mixdog 0.9.44 → 0.9.46

package/src/runtime/shared/pristine-execution-contract.json

@@ -0,0 +1,75 @@
+{
+  "schemaVersion": 1,
+  "configFileName": "mixdog-config.json",
+  "guardEnv": {
+    "MIXDOG_DISABLE_MCP": "1",
+    "MIXDOG_DISABLE_SKILLS": "1",
+    "MIXDOG_BOOT_CORE_MEMORY": "0",
+    "MIXDOG_DISABLE_CHANNEL_START": "1",
+    "MIXDOG_SKIP_USER_DATA_BACKUP": "1",
+    "MIXDOG_DISABLE_STAGED_INSTALL": "1",
+    "MIXDOG_DISABLE_STAGED_SWAP": "1"
+  },
+  "approvedExecutionEnv": [
+    "MIXDOG_AGENT_TRACE_PATH",
+    "MIXDOG_ANTHROPIC_OAUTH_REFRESH_DISABLED",
+    "MIXDOG_DRIVER_DEADLINE_MS",
+    "MIXDOG_DISABLE_PROVIDER_WARMUP",
+    "MIXDOG_DISABLE_MODEL_PREFETCH",
+    "MIXDOG_DISABLE_MODEL_CATALOG_WARMUP",
+    "MIXDOG_PROVIDER_FIRST_BYTE_TIMEOUT_MS",
+    "MIXDOG_STALL_FIRST_BYTE_ABORT_S"
+  ],
+  "benchmarkRouteEnv": [
+    "MIXDOG_PROMPT",
+    "MIXDOG_PROVIDER",
+    "MIXDOG_MODEL",
+    "MIXDOG_EFFORT",
+    "MIXDOG_FAST",
+    "MIXDOG_WORKFLOW"
+  ],
+  "oauthProviders": {
+    "anthropic-oauth": {
+      "credentialFile": "anthropic-oauth-credentials.json",
+      "credentialPathEnv": "ANTHROPIC_OAUTH_CREDENTIALS_PATH",
+      "modelCatalogFile": "anthropic-oauth-models.json"
+    },
+    "openai-oauth": {
+      "credentialFile": "openai-oauth.json",
+      "credentialPathEnv": "OPENAI_OAUTH_CREDENTIALS_PATH",
+      "modelCatalogFile": "openai-oauth-models.json"
+    },
+    "grok-oauth": {
+      "credentialFile": "grok-oauth.json",
+      "credentialPathEnv": "GROK_OAUTH_CREDENTIALS_PATH",
+      "modelCatalogFile": "grok-oauth-models.json"
+    }
+  },
+  "apiKeyProviders": {
+    "openai": "OPENAI_API_KEY",
+    "anthropic": "ANTHROPIC_API_KEY",
+    "gemini": "GEMINI_API_KEY",
+    "deepseek": "DEEPSEEK_API_KEY",
+    "xai": "XAI_API_KEY",
+    "opencode-go": "OPENCODE_API_KEY"
+  },
+  "personalStateCounters": [
+    "behavioralStateFilesCopied",
+    "memoryFilesCopied",
+    "sessionFilesCopied",
+    "userProfileFilesCopied",
+    "pluginStateFilesCopied",
+    "channelStateFilesCopied",
+    "otherPersonalStateFilesCopied"
+  ],
+  "disabledFeatures": [
+    "mcpSources",
+    "skills",
+    "bundledSkillSeeding",
+    "coreMemoryBoot",
+    "channelStart",
+    "plugins",
+    "userProfiles",
+    "priorSessions"
+  ]
+}

package/src/runtime/shared/pristine-execution.mjs

@@ -0,0 +1,356 @@
+import { createHash } from 'node:crypto';
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { replaceProviderAuthBindings } from './provider-auth-binding.mjs';
+import {
+  AGENT_PROVIDER_ENV_ALIASES,
+  getAgentApiKey,
+} from './provider-api-key.mjs';
+
+const contractPath = fileURLToPath(
+  new URL('./pristine-execution-contract.json', import.meta.url),
+);
+const patchManifestPath = fileURLToPath(
+  new URL('../agent/orchestrator/tools/patch-manifest.json', import.meta.url),
+);
+
+export const PRISTINE_EXECUTION_CONTRACT = Object.freeze(
+  JSON.parse(readFileSync(contractPath, 'utf8')),
+);
+
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+
+function clean(value) {
+  return String(value ?? '').trim();
+}
+
+export function validateExplicitPristineRoute({ provider, model, effort, fast } = {}) {
+  const selectedProvider = clean(provider);
+  const selectedModel = clean(model);
+  if (!selectedProvider || !selectedModel) {
+    return 'headless role commands require both --provider <name> and --model <name>; host route fallback is disabled';
+  }
+  const selectedEffort = clean(effort).toLowerCase();
+  if (selectedEffort && !EFFORTS.has(selectedEffort)) {
+    return `invalid --effort ${JSON.stringify(clean(effort))}; expected low, medium, high, xhigh, or max`;
+  }
+  if (fast !== undefined && typeof fast !== 'boolean') {
+    return '--fast must be an explicit boolean flag';
+  }
+  return null;
+}
+
+export function buildMinimalPristineConfig({ provider, model, effort, fast } = {}) {
+  const routeError = validateExplicitPristineRoute({ provider, model, effort, fast });
+  if (routeError) throw new Error(routeError);
+  const selectedProvider = clean(provider);
+  const selectedModel = clean(model);
+  const selectedEffort = clean(effort).toLowerCase();
+  const route = {
+    provider: selectedProvider,
+    model: selectedModel,
+    ...(selectedEffort ? { effort: selectedEffort } : {}),
+    ...(fast === true ? { fast: true } : {}),
+  };
+  const providerConfig = {
+    enabled: true,
+    ...(selectedProvider === 'openai-oauth' ? { websocket: true } : {}),
+  };
+  const modelSettings = {};
+  if (selectedEffort || fast === true) {
+    modelSettings[`${selectedProvider}/${selectedModel}`] = {
+      ...(selectedEffort ? { effort: selectedEffort } : {}),
+      ...(fast === true ? { fast: true } : {}),
+    };
+  }
+  return {
+    agent: {
+      providers: { [selectedProvider]: providerConfig },
+      presets: [{
+        id: 'headless-explicit-route',
+        name: 'HEADLESS EXPLICIT ROUTE',
+        type: 'agent',
+        tools: 'full',
+        ...route,
+      }],
+      default: 'headless-explicit-route',
+      workflow: { active: 'default' },
+      workflowRoutes: {},
+      agents: {},
+      modelSettings,
+      mcpServers: {},
+    },
+  };
+}
+
+function cloneJson(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+export function createSelectedProviderPristineLoader({
+  config,
+  provider,
+  apiKey = null,
+} = {}) {
+  const selectedProvider = clean(provider);
+  const runtimeConfig = cloneJson(config?.agent || {});
+  const selectedConfig = {
+    ...(runtimeConfig.providers?.[selectedProvider] || {}),
+    enabled: true,
+    ...(apiKey ? { apiKey } : {}),
+  };
+  runtimeConfig.providers = { [selectedProvider]: selectedConfig };
+  return () => cloneJson(runtimeConfig);
+}
+
+function hostDataDir(env) {
+  if (clean(env.MIXDOG_DATA_DIR)) return resolve(env.MIXDOG_DATA_DIR);
+  const home = clean(env.MIXDOG_HOME)
+    ? resolve(env.MIXDOG_HOME)
+    : join(homedir(), '.mixdog');
+  return join(home, 'data');
+}
+
+function patchPlatformKey() {
+  const os = process.platform === 'win32' ? 'win32' : process.platform;
+  return `${os}-${process.arch}`;
+}
+
+export function seedVerifiedPatchBinaryCache(
+  sourceDataDir,
+  dataDir,
+  { manifestPath = patchManifestPath } = {},
+) {
+  try {
+    const sourcePatchDir = join(sourceDataDir, 'patch-bin');
+    const manifestBytes = readFileSync(manifestPath);
+    const manifest = JSON.parse(manifestBytes.toString('utf8'));
+    const asset = manifest?.assets?.[patchPlatformKey()];
+    const version = String(manifest?.version || '');
+    const expectedSha256 = clean(asset?.sha256).toLowerCase();
+    if (!/^[A-Za-z0-9._-]+$/.test(version) || !/^[a-f0-9]{64}$/.test(expectedSha256)) return false;
+
+    const binaryName = `mixdog-patch-${version}${process.platform === 'win32' ? '.exe' : ''}`;
+    const sourceBinary = join(sourcePatchDir, binaryName);
+    if (!existsSync(sourceBinary)) return false;
+    const binaryBytes = readFileSync(sourceBinary);
+    const actualSha256 = createHash('sha256').update(binaryBytes).digest('hex');
+    if (actualSha256 !== expectedSha256) return false;
+
+    const targetPatchDir = join(dataDir, 'patch-bin');
+    mkdirSync(targetPatchDir, { recursive: true, mode: 0o700 });
+    writeFileSync(join(targetPatchDir, binaryName), binaryBytes, { mode: 0o700 });
+    writeFileSync(join(targetPatchDir, 'manifest.json'), manifestBytes, { mode: 0o600 });
+    return true;
+  } catch {
+    // A missing, stale, or malformed host cache is optional acceleration only.
+    // Leave the pristine runtime empty so the normal fetch path handles it.
+    return false;
+  }
+}
+
+function auditDocument({
+  provider,
+  model,
+  effort,
+  fast,
+  configBytes,
+  authMode,
+  catalogCount,
+}) {
+  const contract = PRISTINE_EXECUTION_CONTRACT;
+  return {
+    schemaVersion: contract.schemaVersion,
+    mode: 'headless-role-pristine',
+    provider: clean(provider),
+    model: clean(model),
+    effort: clean(effort).toLowerCase() || null,
+    fast: fast === true,
+    configSha256: createHash('sha256').update(configBytes).digest('hex'),
+    authMode,
+    authArtifactFilesCopied: 0,
+    injectedModelCatalogFileCount: catalogCount,
+    personalState: {
+      hostConfigRead: false,
+      ...Object.fromEntries(contract.personalStateCounters.map((name) => [name, 0])),
+    },
+    featuresEnabled: Object.fromEntries(
+      contract.disabledFeatures.map((name) => [name, false]),
+    ),
+  };
+}
+
+export function formatPristineExecutionAudit(audit) {
+  return [
+    `pristine-execution-audit v${audit.schemaVersion}`,
+    'mode=headless-role',
+    'personal-files=0',
+    'host-config=0',
+    'mcp=0',
+    'skills=0',
+    'core-memory=0',
+    'channels=0',
+    'plugins=0',
+    'profiles=0',
+    'prior-sessions=0',
+    `provider=${audit.provider}`,
+    `model=${audit.model}`,
+    `effort=${audit.effort || 'provider-default'}`,
+    `fast=${String(audit.fast)}`,
+    `auth=${audit.authMode}`,
+    `catalogs=${audit.injectedModelCatalogFileCount}`,
+  ].join(' ');
+}
+
+export function createPristineExecutionBoundary({
+  provider,
+  model,
+  effort,
+  fast,
+  env = process.env,
+  approvedExecutionEnv = {},
+  apiKeyResolver = getAgentApiKey,
+} = {}) {
+  const routeError = validateExplicitPristineRoute({ provider, model, effort, fast });
+  if (routeError) throw new Error(routeError);
+
+  const contract = PRISTINE_EXECUTION_CONTRACT;
+  const hostEnv = { ...env };
+  const originalEnv = new Map();
+  const touchedKeys = new Set();
+  const setEnv = (name, value) => {
+    if (!touchedKeys.has(name)) {
+      originalEnv.set(name, Object.prototype.hasOwnProperty.call(env, name) ? env[name] : undefined);
+      touchedKeys.add(name);
+    }
+    env[name] = String(value);
+  };
+  const unsetEnv = (name) => {
+    if (!touchedKeys.has(name)) {
+      originalEnv.set(name, Object.prototype.hasOwnProperty.call(env, name) ? env[name] : undefined);
+      touchedKeys.add(name);
+    }
+    delete env[name];
+  };
+  const rootDir = mkdtempSync(join(tmpdir(), 'mixdog-headless-pristine-'));
+  const dataDir = join(rootDir, 'data');
+  mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+  let cleaned = false;
+  let restoreAuthBindings = () => {};
+  const cleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    for (const [name, value] of originalEnv) {
+      if (value === undefined) delete env[name];
+      else env[name] = value;
+    }
+    restoreAuthBindings();
+    rmSync(rootDir, { recursive: true, force: true });
+  };
+
+  try {
+    const sourceDataDir = hostDataDir(hostEnv);
+    seedVerifiedPatchBinaryCache(sourceDataDir, dataDir);
+    const approvedNames = new Set(contract.approvedExecutionEnv || []);
+    for (const name of Object.keys(approvedExecutionEnv || {})) {
+      if (!approvedNames.has(name)) {
+        throw new Error(`unapproved pristine execution environment override: ${name}`);
+      }
+    }
+    const inheritedExecutionEnv = Object.fromEntries(
+      [...approvedNames]
+        .filter((name) => hostEnv[name] !== undefined)
+        .map((name) => [name, hostEnv[name]]),
+    );
+    const selectedProvider = clean(provider);
+    const oauth = contract.oauthProviders[selectedProvider];
+    const apiKeyEnv = contract.apiKeyProviders[selectedProvider];
+    let selectedApiKey = null;
+    if (apiKeyEnv) {
+      // Resolve before scrubbing so the selected provider may use its standard,
+      // MIXDOG_AGENT_*, alias, or one provider-scoped keychain account. No
+      // general config loader or all-provider credential scan is involved.
+      selectedApiKey = clean(apiKeyResolver(selectedProvider));
+    }
+    // Fail closed: no inherited Mixdog behavior reaches the child runtime.
+    // Only contract-listed operational controls are reintroduced below.
+    for (const name of Object.keys(env)) {
+      if (name.startsWith('MIXDOG_')) unsetEnv(name);
+    }
+    for (const entry of Object.values(contract.oauthProviders)) {
+      unsetEnv(entry.credentialPathEnv);
+    }
+    for (const name of Object.values(contract.apiKeyProviders)) unsetEnv(name);
+    for (const aliases of Object.values(AGENT_PROVIDER_ENV_ALIASES)) {
+      for (const name of aliases) unsetEnv(name);
+    }
+    setEnv('MIXDOG_HOME', rootDir);
+    setEnv('MIXDOG_DATA_DIR', dataDir);
+    for (const [name, value] of Object.entries({
+      ...inheritedExecutionEnv,
+      ...approvedExecutionEnv,
+    })) {
+      setEnv(name, value);
+    }
+    for (const [name, value] of Object.entries(contract.guardEnv)) setEnv(name, value);
+
+    let authMode = 'provider-managed';
+    let catalogCount = 0;
+    if (oauth) {
+      const sourceCredential = clean(hostEnv[oauth.credentialPathEnv])
+        ? resolve(hostEnv[oauth.credentialPathEnv])
+        : join(sourceDataDir, oauth.credentialFile);
+      if (!existsSync(sourceCredential)) {
+        throw new Error(`required ${clean(provider)} credentials are unavailable; sign in before using the headless role command`);
+      }
+      // Authentication is the sole host-state exception. Bind in-process (not
+      // via child-visible environment) so tools cannot discover the auth path.
+      restoreAuthBindings = replaceProviderAuthBindings({
+        [selectedProvider]: sourceCredential,
+      });
+      authMode = 'in-process-host-oauth-binding';
+      const sourceCatalog = join(sourceDataDir, oauth.modelCatalogFile);
+      if (existsSync(sourceCatalog)) {
+        copyFileSync(sourceCatalog, join(dataDir, oauth.modelCatalogFile));
+        catalogCount = 1;
+      }
+    } else if (apiKeyEnv) {
+      if (!selectedApiKey) {
+        throw new Error(`required ${selectedProvider} authentication is unavailable; set ${apiKeyEnv}`);
+      }
+      authMode = 'in-process-api-key';
+    }
+
+    const config = buildMinimalPristineConfig({ provider, model, effort, fast });
+    const loadConfig = createSelectedProviderPristineLoader({
+      config,
+      provider,
+      apiKey: selectedApiKey,
+    });
+    const configBytes = `${JSON.stringify(config, null, 2)}\n`;
+    writeFileSync(join(dataDir, contract.configFileName), configBytes, { mode: 0o600 });
+    const audit = auditDocument({
+      provider,
+      model,
+      effort,
+      fast,
+      configBytes,
+      authMode,
+      catalogCount,
+    });
+    return { rootDir, dataDir, config, audit, loadConfig, cleanup };
+  } catch (error) {
+    cleanup();
+    throw error;
+  }
+}

package/src/runtime/shared/provider-api-key.mjs

@@ -0,0 +1,43 @@
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { getSecret } = require('../../lib/keychain-cjs.cjs');
+
+// Lightweight API-key lookup shared by pristine startup and the general config
+// loader. This module deliberately has no mixdog-config.json dependency: asking
+// for one provider probes only that provider's environment/keychain account.
+export const AGENT_PROVIDER_ENV = Object.freeze({
+  openai: 'OPENAI_API_KEY',
+  anthropic: 'ANTHROPIC_API_KEY',
+  gemini: 'GEMINI_API_KEY',
+  deepseek: 'DEEPSEEK_API_KEY',
+  xai: 'XAI_API_KEY',
+  'opencode-go': 'OPENCODE_API_KEY',
+});
+
+export const AGENT_PROVIDER_ENV_ALIASES = Object.freeze({
+  xai: ['GROK_API_KEY'],
+});
+
+function providerSecretEnv(provider) {
+  return `MIXDOG_AGENT_${String(provider || '').replace(/[.\s]+/g, '_').toUpperCase()}_APIKEY`;
+}
+
+export function getAgentApiKey(provider) {
+  const id = String(provider || '').trim();
+  const standardEnv = AGENT_PROVIDER_ENV[id];
+  if (standardEnv && process.env[standardEnv]) return process.env[standardEnv];
+  const mixdogEnv = providerSecretEnv(id);
+  if (process.env[mixdogEnv]) return process.env[mixdogEnv];
+  try {
+    const stored = getSecret(`agent.${id}.apiKey`);
+    if (stored) return stored;
+  } catch {
+    // A missing/locked keychain is equivalent to no stored key. Explicit
+    // environment aliases remain available as the final provider-local source.
+  }
+  for (const alias of AGENT_PROVIDER_ENV_ALIASES[id] || []) {
+    if (process.env[alias]) return process.env[alias];
+  }
+  return null;
+}

package/src/runtime/shared/provider-auth-binding.mjs

@@ -0,0 +1,21 @@
+const AUTH_BINDINGS = Symbol.for('mixdog.providerAuthBindings');
+
+export function boundProviderAuthPath(provider) {
+  const bindings = globalThis[AUTH_BINDINGS];
+  const value = bindings && typeof bindings === 'object'
+    ? bindings[String(provider || '').trim()]
+    : null;
+  return typeof value === 'string' && value ? value : null;
+}
+
+export function replaceProviderAuthBindings(next = {}) {
+  const previous = globalThis[AUTH_BINDINGS];
+  globalThis[AUTH_BINDINGS] = Object.freeze({ ...next });
+  let restored = false;
+  return () => {
+    if (restored) return;
+    restored = true;
+    if (previous === undefined) delete globalThis[AUTH_BINDINGS];
+    else globalThis[AUTH_BINDINGS] = previous;
+  };
+}

package/src/runtime/shared/update-checker.mjs

@@ -13,8 +13,8 @@
  * the child exits, reporting the resolved version on success.
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { basename, delimiter, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { resolvePluginData } from './plugin-paths.mjs';
@@ -199,19 +199,49 @@ export async function checkLatestVersion({ force = false, dataDir } = {}) {
  * `-WindowStyle Hidden` style flags that antivirus heuristics flag).
  */
 export function npmCliJsPath() {
-  const execDir = dirname(process.execPath);
-  const candidates = [
-    // Windows: npm ships beside node.exe.
-    join(execDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-    // Unix layout: <prefix>/bin/node → <prefix>/lib/node_modules/npm.
-    join(execDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-  ];
   // When launched via npm itself, npm_execpath is authoritative.
   const envPath = process.env.npm_execpath;
-  if (envPath && /npm-cli\.js$/i.test(envPath)) candidates.unshift(envPath);
+  const candidates = envPath && /npm-cli\.js$/i.test(envPath) ? [envPath] : [];
+  const execDirs = [dirname(process.execPath)];
+  try {
+    const realExecDir = dirname(realpathSync(process.execPath));
+    if (!execDirs.includes(realExecDir)) execDirs.push(realExecDir);
+  } catch { /* retain the raw executable path */ }
+
+  for (const execDir of execDirs) {
+    // Windows: npm ships beside node.exe.
+    candidates.push(join(execDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+    // Unix layout: <prefix>/bin/node → <prefix>/lib/node_modules/npm.
+    candidates.push(join(execDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+    // Homebrew: <prefix>/bin/node → <prefix>/libexec/lib/node_modules/npm.
+    candidates.push(join(execDir, '..', 'libexec', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+  }
   for (const candidate of candidates) {
     try { if (existsSync(candidate)) return candidate; } catch { /* keep looking */ }
   }
+
+  // Last resort: npm shims on PATH commonly resolve into npm's package bin dir.
+  const pathDirs = (process.env.PATH || process.env.Path || '').split(delimiter);
+  for (const pathDir of pathDirs) {
+    if (!pathDir) continue;
+    const npmPaths = process.platform === 'win32'
+      ? [join(pathDir, 'npm'), join(pathDir, 'npm.cmd')]
+      : [join(pathDir, 'npm')];
+    for (const npmPath of npmPaths) {
+      try {
+        if (!existsSync(npmPath)) continue;
+        const resolvedNpm = realpathSync(npmPath);
+        const npmBinDir = dirname(resolvedNpm);
+        if (
+          basename(npmBinDir) !== 'bin'
+          || basename(dirname(npmBinDir)) !== 'npm'
+          || basename(dirname(dirname(npmBinDir))) !== 'node_modules'
+        ) continue;
+        const cliJs = join(npmBinDir, 'npm-cli.js');
+        if (existsSync(cliJs)) return cliJs;
+      } catch { /* keep looking */ }
+    }
+  }
   return null;
 }