mixdog 0.9.68 → 0.9.70

package/src/session-runtime/memory-daemon-probe.mjs

@@ -0,0 +1,61 @@
+// Eager memory-daemon boot for remote sessions. The channels worker forwards
+// transcript ingests to the memory HTTP service, so its port must be published
+// (and actually listening) before the worker sends its first ingest — otherwise
+// early channel traffic finds no port and gets buffered. Extracted from
+// runtime-core's startRemote, which now just fires it.
+import * as httpMod from 'node:http';
+
+const HEALTH_ATTEMPTS = 30;
+const HEALTH_RETRY_MS = 500;
+const HEALTH_TIMEOUT_MS = 1500;
+
+function healthOk(port) {
+  return new Promise((resolve) => {
+    const request = httpMod.request(
+      { hostname: '127.0.0.1', port, path: '/health', timeout: HEALTH_TIMEOUT_MS },
+      (response) => {
+        let body = '';
+        response.on('data', (chunk) => { body += chunk; });
+        response.on('end', () => {
+          try { resolve(JSON.parse(body)?.status === 'ok'); } catch { resolve(false); }
+        });
+      },
+    );
+    request.on('error', () => resolve(false));
+    request.on('timeout', () => { request.destroy(); resolve(false); });
+    request.end();
+  });
+}
+
+/** Detached, never throws: resolving the module only hands back a handle, so
+ *  this awaits start() and then polls /health until the daemon is provably
+ *  reachable (or the failure is profiled). */
+export function startMemoryDaemonEagerly({ getMemoryModule, bootProfile }) {
+  void (async () => {
+    try {
+      // Yield one tick first: the module resolve + daemon fork below is a long
+      // synchronous chain that would otherwise starve Ink's queued render and
+      // keypress handling.
+      await new Promise((resolve) => setImmediate(resolve));
+      const module = await getMemoryModule();
+      const started = typeof module?.start === 'function' ? await module.start() : null;
+      const port = started?.port;
+      if (!port) {
+        bootProfile('channels:memory-eager-init-failed', { error: 'no port from start()' });
+        return;
+      }
+      for (let attempt = 0; attempt < HEALTH_ATTEMPTS; attempt += 1) {
+        try {
+          if (await healthOk(port)) {
+            bootProfile('channels:memory-eager-init-ready', { port });
+            return;
+          }
+        } catch { /* probe failure is retried below */ }
+        await new Promise((resolve) => setTimeout(resolve, HEALTH_RETRY_MS));
+      }
+      bootProfile('channels:memory-eager-init-failed', { error: `health not ok after retries (port ${port})` });
+    } catch (error) {
+      bootProfile('channels:memory-eager-init-failed', { error: error?.message || String(error) });
+    }
+  })();
+}

package/src/session-runtime/model-capabilities.mjs

@@ -103,6 +103,8 @@ export function fastPreferenceFor(config, provider, model) {
   if (!key) return false;
   const saved = config?.modelSettings?.[key];
   if (saved && typeof saved === 'object' && hasOwn(saved, 'fast')) return saved.fast === true;
+  // Pre-modelSettings configs kept the preference in a parallel `fastModels`
+  // map. Reading it keeps those installs working; nothing writes it anymore.
   return config?.fastModels?.[key] === true;
 }
 
@@ -118,11 +120,11 @@ export function saveModelSettings(cfgMod, route, { fastCapable = true, baseConfi
   else nextSetting.fast = false;
   modelSettings[key] = nextSetting;
 
-  // Legacy compatibility: keep fastModels true entries for old readers, but
-  // let modelSettings.fast=false override them in new readers.
+  // modelSettings is the single source of truth for the fast preference; the
+  // stale mirror in `fastModels` is dropped for the key being written so the
+  // two can never disagree.
   const fastModels = { ...(nextConfig.fastModels || {}) };
-  if (nextSetting.fast === true) fastModels[key] = true;
-  else delete fastModels[key];
+  delete fastModels[key];
 
   const savedConfig = { ...nextConfig, modelSettings, fastModels };
   cfgMod.saveConfig(savedConfig);

package/src/session-runtime/model-route-api.mjs

@@ -96,6 +96,10 @@ export function createModelRouteApi(deps) {
       if (!searchCapableFor(selectedRoute.provider, modelMeta)) {
         throw new Error(`model "${selectedRoute.model}" is not marked as web-search capable`);
       }
+      // Route-scope isolation: the search route stores its own effort/fast in
+      // config.searchRoute. The shared config.modelSettings[provider/model]
+      // bucket belongs to the MAIN route alone, so a search-model pick that
+      // happens to match Main must not rewrite Main's saved effort/fast.
       const fastCapable = fastCapableFor(selectedRoute.provider, modelMeta);
       const effort = coerceEffortFor(selectedRoute.provider, modelMeta, selectedRoute.effort);
       selectedRoute = {
@@ -103,7 +107,6 @@ export function createModelRouteApi(deps) {
         ...(effort ? { effort } : {}),
         fast: fastCapable ? selectedRoute.fast === true : false,
       };
-      adoptConfig(saveModelSettings(cfgMod, selectedRoute, { fastCapable, baseConfig: getConfig() }), { hasSecrets: getConfigHasSecrets() });
       const routeToSave = normalizeSearchRouteConfig(selectedRoute);
       const nextConfig = { ...getConfig() };
       nextConfig.searchRoute = routeToSave;

package/src/session-runtime/notification-bus.mjs

@@ -0,0 +1,82 @@
+// Runtime notification fan-out. A notification reaches listeners (TUI/API) and,
+// for terminal tool completions, may also be mirrored into the session's
+// pending queue so the model sees it next turn. The delivered registry keeps
+// those two paths from double-injecting the same completion.
+import { modelVisibleToolCompletionMessage } from '../runtime/shared/tool-execution-contract.mjs';
+import { markCompletionEntry } from '../runtime/agent/orchestrator/session/manager/pending-messages.mjs';
+import {
+  isDeliveredCompletion,
+  logDuplicateSkip,
+  recordDeliveredCompletion,
+} from '../runtime/agent/orchestrator/session/manager/delivered-completions.mjs';
+import { shouldMirrorCompletionToPendingQueue } from './runtime-tool-routing.mjs';
+
+export function createNotificationBus({ listeners, mgr }) {
+  function emitRuntimeNotification(content, meta = {}) {
+    const text = String(content || '').trim();
+    if (!text) return { handled: false, modelVisibleDelivered: false };
+    const event = { content: text, meta: meta && typeof meta === 'object' ? meta : {} };
+    let handled = false;
+    for (const listener of [...listeners]) {
+      try {
+        if (listener(event) === true) handled = true;
+      } catch { /* a broken listener never blocks the rest */ }
+    }
+    // EXPLICIT model-visible ack: only the TUI execution-ui path sets
+    // event.modelVisibleDelivered when it enqueues the body into the active
+    // loop. A display-only listener returning true is NOT that ack.
+    return { handled, modelVisibleDelivered: event.modelVisibleDelivered === true };
+  }
+
+  // Enqueue the model-visible twin unless it was already delivered; returns
+  // true when the caller may treat the completion as delivered.
+  function enqueueCompletion(callerSessionId, text, meta, path) {
+    const visible = modelVisibleToolCompletionMessage(text, meta);
+    // Non-completion notifications yield '' here and are never queued.
+    if (!visible) return false;
+    if (isDeliveredCompletion({ executionId: meta?.execution_id, text: visible })) {
+      // Delivered + ACKed on the TUI path: suppress the duplicate but report
+      // DELIVERED so the caller stops retrying.
+      logDuplicateSkip(path, { executionId: meta?.execution_id, text: visible });
+      return true;
+    }
+    return mgr.enqueuePendingMessage(callerSessionId, markCompletionEntry(visible)) > 0;
+  }
+
+  function notifyFnForSession(callerSessionId) {
+    return (text, meta = {}) => {
+      const { handled, modelVisibleDelivered } = emitRuntimeNotification(text, meta);
+      let enqueued = false;
+      // Record the TUI delivery so a racing enqueue in THIS process (background
+      // reconcile / fallback / notify) skips instead of double-injecting.
+      if (modelVisibleDelivered) {
+        try {
+          recordDeliveredCompletion({
+            executionId: meta?.execution_id,
+            text: modelVisibleToolCompletionMessage(text, meta),
+          });
+        } catch { /* registry is best-effort */ }
+      }
+      // TUI sessions consume raw envelopes for UI cards, but those are
+      // internal-only in pending drain: mirror the model-visible twin unless the
+      // TUI explicitly acked it.
+      if (shouldMirrorCompletionToPendingQueue({
+        callerSessionId,
+        modelVisibleDelivered,
+        hasEnqueue: typeof mgr.enqueuePendingMessage === 'function',
+        text,
+        meta,
+      })) {
+        try { enqueued = enqueueCompletion(callerSessionId, text, meta, 'mirror'); } catch { /* best-effort */ }
+      }
+      // Headless/API listeners may exist without consuming the event: keep the
+      // fallback enqueue for an otherwise unhandled completion.
+      if (!enqueued && !handled && callerSessionId && typeof mgr.enqueuePendingMessage === 'function') {
+        try { enqueued = enqueueCompletion(callerSessionId, text, meta, 'fallback'); } catch { /* best-effort */ }
+      }
+      return enqueued || handled;
+    };
+  }
+
+  return { emitRuntimeNotification, notifyFnForSession };
+}

package/src/session-runtime/provider-auth-api.mjs

@@ -24,6 +24,8 @@ export function createProviderAuthApi({
   displayConfig,
   reloadFullConfig,
   awaitKeychainPrewarm,
+  isKeychainPrewarmReady = () => true,
+  hasProviderSetupCached = () => true,
   invalidateProviderCaches,
   warmProviderModelCache,
   refreshProviderCatalogs,
@@ -56,8 +58,21 @@ export function createProviderAuthApi({
       return renderProviderStatus(displayConfig());
     },
     async getProviderSetup(options = {}) {
-      await awaitKeychainPrewarm();
       const force = options?.force === true || options?.refresh === true;
+      // An unforced read never blocks: the authoritative setup waits on the OS
+      // keychain AND probes local provider ports, which together take seconds on
+      // a cold start and used to stall the whole settings sweep behind it. Serve
+      // the no-secrets snapshot until the real one is cached — flagged, so the
+      // caller shows "checking" instead of a wrong "not connected" — and let the
+      // scheduled warmup publish the authoritative result for the next read.
+      if (!force && (!isKeychainPrewarmReady() || !hasProviderSetupCached())) {
+        const quick = await cachedProviderSetup({ quick: true });
+        void Promise.resolve(awaitKeychainPrewarm())
+          .then(() => cachedProviderSetup({}))
+          .catch(() => {});
+        return { ...quick, pendingSecrets: !isKeychainPrewarmReady() };
+      }
+      await awaitKeychainPrewarm();
       if (force) reloadFullConfig();
       return await cachedProviderSetup({ force });
     },

package/src/session-runtime/provider-usage.mjs

@@ -118,6 +118,9 @@ export function createProviderUsage({
   return {
     refreshStatuslineUsageSnapshot,
     cachedProviderSetup,
+    // True once a secrets-aware setup is cached: callers that must not block
+    // (settings hydration) can serve the quick snapshot until then.
+    hasProviderSetupCached: () => Boolean(caches.providerSetupCache.setup),
     getUsageDashboard,
   };
 }

package/src/session-runtime/remote-control.mjs

@@ -0,0 +1,166 @@
+// Remote (channel relay) lifecycle for a session: claim, release and stop.
+// Remote mode is opt-in per session — only a session that turns it on boots the
+// channel worker and contends for the machine-global bridge seat. Extracted
+// from runtime-core, which injects the mutable session/remote state it owns.
+import { startMemoryDaemonEagerly } from './memory-daemon-probe.mjs';
+
+export function createRemoteControl({
+  getSession,
+  isRemoteEnabled,
+  setRemoteEnabled,
+  getRemoteSessionId,
+  setRemoteSessionId,
+  setRemoteClaimPending,
+  isRemoteClaimPending,
+  isCloseRequested,
+  clearChannelStartTimer,
+  remoteTransitions,
+  channels,
+  channelsEnabled,
+  hasActiveAutomation,
+  flushBackendSave,
+  invokeChannelStart,
+  createCurrentSession,
+  ensureRemoteTranscriptWriter,
+  getTranscriptPath,
+  emitRemoteStateChange,
+  getMemoryModule,
+  bootProfile,
+  envFlag,
+}) {
+  // FORCE-TAKEOVER for an explicit claim: it always (re)claims the seat and
+  // rebinds forwarding to this session, even when the worker already runs
+  // (`/remote` re-issued after another session took the seat).
+  function startRemote(options = {}) {
+    const intent = options?.intent === 'auto' ? 'auto' : 'explicit';
+    if (intent === 'auto') {
+      // Auto-start attempts a claim-if-vacant: remoteEnabled flips only when the
+      // worker reports it actually acquired the seat, so a live owner elsewhere
+      // leaves this session non-remote.
+      setRemoteClaimPending(true);
+    } else {
+      setRemoteEnabled(true);
+      // Explicit toggle: the CURRENT session owns the relay (lazy create adopts
+      // inside ensureRemoteTranscriptWriter when no session exists yet).
+      setRemoteSessionId(getSession()?.id || null);
+    }
+    // The worker forwards transcript ingests to the memory service, so its port
+    // must be live before the first ingest.
+    startMemoryDaemonEagerly({ getMemoryModule, bootProfile });
+    // Publish the session record + transcript file BEFORE the worker's
+    // activate-time discovery polls, so forwarding binds to THIS terminal
+    // instead of a stale neighbour. A no-op in lazy mode; the turn-start rebind
+    // covers that case.
+    ensureRemoteTranscriptWriter();
+    if (envFlag('MIXDOG_DISABLE_CHANNEL_START')) {
+      bootProfile('channels:start-skipped');
+      return true;
+    }
+    if (isCloseRequested()) return true;
+    clearChannelStartTimer();
+    bootProfile('channels:start-scheduled', { delayMs: 0, immediate: true });
+    return remoteTransitions.run(async () => {
+      try {
+        // The channels-module toggle gates MESSAGING only: automation still
+        // boots the worker, which runs headless when messaging is off.
+        if (!channelsEnabled() && !(await hasActiveAutomation().catch(() => false))) {
+          bootProfile('channels:start-disabled');
+          setRemoteClaimPending(false);
+          return isRemoteEnabled();
+        }
+        // A backend switch may still be writing; drain it before the worker
+        // reads config rather than racing a sync lock wait.
+        try { await flushBackendSave(); } catch { /* best-effort */ }
+        // Yield before the create/transcript/fork chain so Ink's queued render
+        // and input handling are not starved by this detached chain.
+        await new Promise((resolve) => setImmediate(resolve));
+        // Immediate-occupancy guarantee: a freshly forked worker runs transcript
+        // discovery inside its own start(), so the session must exist first.
+        // Idempotent; on failure we still claim (bind resolves on first turn).
+        try { await createCurrentSession('remote-start'); } catch (error) {
+          bootProfile('channels:remote-session-create-failed', { error: error?.message || String(error) });
+        }
+        ensureRemoteTranscriptWriter();
+        // Re-check after the awaits: stop/supersede or runtime close may have
+        // landed mid-chain — never boot for a session that turned remote off.
+        if ((!isRemoteEnabled() && !isRemoteClaimPending()) || isCloseRequested()) {
+          setRemoteClaimPending(false);
+          return false;
+        }
+        // The fork reads process.env synchronously, so set the inherited intent
+        // immediately before it and restore right after: the pollution window is
+        // this fork instead of the whole boot chain.
+        const previousIntent = process.env.MIXDOG_REMOTE_INTENT;
+        try {
+          process.env.MIXDOG_REMOTE_INTENT = intent;
+          await invokeChannelStart();
+        } finally {
+          if (previousIntent === undefined) delete process.env.MIXDOG_REMOTE_INTENT;
+          else process.env.MIXDOG_REMOTE_INTENT = previousIntent;
+        }
+        if ((!isRemoteEnabled() && !isRemoteClaimPending()) || isCloseRequested()) {
+          setRemoteClaimPending(false);
+          return false;
+        }
+        // Explicit claims are unconditional; auto-start dispatches the same
+        // activation as claim-if-vacant so it promotes an automation-only daemon
+        // without stealing a live remote owner.
+        await channels.execute('activate_channel_bridge', {
+          active: true,
+          claimIfVacant: intent === 'auto',
+          sessionId: getSession()?.id || getRemoteSessionId() || null,
+          transcriptPath: getTranscriptPath(),
+        });
+        // The worker's acquire/supersede notification now owns the transition.
+        setRemoteClaimPending(false);
+        return isRemoteEnabled();
+      } catch (error) {
+        setRemoteClaimPending(false);
+        if (isRemoteEnabled()) {
+          setRemoteEnabled(false);
+          setRemoteSessionId(null);
+          await channels.stop('remote-claim-failed').catch(() => {});
+          emitRemoteStateChange(false, 'claim-failed');
+        }
+        bootProfile('channels:claim-failed', { error: error?.message || String(error) });
+        return false;
+      }
+    });
+  }
+
+  // Explicit user OFF is a desired-state command, not a toggle retry: deactivate
+  // the machine-global bridge before detaching. The promise settles only after
+  // detach, keeping the desktop toggle busy until a later ON can reconnect.
+  function releaseRemote(reason) {
+    const releasingSessionId = getRemoteSessionId() || getSession()?.id || null;
+    setRemoteEnabled(false);
+    setRemoteSessionId(null);
+    setRemoteClaimPending(false);
+    clearChannelStartTimer();
+    return remoteTransitions.run(async () => {
+      try {
+        await channels.execute('activate_channel_bridge', { active: false, sessionId: releasingSessionId });
+      } catch (error) {
+        bootProfile('channels:release-failed', { error: error?.message || String(error) });
+        emitRemoteStateChange(false, 'release-failed');
+      } finally {
+        await channels.stop(reason || 'remote-disabled').catch(() => {});
+      }
+      return false;
+    });
+  }
+
+  // /remote-off and supersede: the runtime keeps running so this never blocks,
+  // but the waiting stop path runs the full SIGTERM -> taskkill escalation so the
+  // worker cannot linger as a zombie holding the seat.
+  function stopRemote(reason) {
+    setRemoteEnabled(false);
+    setRemoteSessionId(null);
+    setRemoteClaimPending(false);
+    clearChannelStartTimer();
+    channels.stop(reason || 'remote-disabled').catch(() => {});
+    return true;
+  }
+
+  return { startRemote, releaseRemote, stopRemote };
+}

package/src/session-runtime/remote-transcript.mjs

@@ -0,0 +1,126 @@
+// Remote transcript binding: the channel worker forwards output by watching a
+// per-session transcript file, so the runtime must (re)create the writer for
+// the CURRENT session+cwd and push the path to the worker whenever the binding
+// can go stale (relay acquire, new session, resume, clear). Extracted from
+// runtime-core; every mutable local it needs is injected as an accessor.
+import { createTranscriptWriter } from '../runtime/shared/transcript-writer.mjs';
+import { mixdogHome } from '../runtime/shared/plugin-paths.mjs';
+
+const REBIND_MAX_ATTEMPTS = 3;
+
+export function createRemoteTranscript({
+  getSession,
+  getCwd,
+  isRemoteEnabled,
+  getRemoteSessionId,
+  setRemoteSessionId,
+  isCloseRequested,
+  channelsEnabled,
+  channels,
+  mgr,
+  bootProfile,
+}) {
+  let writer = null;
+  let writerKey = '';
+  let pendingRebind = false;
+
+  return {
+    get transcriptWriter() { return writer; },
+    // Session+cwd identity of the current binding: a change means forwarding
+    // must be re-activated for the new transcript.
+    get transcriptKey() { return writerKey; },
+    get pendingRebind() { return pendingRebind; },
+    resetPendingRebind() { pendingRebind = false; },
+    ensureRemoteTranscriptWriter,
+    pushTranscriptRebind,
+    flushPendingTranscriptRebind,
+  };
+
+  // Bind (or refresh) the writer for the CURRENT session+cwd. The owner gate
+  // covers lazy create: an unset owner adopts this session, a LIVE owner blocks
+  // every other session, and a dead owner hands the relay over.
+  function ensureRemoteTranscriptWriter() {
+    const session = getSession();
+    if (!isRemoteEnabled() || !session?.id) return false;
+    const owner = getRemoteSessionId();
+    if (!owner) {
+      setRemoteSessionId(session.id);
+    } else if (session.id !== owner) {
+      const ownerSession = mgr.getSession(owner);
+      if (ownerSession && ownerSession.closed !== true && ownerSession.status !== 'closed') return false;
+      setRemoteSessionId(session.id);
+    }
+    const cwd = getCwd();
+    const key = `${session.id}\u0000${cwd}`;
+    if (writerKey !== key) {
+      try {
+        writer = createTranscriptWriter({
+          mixdogHome: mixdogHome(),
+          sessionId: session.id,
+          cwd,
+          pid: process.pid,
+        });
+        writer.writeSessionRecord();
+        writerKey = key;
+      } catch (error) {
+        process.stderr.write(`mixdog: transcript-writer: init failed: ${error?.message || error}\n`);
+        writer = null;
+        writerKey = '';
+        return false;
+      }
+    } else {
+      // Same binding — refresh updatedAt so worker-side discovery keeps ranking
+      // this session as the live parent-chain candidate.
+      try { writer?.writeSessionRecord(); } catch { /* discovery hint only */ }
+    }
+    try { writer?.ensureTranscriptFile(); } catch (error) {
+      process.stderr.write(`mixdog: transcript-writer: ensureTranscriptFile failed: ${error?.message || error}\n`);
+    }
+    return writer != null;
+  }
+
+  // Repoint outbound forwarding at the current transcript. Best-effort: a
+  // writer that is not bindable yet (relay acquired before the session exists)
+  // defers, and flushPendingTranscriptRebind() re-fires it exactly once.
+  function pushTranscriptRebind() {
+    if (!isRemoteEnabled()) return;
+    if (!ensureRemoteTranscriptWriter()) { pendingRebind = true; return; }
+    const transcriptPath = writer?.transcriptPath;
+    if (!transcriptPath || !channelsEnabled()) { pendingRebind = true; return; }
+    pendingRebind = false;
+    executeTranscriptRebind(transcriptPath, 1);
+  }
+
+  // Bounded retry on the idempotent worker op; the final failure surfaces one
+  // stderr line so a lost rebind is diagnosable without the env-gated profile.
+  function executeTranscriptRebind(transcriptPath, attempt) {
+    const onError = (error) => {
+      const detail = error?.message || String(error);
+      bootProfile('channels:rebind-push-failed', { attempt, error: detail });
+      if (attempt < REBIND_MAX_ATTEMPTS && isRemoteEnabled() && !isCloseRequested()) {
+        const timer = setTimeout(() => {
+          // Drop the chain if remote went away or the writer moved on: re-firing
+          // the captured path would rebind forwarding to a stale transcript.
+          if (!isRemoteEnabled() || !channelsEnabled()) return;
+          if (writer?.transcriptPath !== transcriptPath) return;
+          executeTranscriptRebind(transcriptPath, attempt + 1);
+        }, 150 * attempt);
+        timer.unref?.();
+      } else {
+        process.stderr.write(`mixdog: channels: rebind_current_transcript failed after ${attempt} attempt(s): ${detail}\n`);
+      }
+    };
+    try {
+      void channels.execute('rebind_current_transcript', { transcriptPath }).catch(onError);
+    } catch (error) {
+      onError(error);
+    }
+  }
+
+  // Re-fire a deferred rebind once the writer becomes available; a no-op for
+  // already-bound sessions so no unconditional rebind fires per turn.
+  function flushPendingTranscriptRebind() {
+    if (!pendingRebind || !isRemoteEnabled()) return;
+    pushTranscriptRebind();
+  }
+}

package/src/session-runtime/remote-transition-queue.mjs

@@ -0,0 +1,14 @@
+export function createRemoteTransitionQueue() {
+  let tail = Promise.resolve();
+
+  return {
+    run(task) {
+      const result = tail.then(() => task());
+      tail = result.then(() => undefined, () => undefined);
+      return result;
+    },
+    settled() {
+      return tail;
+    },
+  };
+}