];
+      child = spawn(cmd, args, {
         stdio: 'ignore',
-        windowsHide: true,
-        // detached: survive parent exit — quitting the TUI mid-install must
-        // not kill npm halfway and leave the global install corrupted.
-        detached: true,
-        shell: process.platform === 'win32',
+        shell: useShell,
+        ...detachedSpawnOpts,
       });
     } catch (err) {
       resolvePromise({ ok: false, error: err?.message || String(err) });