mixdog 0.9.27 → 0.9.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.27",
+  "version": "0.9.29",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -29,6 +29,7 @@
     "!scripts/bench/",
     "!scripts/recall-bench-*.txt",
     "src/",
+    "!src/tui/dev",
     "vendor/"
   ],
   "scripts": {
@@ -62,7 +63,10 @@
     "bench:recall": "node scripts/recall-bench.mjs",
     "audit:models": "node scripts/model-catalog-audit.mjs",
     "patch:replay": "node scripts/patch-replay.mjs",
-    "build:tui": "node scripts/build-tui.mjs"
+    "build:tui": "node scripts/build-tui.mjs",
+    "release:patch": "npm run smoke && npm version patch -m \"mixdog v%s\" && git push --follow-tags origin main",
+    "release:minor": "npm run smoke && npm version minor -m \"mixdog v%s\" && git push --follow-tags origin main",
+    "release:major": "npm run smoke && npm version major -m \"mixdog v%s\" && git push --follow-tags origin main"
   },
   "engines": {
     "node": ">=22.0.0"

package/src/app.mjs

@@ -166,6 +166,20 @@ export async function run(argv = []) {
   }
 
   // Default: the canonical React/Ink TUI over the mixdog session runtime.
+  // DEV convenience (opt-in via MIXDOG_TUI_DEV): rebuild the JSX bundle from
+  // source before launch so local edits reflect without a manual build. The
+  // dev module is excluded from the published package ("files" negation) and
+  // esbuild is a devDependency, so this is a no-op fallback on any install.
+  if (process.env.MIXDOG_TUI_DEV) {
+    try {
+      const { rebuildTuiFromSource } = await import('./tui/dev/jit-rebuild.mjs');
+      await rebuildTuiFromSource();
+    } catch (err) {
+      if (process.env.MIXDOG_TUI_DEV_VERBOSE) {
+        process.stderr.write(`mixdog[tui-dev]: rebuild skipped — ${err?.message ?? err}\n`);
+      }
+    }
+  }
   const bundle = join(__dirname, 'tui', 'dist', 'index.mjs');
   if (!existsSync(bundle)) {
     process.stderr.write(

package/src/rules/lead/lead-tool.md

@@ -5,5 +5,4 @@
   directly.
 - Use the session's current project/workspace. Change the work project only
   when the user asks for another project or a tool call needs another root.
-- Use `agent` for scoped implementation, research, review, and debugging — not
-  for git commit/push/stash or Ship.
+- Use `agent` for scoped implementation, research, review, and debugging.

package/src/rules/shared/01-tool.md

@@ -1,10 +1,12 @@
 # Tool Use
 
-- Every turn carries ALL independent calls you can already specify — a
-  second consecutive single-lookup turn is a defect, not a style choice;
-  serialize only on real data dependency. Merge variants/scopes into ONE
-  call wherever the schema accepts arrays (`pattern[]`, `path[]`,
-  `symbols[]`, `query[]`).
+- BATCH OR IT IS A DEFECT — this is the single hardest rule here. Every turn
+  fires ALL independent calls at once; a second consecutive single-lookup,
+  single-`shell`, or single-`apply_patch` turn is a defect, never a style
+  choice. Serialize ONLY on a real data dependency — nothing else earns a
+  solo call. Merge variants/scopes into ONE call wherever the schema takes
+  arrays (`pattern[]`, `path[]`, `symbols[]`, `query[]`), chain shell with
+  `;`/`&&` or run them in parallel, and put every known edit in ONE patch.
 - Route by what is already known: known symbol/relation → `code_graph`;
   exact text in a known scope → `grep`; unknown location, machine-wide/
   out-of-repo whereabouts, or concept-level question → `explore` (which uses
@@ -33,9 +35,9 @@
   unit (function/section) — over-read once instead of paging the same file
   in small windows across turns; a 3rd window into one file means the first
   should have been wider.
-- Don't mix `apply_patch` with shell or other state-changing calls in one
-  turn; batch independent-file patches in one turn, then verify them all in
-  ONE shell call the next.
-- Consecutive single `shell` or `apply_patch` turns are a batching miss
-  unless output-dependent: chain shell commands with `;`/`&&` or call in
-  parallel; put all known edits in ONE patch.
+- Parallel-first has ONE carve-out: verifying your own edits. Keep an
+  `apply_patch` and the `shell` that checks it in separate turns — not for
+  ordering (same-turn calls run in emit order), but because you must SEE the
+  patch result before verifying: a same-turn shell is already emitted and
+  can't react to a failed or partial patch. Batch the patches this turn,
+  verify them all in ONE shell call the next. Anything else stays parallel.

package/src/runtime/channels/backends/discord-access.mjs

@@ -11,9 +11,7 @@ function defaultAccess() {
 function normalizeAccess(parsed) {
   const defaults = defaultAccess();
   return {
-    // Legacy "pairing" policy was removed (its approval flow was never
-    // completable); normalize it to "allowlist" on load.
-    dmPolicy: parsed?.dmPolicy === "pairing" ? "allowlist" : (parsed?.dmPolicy ?? defaults.dmPolicy),
+    dmPolicy: parsed?.dmPolicy ?? defaults.dmPolicy,
     allowFrom: parsed?.allowFrom ?? defaults.allowFrom,
     channels: parsed?.channels ?? defaults.channels,
     mentionPatterns: parsed?.mentionPatterns,

package/src/runtime/channels/backends/telegram.mjs

@@ -56,7 +56,7 @@ function defaultAccess() {
 function normalizeAccess(parsed) {
   const defaults = defaultAccess();
   return {
-    dmPolicy: parsed?.dmPolicy === "pairing" ? "allowlist" : (parsed?.dmPolicy ?? defaults.dmPolicy),
+    dmPolicy: parsed?.dmPolicy ?? defaults.dmPolicy,
     allowFrom: parsed?.allowFrom ?? defaults.allowFrom,
     channels: parsed?.channels ?? defaults.channels,
     mentionPatterns: parsed?.mentionPatterns,

package/src/runtime/channels/lib/config.mjs

@@ -39,27 +39,10 @@ function channelIdForBackend(entry = {}, backend = "discord") {
 }
 
 // Resolve the single active-backend channel id from the config's `channel`
-// section. Backward compat (read-side only, no on-disk migration): when
-// `channel` is absent, fall back to the legacy `channelsConfig[mainChannel]`
-// entry (or the first entry that carries an id).
+// section. Disk config carries a single `channel` object only.
 function resolveChannelId(raw = {}, backend = "discord") {
   const channel = raw.channel && typeof raw.channel === "object" ? raw.channel : null;
   if (channel) return channelIdForBackend(channel, backend);
-  const legacy = raw.channelsConfig && typeof raw.channelsConfig === "object" ? raw.channelsConfig : null;
-  if (legacy) {
-    const mainName = raw.mainChannel ?? "main";
-    const preferred = legacy[mainName];
-    if (preferred && typeof preferred === "object") {
-      const id = channelIdForBackend(preferred, backend);
-      if (id) return id;
-    }
-    for (const entry of Object.values(legacy)) {
-      if (entry && typeof entry === "object") {
-        const id = channelIdForBackend(entry, backend);
-        if (id) return id;
-      }
-    }
-  }
   return "";
 }
 
@@ -96,13 +79,11 @@ async function loadConfig() {
     const backend = raw.backend === "telegram" ? "telegram" : "discord";
     const telegramToken = getTelegramToken();
     const channelId = resolveChannelId(raw, backend);
-    // Drop legacy multi-channel keys from the returned shape; the runtime
-    // reads only the resolved `channelId` now (read-side compat lives in
-    // resolveChannelId — no on-disk migration).
-    const { channelsConfig: _legacyChannels, mainChannel: _legacyMain, ...rawRest } = raw;
+    // The runtime reads only the resolved `channelId`; disk carries a single
+    // `channel` object, so spread `raw` directly.
     return applyDefaults({
       ...DEFAULT_CONFIG,
-      ...rawRest,
+      ...raw,
       backend,
       channelId,
       discord: { ...DEFAULT_CONFIG.discord, ...(({ token: _, ...rest }) => rest)(raw.discord || {}), ...(discordToken && !discordTokenProblem ? { token: discordToken } : {}) },
@@ -111,12 +92,7 @@ async function loadConfig() {
       telegram: { ...DEFAULT_CONFIG.telegram, ...(({ token: _t, ...rest }) => rest)(raw.telegram || {}), ...(telegramToken ? { token: telegramToken } : {}) },
       access: {
         ...DEFAULT_ACCESS,
-        // Drop the retired pairing-era keys at the config layer too (the
-        // Discord backend's normalizeAccess() is the runtime belt): legacy
-        // dmPolicy "pairing" → "allowlist", and the `pending` code store is
-        // gone entirely.
-        ...(({ pending: _pending, ...rest }) => rest)(raw.access || {}),
-        ...(raw.access?.dmPolicy === "pairing" ? { dmPolicy: "allowlist" } : {}),
+        ...(raw.access || {}),
         channels: accessChannels,
       },
       voice: { ...(raw.voice || {}), ...voice }

package/src/runtime/memory/tool-defs.mjs

@@ -30,7 +30,7 @@ export const TOOL_DEFS = [
     name: 'recall',
     title: 'Recall',
     annotations: { title: 'Recall', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-    description: 'Retrieve stored memory/session history. Use only to check prior conversation or past events: resumes, prior work, earlier decisions or messages. Do not call as a reflexive pre-step, to verify a just-made decision, or before storing memory. Query is topic/semantic search, not regex. Patterns: period:"last" for previous conversation; sessionId without query for current session; period:"3h"/"30m"/"24h" for recent; YYYY-MM-DD, date ranges, or HH:MM~HH:MM for time windows; id for exact follow-up.',
+    description: 'Retrieve stored memory/session history. Call when a task ties to prior work — resumes, continuations, or references to earlier decisions/messages. Do not call as a reflexive pre-step, to verify a just-made decision, or before storing memory. Query is topic/semantic search, not regex. Patterns: period:"last" for previous conversation; sessionId without query for current session; period:"3h"/"30m"/"24h" for recent; YYYY-MM-DD, date ranges, or HH:MM~HH:MM for time windows; id for exact follow-up.',
     inputSchema: {
       type: 'object',
       properties: {

package/src/runtime/shared/config.mjs

@@ -315,14 +315,9 @@ export function diagnoseDiscordTokenValue(value, config = {}) {
   const discord = config?.discord && typeof config.discord === 'object' ? config.discord : {}
   const appId = String(discord.applicationId || '').trim()
   if (appId && token === appId) return 'Bot token field contains the Application ID, not the bot token.'
-  // Single main channel: check the `channel` object. Legacy `channelsConfig`
-  // is still read here (read-only) so the diagnostic keeps working on configs
-  // that predate the single-channel collapse.
+  // Single main channel: check the `channel` object.
   const candidateEntries = []
   if (config?.channel && typeof config.channel === 'object') candidateEntries.push(config.channel)
-  if (config?.channelsConfig && typeof config.channelsConfig === 'object') {
-    candidateEntries.push(...Object.values(config.channelsConfig))
-  }
   for (const ch of candidateEntries) {
     if (!ch || typeof ch !== 'object') continue
     for (const id of [ch.channelId, ch.discordChannelId, ch.telegramChatId]) {

package/src/runtime/shared/schedules-db.mjs

@@ -3,10 +3,8 @@
  * schedules (schema `scheduler`, table `scheduler.schedules`).
  *
  * All schedule readers/writers (scheduler.mjs, config.mjs, channel-admin.mjs)
- * go through this module. Legacy `<dataDir>/schedules/<name>/SCHEDULE.md`
- * files are imported once by the migration hook in getDb and the directory is
- * renamed to `schedules.migrated`; the old file-based schedules-store.mjs has
- * been removed.
+ * go through this module. It is the sole store for schedules; the old
+ * file-based schedules-store.mjs has been retired.
  *
  * DDL is idempotent and runs once on the first call per process. All queries
  * fully-qualify `scheduler.schedules` so they are correct regardless of the
@@ -15,9 +13,6 @@
 
 import { ensurePgInstance, withSchemaBootstrapLock } from '../memory/lib/pg/adapter.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
-import { readdirSync, readFileSync, renameSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { readMarkdownDocument } from './markdown-frontmatter.mjs';
 
 const SCHEMA = 'scheduler';
 
@@ -58,7 +53,6 @@ async function getDb(dataDir = resolvePluginData()) {
     // same cluster-global advisory lock the adapter uses for schema bootstrap,
     // so racing first calls can't run the DDL simultaneously.
     await withSchemaBootstrapLock(pool, () => db.exec(DDL));
-    await migrateLegacySchedules(db, dataDir);
     return db;
   })();
   _ready.set(dataDir, p);
@@ -70,118 +64,6 @@ async function getDb(dataDir = resolvePluginData()) {
   }
 }
 
-// ---------------------------------------------------------------------------
-// One-time legacy SCHEDULE.md migration (additive; runs once per dataDir on
-// first getDb, right after DDL). Imports every `<dataDir>/schedules/<name>/
-// SCHEDULE.md` not already present in the table (by name), using the same
-// days->cron folding as the admin write path, then renames the directory to
-// `schedules.migrated` (never deletes user data). Per-entry failures are
-// isolated and never block store readiness.
-// ---------------------------------------------------------------------------
-
-// Day-name / keyword -> cron day-of-week number (Sun=0 .. Sat=6).
-const MIGRATE_DAY_TO_DOW = {
-  sun: 0, sunday: 0,
-  mon: 1, monday: 1,
-  tue: 2, tues: 2, tuesday: 2,
-  wed: 3, weds: 3, wednesday: 3,
-  thu: 4, thur: 4, thurs: 4, thursday: 4,
-  fri: 5, friday: 5,
-  sat: 6, saturday: 6,
-};
-
-function foldLegacyDaysIntoCron(cron, days) {
-  const parts = String(cron || '').trim().split(/\s+/).filter(Boolean);
-  if (parts.length !== 5 && parts.length !== 6) {
-    throw new Error(`invalid cron "${cron}"`);
-  }
-  const raw = String(days || '').trim().toLowerCase();
-  const dowIndex = parts.length - 1;
-  // days absent -> keep the cron's own day-of-week field ('0 9 * * 1' stays
-  // Monday-only). Only an explicit selector rewrites the dow field.
-  if (!raw) return parts.join(' ');
-  let dow;
-  if (raw === 'daily' || raw === 'everyday' || raw === 'every day') dow = '*';
-  else if (raw === 'weekday' || raw === 'weekdays') dow = '1-5';
-  else if (raw === 'weekend' || raw === 'weekends') dow = '0,6';
-  else {
-    const nums = raw.split(/[\s,]+/).filter(Boolean).map((t) => (
-      /^[0-6]$/.test(t) ? Number(t) : MIGRATE_DAY_TO_DOW[t]
-    ));
-    if (nums.some((n) => n === undefined)) {
-      throw new Error(`days "${days}" is not a recognizable day selector`);
-    }
-    dow = nums.join(',');
-  }
-  parts[dowIndex] = dow;
-  return parts.join(' ');
-}
-
-async function migrateLegacySchedules(db, dataDir) {
-  const dir = join(dataDir, 'schedules');
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return; // no legacy schedules/ dir -> nothing to migrate
-  }
-  let imported = 0;
-  let skipped = 0;
-  const failed = [];
-  for (const ent of entries) {
-    if (!ent.isDirectory()) continue;
-    const name = ent.name;
-    try {
-      const { rows } = await db.query('SELECT 1 FROM scheduler.schedules WHERE name = $1', [name]);
-      if (rows.length) { skipped++; continue; }
-      let md;
-      try { md = readFileSync(join(dir, name, 'SCHEDULE.md'), 'utf8'); }
-      catch { skipped++; continue; }
-      const { frontmatter, body } = readMarkdownDocument(md);
-      const cron = foldLegacyDaysIntoCron(frontmatter.time, frontmatter.days);
-      const channel = String(frontmatter.channel || '').trim();
-      const enabled = frontmatter.enabled !== 'false' && frontmatter.enabled !== false;
-      await db.query(
-        `INSERT INTO scheduler.schedules
-           (name, description, when_cron, timezone, target, channel_id, model, prompt, enabled)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
-         ON CONFLICT (name) DO NOTHING`,
-        [
-          name,
-          String(frontmatter.description || '').trim(),
-          cron,
-          frontmatter.timezone ? String(frontmatter.timezone).trim() : null,
-          channel ? 'channel' : 'session',
-          channel || null,
-          frontmatter.model ? String(frontmatter.model).trim() : null,
-          String(body || '').trim(),
-          enabled,
-        ],
-      );
-      imported++;
-    } catch (err) {
-      failed.push(name);
-      console.error(`[schedules] migration failed for "${name}": ${err?.message || err}`);
-    }
-  }
-  if (failed.length) {
-    // Some entries failed to import. Leave schedules/ in place (do NOT rename)
-    // so the next boot retries them; already-imported entries are skipped by
-    // the name check above, so retry is idempotent.
-    console.error(`[schedules] migrated ${imported} legacy schedule(s), ${failed.length} failed (${failed.join(', ')}); leaving schedules/ for retry`);
-    return;
-  }
-  try {
-    let target = `${dir}.migrated`;
-    if (existsSync(target)) target = `${dir}.migrated-${Date.now()}`;
-    renameSync(dir, target);
-  } catch (err) {
-    console.error(`[schedules] migrated ${imported} legacy schedule(s) but could not rename schedules/: ${err?.message || err}`);
-    return;
-  }
-  console.error(`[schedules] migrated ${imported} legacy schedule(s) (${skipped} skipped); renamed schedules/ -> schedules.migrated`);
-}
-
 // ---------------------------------------------------------------------------
 // Row <-> def mapping
 // ---------------------------------------------------------------------------

package/src/runtime/shared/webhooks-db.mjs

@@ -6,11 +6,9 @@
  * This module mirrors schedules-db.mjs: a lazy connection keyed per resolved
  * dataDir runs idempotent DDL exactly once per process, serialized across
  * concurrent first-boot processes on the adapter's schema-bootstrap advisory
- * lock. It covers the file-store API surface currently in
- * channels/lib/webhook/deliveries.mjs (loadEndpointConfig, appendDelivery,
- * deliveryExists, _readEndpointSecret) so call sites can migrate off the
- * per-endpoint WEBHOOK.md + deliveries.jsonl files later. No call-site
- * changes are made in this scope.
+ * lock. It is the sole store for endpoints + delivery dedup; the old
+ * per-endpoint WEBHOOK.md + deliveries.jsonl file store is fully retired
+ * (webhook.mjs reads/writes only through here).
  *
  * All queries fully-qualify their tables so they are correct regardless of
  * the connection search_path.
@@ -18,9 +16,6 @@
 
 import { ensurePgInstance, withSchemaBootstrapLock } from '../memory/lib/pg/adapter.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
-import { readdirSync, readFileSync, rmSync, rmdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { readMarkdownDocument } from './markdown-frontmatter.mjs';
 
 const SCHEMA = 'webhooks';
 
@@ -67,7 +62,6 @@ async function getDb(dataDir = resolvePluginData()) {
     // same cluster-global advisory lock the adapter uses for schema bootstrap,
     // so racing first calls can't run the DDL simultaneously.
     await withSchemaBootstrapLock(pool, () => db.exec(DDL));
-    await migrateLegacyWebhooks(db, dataDir);
     return db;
   })();
   _ready.set(dataDir, p);
@@ -79,91 +73,6 @@ async function getDb(dataDir = resolvePluginData()) {
   }
 }
 
-// ---------------------------------------------------------------------------
-// One-time legacy WEBHOOK.md migration (additive; runs once per dataDir on
-// first getDb, right after DDL). Imports every `<dataDir>/webhooks/<name>/
-// WEBHOOK.md` (+ its `secret` side file) not already present in the table (by
-// name), then DELETES the webhooks/ directory. The legacy file reading is
-// inlined here on purpose so this migration never depends on the file-store
-// deliveries.mjs module (which another scope may remove). Old per-endpoint
-// deliveries files are intentionally NOT imported — dedup history resets,
-// which is acceptable. Partial failure keeps the directory in place and logs,
-// so the next boot retries the un-imported entries idempotently.
-// ---------------------------------------------------------------------------
-async function migrateLegacyWebhooks(db, dataDir) {
-  const dir = join(dataDir, 'webhooks');
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return; // no legacy webhooks/ dir -> nothing to migrate
-  }
-  let imported = 0;
-  let skipped = 0;
-  const failed = [];
-  // Per-endpoint dirs safe to delete this run: those imported now, or already
-  // present in the table (a prior run imported them). Anything unrecognized —
-  // a dir with no WEBHOOK.md, a stray file, a failed import — is left in place.
-  const removable = [];
-  for (const ent of entries) {
-    if (!ent.isDirectory()) continue;
-    const name = ent.name;
-    try {
-      const { rows } = await db.query('SELECT 1 FROM webhooks.endpoints WHERE name = $1', [name]);
-      if (rows.length) { skipped++; removable.push(name); continue; }
-      let md;
-      try { md = readFileSync(join(dir, name, 'WEBHOOK.md'), 'utf8'); }
-      catch { skipped++; continue; }
-      const { frontmatter, body } = readMarkdownDocument(md);
-      let secret = null;
-      try { secret = String(readFileSync(join(dir, name, 'secret'), 'utf8')).trim() || null; }
-      catch { secret = null; }
-      const channel = String(frontmatter.channel || '').trim();
-      const enabled = frontmatter.enabled !== 'false' && frontmatter.enabled !== false;
-      await db.query(
-        `INSERT INTO webhooks.endpoints
-           (name, description, channel_id, role, model, parser, secret, instructions, enabled)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
-         ON CONFLICT (name) DO NOTHING`,
-        [
-          name,
-          String(frontmatter.description || '').trim(),
-          channel || null,
-          'webhook-handler',
-          frontmatter.model ? String(frontmatter.model).trim() : null,
-          frontmatter.parser ? String(frontmatter.parser).trim() : null,
-          secret,
-          String(body || '').trim(),
-          enabled,
-        ],
-      );
-      imported++;
-      removable.push(name);
-    } catch (err) {
-      failed.push(name);
-      console.error(`[webhooks] migration failed for "${name}": ${err?.message || err}`);
-    }
-  }
-  // User chose deletion over a `.migrated` rename. Delete only the recognized
-  // per-endpoint dirs (imported now or already in the table); never blow away
-  // unimported/unrelated entries. Failed imports keep their dir for the next
-  // boot to retry (idempotent via the name check above).
-  for (const name of removable) {
-    try { rmSync(join(dir, name), { recursive: true, force: true }); }
-    catch (err) { console.error(`[webhooks] could not delete migrated dir "${name}": ${err?.message || err}`); }
-  }
-  // Remove the parent webhooks/ only once it is empty — anything unrecognized
-  // (stray files, WEBHOOK.md-less dirs, failed imports) keeps it alive.
-  let parentGone = false;
-  try {
-    if (readdirSync(dir).length === 0) { rmdirSync(dir); parentGone = true; }
-  } catch (err) {
-    console.error(`[webhooks] could not remove empty webhooks/: ${err?.message || err}`);
-  }
-  const tail = failed.length ? `${failed.length} failed (${failed.join(', ')}); ` : '';
-  console.error(`[webhooks] migrated ${imported} legacy webhook(s) (${skipped} skipped); ${tail}${parentGone ? 'removed webhooks/' : 'kept webhooks/ (non-empty)'}`);
-}
-
 // ---------------------------------------------------------------------------
 // Row <-> def mapping
 // ---------------------------------------------------------------------------
@@ -340,30 +249,6 @@ export async function claimDelivery(endpoint, deliveryId, fields = {}, { dataDir
   return { claimed: false, duplicate: true, row: rowToDelivery(existing[0]) };
 }
 
-/**
- * True when a delivery id has already been recorded for the endpoint (any
- * status). Callers wanting terminal-vs-inflight semantics inspect the row via
- * getDelivery; claimDelivery is the race-safe gate.
- */
-export async function deliveryExists(endpoint, deliveryId, { dataDir } = {}) {
-  if (!endpoint || !deliveryId) return false;
-  const db = await getDb(dataDir);
-  const { rows } = await db.query(
-    'SELECT 1 FROM webhooks.deliveries WHERE endpoint = $1 AND delivery_id = $2',
-    [endpoint, deliveryId],
-  );
-  return rows.length > 0;
-}
-
-export async function getDelivery(endpoint, deliveryId, { dataDir } = {}) {
-  const db = await getDb(dataDir);
-  const { rows } = await db.query(
-    `SELECT ${DELIVERY_COLS} FROM webhooks.deliveries WHERE endpoint = $1 AND delivery_id = $2`,
-    [endpoint, deliveryId],
-  );
-  return rowToDelivery(rows[0]);
-}
-
 /**
  * Update the status (and optional event/error) of an existing delivery,
  * keyed by (endpoint, delivery_id). Returns the updated row or null.
@@ -383,23 +268,3 @@ export async function updateDeliveryStatus(endpoint, deliveryId, status, fields
   );
   return rowToDelivery(rows[0]);
 }
-
-/**
- * Append a delivery record (claim-or-update convenience covering the old
- * appendDelivery). First write for an id claims it; a later write with the
- * same id updates its status/fields latest-wins.
- *
- * Returns the claim outcome — { claimed, duplicate, row } — NOT a bare row,
- * so a pre-dispatch caller can detect a concurrent duplicate (claimed:false,
- * duplicate:true) and skip re-dispatching an in-flight delivery. `row` is the
- * freshly claimed row when claimed, else the existing row after the
- * latest-wins status/fields update.
- */
-export async function appendDelivery(endpoint, entry = {}, { dataDir } = {}) {
-  const deliveryId = entry.deliveryId ?? entry.id;
-  if (!endpoint || !deliveryId) throw new Error('appendDelivery: endpoint and deliveryId are required');
-  const claim = await claimDelivery(endpoint, deliveryId, entry, { dataDir });
-  if (claim.claimed) return claim;
-  const row = await updateDeliveryStatus(endpoint, deliveryId, entry.status ?? claim.row?.status, entry, { dataDir });
-  return { claimed: false, duplicate: true, row };
-}

package/src/session-runtime/runtime-core.mjs

@@ -16,7 +16,7 @@ import { cancelBackgroundTasks } from '../runtime/shared/background-tasks.mjs';
 import { createTranscriptWriter } from '../runtime/shared/transcript-writer.mjs';
 import { mixdogHome } from '../runtime/shared/plugin-paths.mjs';
 import { checkLatestVersion, localPackageVersion, isDevInstall } from '../runtime/shared/update-checker.mjs';
-import { spawnStagedInstall, runStagedInstall } from '../runtime/shared/staged-update.mjs';
+import { spawnStagedInstall, runStagedInstall, isStagedComplete } from '../runtime/shared/staged-update.mjs';
 import {
   modelVisibleToolCompletionMessage,
   shouldPersistModelVisibleToolCompletion,
@@ -713,15 +713,37 @@ export async function createMixdogSessionRuntime({
   const updateBootTimer = setTimeout(() => {
     void (async () => {
       await checkForUpdateInternal({ force: true });
-      if (autoUpdateEnabled() && !isDevInstall() && updateCheckState.updateAvailable) {
-        const ver = updateCheckState.latestVersion;
-        try { spawnStagedInstall(ver); } catch { /* best-effort background stage */ }
-        const v = ver ? `v${ver}` : 'latest';
-        // UI-only notice (TUI maps meta.kind 'update-notice' to a transcript
-        // notice, never a model-visible message). tone 'info': non-urgent,
-        // staging runs quietly and applies on the next launch.
-        emitRuntimeNotification(`mixdog ${v} staging in background — applies on next launch.`, { kind: 'update-notice', tone: 'info' });
-      }
+      if (!(autoUpdateEnabled() && !isDevInstall() && updateCheckState.updateAvailable)) return;
+      const ver = updateCheckState.latestVersion;
+      if (!ver) return;
+      // The notice fires ONLY once staging has completed (a ready-to-apply
+      // package sits on disk) — never upfront — so the user sees no "update
+      // available / installs on quit" nag while the background stage runs
+      // silently. The wording lives in the notice surface (notification-plan):
+      // this emit only carries meta.version. TUI maps meta.kind 'update-notice'
+      // to a transcript notice, never a model-visible message; tone 'info' =
+      // non-urgent, applies on the next launch.
+      const announceReady = () => {
+        emitRuntimeNotification('update ready', { kind: 'update-notice', version: ver, tone: 'info' });
+      };
+      // Already staged in a prior session → announce immediately.
+      if (isStagedComplete(ver)) { announceReady(); return; }
+      try { spawnStagedInstall(ver); } catch { /* best-effort background stage */ }
+      // Poll for staging completion, then announce once. The interval is
+      // unref'd so it never holds the process open, and gives up silently
+      // after the cap — the next launch retries.
+      const POLL_MS = 3_000;
+      const MAX_MS = 10 * 60 * 1000;
+      const startedAt = Date.now();
+      const poll = setInterval(() => {
+        if (isStagedComplete(ver)) {
+          clearInterval(poll);
+          announceReady();
+        } else if (Date.now() - startedAt > MAX_MS) {
+          clearInterval(poll);
+        }
+      }, POLL_MS);
+      poll.unref?.();
     })().catch(() => {});
   }, 0);
   updateBootTimer.unref?.();

package/src/standalone/agent-tool/tool-def.mjs

@@ -35,7 +35,7 @@ export const AGENT_TOOL = {
     openWorldHint: true,
     agentHidden: true,
   },
-  description: 'Delegate scoped work. Agent handoffs always start background tasks and return task IDs immediately. Spawn independent scopes in parallel with distinct tags; for the same scope, use send or spawn with the same tag to reuse the live session. Wait for the completion notification before dependent work. Do not call status/read after spawn; they are manual recovery only.',
+  description: 'Delegate scoped work. Agent handoffs always start background tasks and return task IDs immediately. Spawn every independent scope in parallel in the same turn, each with a distinct tag; for the same scope, use send or spawn with the same tag to reuse the live session. Wait for the completion notification before dependent work. Do not call status/read after spawn; they are manual recovery only.',
   inputSchema: {
     type: 'object',
     properties: {