mixdog 1.1.0 → 1.1.2

package/src/runtime/computer-bridge/linux-readiness.mjs

@@ -0,0 +1,411 @@
+// Linux Computer Use prerequisites, probed per capability BEFORE a task starts
+// so a missing permission or helper yields one actionable message naming what
+// is missing instead of a failure or hang mid-task. Probes never prompt: they
+// read the environment, test file access and PATH, and ask D-Bus read-only
+// questions. The wording mirrors the native hints in native/mixdog-computer
+// (uinput.rs PERMISSION_HINT, compositor.rs supported, apps.rs TESSERACT_HINT /
+// CLIPBOARD_HINT, atspi.rs connect).
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { isForegroundWindowCapture, requiredCapabilities } from './linux-action-capabilities.mjs';
+
+export const UINPUT_HINT =
+  'input_unavailable: Wayland input needs write access to /dev/uinput; add the udev rule `KERNEL=="uinput", GROUP="input", MODE="0660", OPTIONS+="static_node=uinput"`, add your user to the input group, then sign in again';
+export const INPUT_GROUP_SECURITY_NOTE =
+  'Security note: membership of the input group lets every program you run read and inject keyboard and mouse input system-wide. Grant it only on a machine and account you trust.';
+export const GNOME_EXTENSION_UUID = 'mixdog-windows@mixdog.io';
+/** The oldest helper interface this app can use (2 added Screenshot and StopRequested, 3 the in-shell indicator). */
+export const MIN_WINDOW_HELPER_VERSION = 3;
+export const WINDOW_CONTROL_HINT =
+  'wayland_window_control_unavailable: this compositor offers no window control to other programs; on GNOME the Mixdog Windows extension (mixdog-windows@mixdog.io) provides it and must be enabled and loaded';
+export const WINDOW_HELPER_RELOGIN_HINT =
+  'wayland_window_control_unavailable: the Mixdog Windows GNOME extension is installed and enabled but GNOME Shell has not loaded it yet; the user must sign out and sign in again once';
+export const WINDOW_HELPER_ENABLE_HINT =
+  'wayland_window_control_unavailable: the Mixdog Windows GNOME extension is not enabled; it could not be enabled automatically (run gnome-extensions enable mixdog-windows@mixdog.io)';
+export const WINDOW_CONTROL_UNSUPPORTED_HINT =
+  'wayland_window_control_unavailable: this desktop offers no window control to other programs (supported: GNOME with the Mixdog Windows extension, sway, Hyprland, or an X11 session); screen, pointer, keyboard and clipboard still work';
+export const ACCESSIBILITY_HINT =
+  'accessibility_unavailable: the AT-SPI bus is not running; install at-spi2-core';
+export const TESSERACT_HINT =
+  'ocr_unavailable: install Tesseract (for example `sudo apt install tesseract-ocr tesseract-ocr-kor`) to read text from pixels';
+export const CLIPBOARD_HINT =
+  'clipboard_unavailable: install wl-clipboard (`wl-copy`/`wl-paste`) for clipboard access on Wayland';
+export const DISPLAY_HINT =
+  'display_unavailable: no graphical session to drive; run inside a desktop session with DISPLAY (X11) or WAYLAND_DISPLAY set';
+
+/**
+ * User-facing English phrases, one per fix a capability can ask for. They are
+ * the keys of the UI catalogs (apps/desktop/src/renderer/locales), so a UI that
+ * renders a capability's `fix` looks the phrase up there; `{{package}}` is the
+ * capability's `package`. The tool result text for the model stays English.
+ */
+export const FIX_MESSAGES = Object.freeze({
+  allow_input:
+    'Allow Mixdog to send keyboard and mouse input: grant access to /dev/uinput (add your user to the input group), then sign in again.',
+  relogin: 'Sign out and sign in again to finish setting up window control for Mixdog.',
+  enable_window_helper:
+    'Enable the Mixdog Windows extension so Mixdog can list and control windows (gnome-extensions enable mixdog-windows@mixdog.io).',
+  install_package: 'Install {{package}} to enable this Computer Use feature.',
+});
+export const REFUSAL_MESSAGE = 'Computer Use cannot run this action because a required capability is not ready.';
+
+/** Stable code of the whole refusal; the per-capability codes are the native ones. */
+export const CAPABILITY_UNAVAILABLE_CODE = 'computer_capability_unavailable';
+
+const READY = Object.freeze({ state: 'ready' });
+
+function onPath(name, env) {
+  return String(env.PATH || '')
+    .split(path.delimiter)
+    .filter(Boolean)
+    .some((dir) => {
+      try {
+        fs.accessSync(path.join(dir, name), fs.constants.X_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+}
+
+// A read-only gdbus call: its stdout, or null when it fails or times out.
+function gdbusOutput(env, args, timeoutMs = 2000) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn('gdbus', ['call', '--session', ...args], { env, stdio: ['ignore', 'pipe', 'ignore'], shell: false, windowsHide: true });
+    } catch {
+      resolve(null);
+      return;
+    }
+    let out = '';
+    child.stdout.on('data', (chunk) => {
+      out += chunk;
+    });
+    const timer = setTimeout(() => {
+      try {
+        child.kill('SIGKILL');
+      } catch {}
+      resolve(null);
+    }, timeoutMs);
+    child.once('error', () => {
+      clearTimeout(timer);
+      resolve(null);
+    });
+    child.once('close', (status) => {
+      clearTimeout(timer);
+      resolve(status === 0 ? out : null);
+    });
+  });
+}
+
+const gdbusSucceeds = async (env, args, timeoutMs) => (await gdbusOutput(env, args, timeoutMs)) !== null;
+
+// Asks our own interface for its Version property: read-only, never prompts.
+// The version the shell actually loaded, or null when nothing answers.
+async function gnomeWindowHelperVersion(env) {
+  const out = await gdbusOutput(env, [
+    '--dest', 'org.gnome.Shell',
+    '--object-path', '/io/mixdog/Windows',
+    '--method', 'org.freedesktop.DBus.Properties.Get',
+    'io.mixdog.Windows', 'Version',
+  ]);
+  const version = /uint32 (\d+)/.exec(out ?? '');
+  return version ? Number(version[1]) : null;
+}
+
+function gsettingsOutput(env, args, timeoutMs = 2000) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn('gsettings', args, { env, stdio: ['ignore', 'pipe', 'ignore'], shell: false, windowsHide: true });
+    } catch {
+      resolve('');
+      return;
+    }
+    let out = '';
+    child.stdout.on('data', (chunk) => {
+      out += chunk;
+    });
+    const timer = setTimeout(() => {
+      try {
+        child.kill('SIGKILL');
+      } catch {}
+      resolve('');
+    }, timeoutMs);
+    child.once('error', () => {
+      clearTimeout(timer);
+      resolve('');
+    });
+    child.once('close', () => {
+      clearTimeout(timer);
+      resolve(out);
+    });
+  });
+}
+
+/** Where GNOME Shell looks for our extension: system-wide (the .deb) or per user. */
+export function gnomeExtensionDirs(env = process.env) {
+  const home = env.HOME || '';
+  const data = env.XDG_DATA_HOME || (home ? path.join(home, '.local', 'share') : '');
+  return [
+    ...(data ? [path.join(data, 'gnome-shell', 'extensions', GNOME_EXTENSION_UUID)] : []),
+    path.join('/usr/share/gnome-shell/extensions', GNOME_EXTENSION_UUID),
+  ];
+}
+
+/** Whether our extension is on disk and listed as enabled (not whether the shell loaded it). */
+async function gnomeWindowHelperStatus(env) {
+  const installed = gnomeExtensionDirs(env).some((dir) => fs.existsSync(path.join(dir, 'metadata.json')));
+  if (!installed) return { installed: false, enabled: false };
+  const list = await gsettingsOutput(env, ['get', 'org.gnome.shell', 'enabled-extensions']);
+  const disabledAll = /true/.test(await gsettingsOutput(env, ['get', 'org.gnome.shell', 'disable-user-extensions']));
+  return { installed, enabled: list.includes(`'${GNOME_EXTENSION_UUID}'`) && !disabledAll };
+}
+
+function accessibilityBusReachable(env) {
+  return gdbusSucceeds(env, [
+    '--dest', 'org.a11y.Bus',
+    '--object-path', '/org/a11y/bus',
+    '--method', 'org.a11y.Bus.GetAddress',
+  ]);
+}
+
+// zbus (the native client) reaches the session bus through this address or the
+// per-user socket; without either there is nothing to ask.
+function sessionBusPresent(env) {
+  if (env.DBUS_SESSION_BUS_ADDRESS) return true;
+  try {
+    return Boolean(env.XDG_RUNTIME_DIR) && fs.existsSync(path.join(env.XDG_RUNTIME_DIR, 'bus'));
+  } catch {
+    return false;
+  }
+}
+
+/** Same rule as native platform::linux::wayland_session(). */
+export function detectSession(env) {
+  const wayland = env.WAYLAND_DISPLAY !== undefined && (env.XDG_SESSION_TYPE === undefined || env.XDG_SESSION_TYPE === 'wayland');
+  return wayland ? 'wayland' : 'x11';
+}
+
+export function detectDesktop(env, session) {
+  if (session === 'wayland') {
+    if (env.SWAYSOCK !== undefined) return 'sway';
+    if (env.HYPRLAND_INSTANCE_SIGNATURE !== undefined) return 'hyprland';
+  }
+  const desktop = String(env.XDG_CURRENT_DESKTOP || '');
+  if (/gnome/i.test(desktop)) return 'gnome';
+  if (/kde|plasma/i.test(desktop)) return 'kde';
+  if (/sway/i.test(desktop)) return 'sway';
+  if (/hyprland/i.test(desktop)) return 'hyprland';
+  return 'other';
+}
+
+const needsPackage = (name, extra = {}) => ({ state: 'needs_setup', fix: 'install_package', package: name, ...extra });
+
+async function windowsCapability({ env, session, hasCommand, windowHelperVersion, windowHelperStatus }) {
+  if (session === 'x11') return READY;
+  // Same order as native Compositor::detect().
+  if (env.SWAYSOCK !== undefined) return hasCommand('swaymsg') ? READY : needsPackage('sway');
+  if (env.HYPRLAND_INSTANCE_SIGNATURE !== undefined) return hasCommand('hyprctl') ? READY : needsPackage('hyprland');
+  if (/gnome/i.test(String(env.XDG_CURRENT_DESKTOP || ''))) {
+    // Without gdbus the extension cannot be probed (the native client talks to
+    // D-Bus itself), so this is unknown rather than missing.
+    if (!hasCommand('gdbus')) return { state: 'unknown' };
+    const loaded = await windowHelperVersion();
+    // A shell that loaded an older copy keeps running it until the next sign-in.
+    if (loaded !== null) return loaded >= MIN_WINDOW_HELPER_VERSION ? READY : { state: 'needs_setup', fix: 'relogin' };
+    // Not answering: either the shell has not loaded a freshly enabled
+    // extension yet (a sign-in fixes that) or it is not enabled at all.
+    const status = await windowHelperStatus();
+    return { state: 'needs_setup', fix: status.installed && status.enabled ? 'relogin' : 'enable_window_helper' };
+  }
+  return { state: 'unsupported' };
+}
+
+async function accessibilityCapability({ env, hasCommand, hasSessionBus, accessibilityReachable }) {
+  if (!hasSessionBus() || !hasCommand('gdbus')) return { state: 'unknown' };
+  return (await accessibilityReachable()) ? READY : needsPackage('at-spi2-core');
+}
+
+/**
+ * Per-capability readiness of this Linux session. Capabilities report
+ * 'unknown' when they cannot be probed without side effects; only
+ * 'needs_setup' and 'unsupported' ever block an action.
+ * @returns {Promise<{
+ *   session: 'wayland'|'x11',
+ *   desktop: 'gnome'|'kde'|'sway'|'hyprland'|'other',
+ *   capabilities: Record<string, {state: 'ready'|'needs_setup'|'unsupported'|'unknown', fix?: string, package?: string, optional?: boolean}>
+ * }>}
+ */
+export async function checkLinuxComputerReadiness({
+  env = process.env,
+  canWrite = (file) => {
+    try {
+      fs.accessSync(file, fs.constants.W_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  hasCommand = (name) => onPath(name, env),
+  hasSessionBus = () => sessionBusPresent(env),
+  windowHelperVersion = () => gnomeWindowHelperVersion(env),
+  windowHelperStatus = () => gnomeWindowHelperStatus(env),
+  accessibilityReachable = () => accessibilityBusReachable(env),
+} = {}) {
+  const session = detectSession(env);
+  const desktop = detectDesktop(env, session);
+  const optional = (capability) => ({ ...capability, optional: true });
+  if (session === 'x11' && !env.DISPLAY) {
+    const none = { state: 'unsupported' };
+    return {
+      session,
+      desktop,
+      capabilities: {
+        capture: none, windows: none, accessibility: none, semanticActions: none,
+        pointer: none, keyboard: none, clipboard: optional(none), ocr: optional(none),
+      },
+    };
+  }
+  const wayland = session === 'wayland';
+  const windows = await windowsCapability({ env, session, hasCommand, windowHelperVersion, windowHelperStatus });
+  const accessibility = await accessibilityCapability({ env, hasCommand, hasSessionBus, accessibilityReachable });
+  const input = !wayland || canWrite('/dev/uinput') ? READY : { state: 'needs_setup', fix: 'allow_input' };
+  const clipboard = !wayland || (hasCommand('wl-copy') && hasCommand('wl-paste')) ? READY : needsPackage('wl-clipboard');
+  return {
+    session,
+    desktop,
+    capabilities: {
+      // GNOME Wayland pixels come from our shell extension (no portal, never a
+      // prompt), so they are ready exactly when the helper is. Other Wayland
+      // desktops use the desktop portal, which only prompts when used and so
+      // cannot be probed.
+      capture: wayland ? (desktop === 'gnome' ? windows : { state: 'unknown' }) : READY,
+      windows,
+      accessibility,
+      // AT-SPI actions act on an accessible found through a window handle.
+      semanticActions: windows.state === 'ready' ? accessibility : windows,
+      pointer: input,
+      keyboard: input,
+      clipboard: optional(clipboard),
+      ocr: optional(hasCommand('tesseract') ? READY : needsPackage('tesseract-ocr')),
+    },
+  };
+}
+
+function capabilityIssue(name, readiness) {
+  if (readiness.capabilities.capture.state === 'unsupported') return { code: 'display_unavailable', message: DISPLAY_HINT };
+  // Semantic actions fail on whichever of their two prerequisites is missing.
+  const gnomeWayland = readiness.session === 'wayland' && readiness.desktop === 'gnome';
+  const target = name === 'semanticActions' ? (readiness.capabilities.windows.state === 'ready' ? 'accessibility' : 'windows') : name === 'capture' && gnomeWayland ? 'windows' : name;
+  const capability = readiness.capabilities[target];
+  switch (target) {
+    case 'windows':
+      if (capability.fix === 'relogin') return { code: 'wayland_window_control_unavailable', message: WINDOW_HELPER_RELOGIN_HINT };
+      if (capability.fix === 'enable_window_helper') return { code: 'wayland_window_control_unavailable', message: WINDOW_HELPER_ENABLE_HINT };
+      if (capability.fix === 'install_package') {
+        return {
+          code: 'wayland_window_control_unavailable',
+          message: `wayland_window_control_unavailable: the ${readiness.desktop} window tool is missing from PATH; install ${capability.package}`,
+        };
+      }
+      return { code: 'wayland_window_control_unavailable', message: WINDOW_CONTROL_UNSUPPORTED_HINT };
+    case 'accessibility':
+      return { code: 'accessibility_unavailable', message: ACCESSIBILITY_HINT };
+    case 'pointer':
+    case 'keyboard':
+      return { code: 'input_unavailable', message: `${UINPUT_HINT}. ${INPUT_GROUP_SECURITY_NOTE}` };
+    case 'clipboard':
+      return { code: 'clipboard_unavailable', message: CLIPBOARD_HINT };
+    case 'ocr':
+      return { code: 'ocr_unavailable', message: TESSERACT_HINT };
+    default:
+      return { code: `${target}_unavailable`, message: `${target}_unavailable: ${target} is not available on this session` };
+  }
+}
+
+/** The required capabilities that are not usable, with their stable codes. */
+export function missingCapabilities(readiness, command) {
+  const missing = [];
+  for (const name of requiredCapabilities(command)) {
+    const capability = readiness.capabilities[name];
+    if (!capability || capability.state === 'ready' || capability.state === 'unknown') continue;
+    const { fix, package: pkg } = capability;
+    missing.push({
+      capability: name,
+      state: capability.state,
+      ...(fix ? { fix } : {}),
+      ...(pkg ? { package: pkg } : {}),
+      ...capabilityIssue(name, readiness),
+    });
+  }
+  return missing;
+}
+
+const CACHE_MS = 3000;
+let cached = null;
+
+/** Probed at most once per few seconds so a fix is noticed on the next call. */
+export function getLinuxComputerReadiness({ check = checkLinuxComputerReadiness, now = Date.now } = {}) {
+  if (!cached || now() - cached.at > CACHE_MS) {
+    const entry = { at: now(), result: Promise.resolve().then(() => check()) };
+    cached = entry;
+    entry.result.catch(() => {
+      if (cached === entry) cached = null;
+    });
+  }
+  return cached.result;
+}
+
+/**
+ * Null when the command can run; otherwise `{code, missing, message}` — the
+ * model-facing text names every missing capability and says nothing ran.
+ */
+export async function linuxComputerPreflight({ command, platform = process.platform, check, now } = {}) {
+  if (platform !== 'linux') return null;
+  const readiness = await getLinuxComputerReadiness({ check, now });
+  const missing = missingCapabilities(readiness, command);
+  if (missing.length === 0) return null;
+  const details = new Map();
+  for (const item of missing) {
+    const entry = details.get(item.message) ?? { code: item.code, message: item.message, capabilities: [] };
+    entry.capabilities.push(item.capability);
+    details.set(item.message, entry);
+  }
+  const lines = [...details.values()].map((entry) => `- ${entry.message} [${entry.capabilities.join(', ')}]`);
+  if (String(command?.action) === 'capture' && missing.some((item) => item.capability === 'windows') && !missing.some((item) => item.capability === 'capture')) {
+    lines.push('Screenshots that need no window still work: capture with mode="vision" and a screen index (screen=0).');
+  }
+  return {
+    code: CAPABILITY_UNAVAILABLE_CODE,
+    missing,
+    message: `${CAPABILITY_UNAVAILABLE_CODE}: Computer Use cannot run this action on this Linux session (${[...new Set(missing.map((item) => item.capability))].join(', ')}) — nothing was executed.\n${lines.join('\n')}`,
+  };
+}
+
+export const CAPTURE_FALLBACK_NOTE =
+  'Note: window control is not available on this Linux session, so this is a full-screen capture of screen 0 instead of the foreground window.';
+
+/**
+ * A default capture resolves the foreground window; without window control it
+ * becomes a full-screen capture instead of a refusal. Null when no fallback applies.
+ */
+export async function linuxCaptureFallback({ command, platform = process.platform, check, now } = {}) {
+  if (platform !== 'linux' || !isForegroundWindowCapture(command)) return null;
+  const { capabilities } = await getLinuxComputerReadiness({ check, now });
+  const { state } = capabilities.windows;
+  if (state !== 'needs_setup' && state !== 'unsupported') return null;
+  // A screen capture the session cannot take either is a refusal, not a fallback.
+  if (capabilities.capture.state === 'needs_setup' || capabilities.capture.state === 'unsupported') return null;
+  const { action, session_id, include_ocr } = command;
+  return {
+    command: { action, mode: 'vision', screen: 0, ...(session_id ? { session_id } : {}), ...(include_ocr ? { include_ocr } : {}) },
+    note: CAPTURE_FALLBACK_NOTE,
+  };
+}
+
+export function resetLinuxComputerPreflightCache() {
+  cached = null;
+}

package/src/runtime/computer-bridge/test-linux-display.mjs

@@ -0,0 +1,5 @@
+// Test-only: the Linux Computer Use preflight refuses to run without a graphical session, and CI runners are headless. A DISPLAY makes the preflight see an X11 session (no uinput/window-control blockers) so the client tests exercise the bridge, not the preflight (covered by linux-readiness.test.mjs).
+process.env.DISPLAY ||= ':99';
+// The AT-SPI probe asks the session bus; a CI bus must not turn into a missing-accessibility refusal.
+delete process.env.DBUS_SESSION_BUS_ADDRESS;
+process.env.XDG_RUNTIME_DIR = '/nonexistent-mixdog-test';

package/src/runtime/effort-judge/compact-tokenizer.mjs

@@ -23,16 +23,14 @@ function build(dir) {
   const json = JSON.parse(readFileSync(join(dir, 'tokenizer.json'), 'utf8'));
   const model = json.model;
   const pre = json.pre_tokenizer;
-  const spaceToMeta = json.normalizer?.type === 'Replace' && json.normalizer.pattern?.String === ' ' && json.normalizer.content === SPACE;
+  const spaceToMeta =
+    json.normalizer?.type === 'Replace' && json.normalizer.pattern?.String === ' ' && json.normalizer.content === SPACE;
   // metaspace: pieces start at every '▁' (mmBERT). whole: a split on ' ' after
   // the normalizer turned every ' ' into '▁' never fires, so BPE sees the
   // whole segment (EmbeddingGemma).
-  const split =
-    pre?.type === 'Metaspace' && pre.split !== false
-      ? 'metaspace'
-      : pre?.type === 'Split' && pre.pattern?.String === ' ' && spaceToMeta
-        ? 'whole'
-        : null;
+  let split = null;
+  if (pre?.type === 'Metaspace' && pre.split !== false) split = 'metaspace';
+  else if (pre?.type === 'Split' && pre.pattern?.String === ' ' && spaceToMeta) split = 'whole';
   if (model?.type !== 'BPE' || !spaceToMeta || !split || model.continuing_subword_prefix || model.end_of_word_suffix) {
     throw new Error('unsupported tokenizer.json layout for the compact encoder');
   }
@@ -68,7 +66,14 @@ function build(dir) {
   const prefix = template.slice(0, seqAt).flatMap(specialIds);
   const suffix = template.slice(seqAt + 1).flatMap(specialIds);
   const meta = Buffer.from(
-    JSON.stringify({ unk: vocab[model.unk_token] ?? -1, split, prepend: split === 'metaspace' ? pre.prepend_scheme || 'always' : 'never', added, prefix, suffix }),
+    JSON.stringify({
+      unk: vocab[model.unk_token] ?? -1,
+      split,
+      prepend: split === 'metaspace' ? pre.prepend_scheme || 'always' : 'never',
+      added,
+      prefix,
+      suffix,
+    }),
     'utf8'
   );
   const [size, mtime] = sourceStamp(dir);

package/src/runtime/effort-judge/judge-input.mjs

@@ -29,7 +29,10 @@ export function cleanJudgeText(text) {
     .trim();
 }
 
-const head = (text, n) => Array.from(String(text || '')).slice(0, n).join('');
+const head = (text, n) =>
+  Array.from(String(text || ''))
+    .slice(0, n)
+    .join('');
 const tail = (text, n) => {
   const cps = Array.from(String(text || ''));
   return cps.slice(Math.max(0, cps.length - n)).join('');
@@ -89,7 +92,7 @@ export function packJudgeIds(tokenizer, { request, prevRequest, prev }, maxToken
     : [];
   const [first, rest] = splitReply(cleanJudgeText(tail(prev, 1000)));
   const top = first ? tokenizer.encode(`previous reply: ${first}`).slice(0, PACK_BUDGET.replyHead) : [];
-  let left = Math.max(0, room - req.length - q.length - top.length);
+  const left = Math.max(0, room - req.length - q.length - top.length);
   const end = rest && left > 0 ? tokenizer.encode(rest) : [];
   const endIds = end.slice(Math.max(0, end.length - left));
   return [...tokenizer.prefix, ...req, ...q, ...top, ...endIds, ...tokenizer.suffix].slice(0, maxTokens);

package/src/runtime/effort-judge/model-install.mjs

@@ -21,7 +21,9 @@ export function effortJudgeManifest() {
   if (
     !manifest.release ||
     !files.length ||
-    files.some(([, f]) => !validSha256(f.sha256) || !Number.isSafeInteger(f.size) || f.size <= 0 || !/^https:\/\//.test(f.url))
+    files.some(
+      ([, f]) => !validSha256(f.sha256) || !Number.isSafeInteger(f.size) || f.size <= 0 || !/^https:\/\//.test(f.url)
+    )
   ) {
     throw new Error('effort judge model manifest is invalid');
   }
@@ -43,7 +45,10 @@ export function effortJudgeInstallCurrent(dir, manifest = effortJudgeManifest())
 }
 
 /** Download what is missing or different, then stamp the release. */
-export async function installEffortJudgeModel(dir, { fetchFn = globalThis.fetch, manifest = effortJudgeManifest() } = {}) {
+export async function installEffortJudgeModel(
+  dir,
+  { fetchFn = globalThis.fetch, manifest = effortJudgeManifest() } = {}
+) {
   mkdirSync(dir, { recursive: true });
   let replaced = false;
   for (const [name, file] of Object.entries(manifest.files)) {
@@ -58,7 +63,8 @@ export async function installEffortJudgeModel(dir, { fetchFn = globalThis.fetch,
         fetchFn,
       });
       const actual = await sha256File(partial);
-      if (actual !== file.sha256) throw new Error(`effort judge ${name}: sha256 mismatch (expected ${file.sha256}, got ${actual})`);
+      if (actual !== file.sha256)
+        throw new Error(`effort judge ${name}: sha256 mismatch (expected ${file.sha256}, got ${actual})`);
       // From the first replaced file until the new stamp, the folder is a mix of
       // releases: without a stamp it reads as not installed, so an interrupted
       // install is never loaded.

package/src/runtime/effort-judge/model-manifest.json

@@ -1,20 +1,20 @@
 {
   "schema_version": 1,
-  "release": "effort-judge-v4",
+  "release": "effort-judge-v6",
   "files": {
     "model.onnx": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v4/model.onnx",
-      "sha256": "1214a76047d08c573566844056f50b0cc82b484f57e809c997443701baa503f6",
-      "size": 130798686
+      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v6/model.onnx",
+      "sha256": "5abed811aaa44690f8d6292472aa8d930abae49f73a99265bb7fe874044df395",
+      "size": 153062716
     },
     "tokenizer.json": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v4/tokenizer.json",
+      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v6/tokenizer.json",
       "sha256": "22c064aaa468855d6211fe5c2ec8fdec595c97c55eb2ffd3b9fdf71a93b16292",
       "size": 32170665
     },
     "calibration.json": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v4/calibration.json",
-      "sha256": "5445f2d7a97ec5758e8caea7de8e299788260eb7cf0362b6ccd043f09a7ceb00",
+      "url": "https://github.com/tribgames/mixdog/releases/download/effort-judge-v6/calibration.json",
+      "sha256": "cc52c28b19fa891cca8913c69871235d5f863bd224d9336ada7d0f8cfb0765f6",
       "size": 157
     }
   }

package/src/runtime/memory/lib/embedding-worker.mjs

@@ -395,9 +395,15 @@ async function loadExtractor() {
             try {
               os.setPriority(0, os.constants.priority.PRIORITY_NORMAL);
             } catch (e) {
-              __mixdogMemoryLog(
-                `[embed-worker] WARN: process priority stuck below normal (restore failed: ${e?.message || e})\n`
-              );
+              // Unprivileged processes cannot raise priority back (EACCES/EPERM);
+              // on Linux that is expected, not a stuck state worth warning about.
+              const expectedOnLinux =
+                process.platform === 'linux' && /EACCES|EPERM/.test(`${e?.code} ${e?.message}`);
+              if (!expectedOnLinux) {
+                __mixdogMemoryLog(
+                  `[embed-worker] WARN: process priority stuck below normal (restore failed: ${e?.message || e})\n`
+                );
+              }
             }
           }
         }

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -799,4 +799,7 @@ export function stopPgForShutdownSync() {
   try {
     _pgProc.stopPgSync({ runtimeDir, pgdataDir });
   } catch {}
+  // The postmaster is gone, so drop its advert too (same guarded clear as the
+  // async path: never another live owner's); otherwise pg.json outlives the run.
+  patchActiveInstance({ pg_port: null, pg_started_at: null, pg_pgdata: null, pg_runtime_dir: null }, { timeoutMs: 1000 });
 }

package/src/runtime/shared/config.mjs

@@ -31,7 +31,15 @@ const {
   setSecret: _setSecret,
   deleteSecret: _deleteSecret,
   hasSecret: _hasSecret,
+  setSecretAsync: _setSecretAsyncImpl,
+  deleteSecretAsync: _deleteSecretAsyncImpl,
+  keychainStatus: _keychainStatus,
+  retryKeychain: _retryKeychain,
+  refreshKeychainStatus: _refreshKeychainStatus,
+  onKeychainRecovered: _onKeychainRecovered,
 } = _require('../../lib/keychain-cjs.cjs');
+const _setSecretAsync = _setSecretAsyncImpl ?? (async (account, value) => _setSecret(account, value));
+const _deleteSecretAsync = _deleteSecretAsyncImpl ?? (async (account) => _deleteSecret(account));
 
 // Resolved per call: the pristine-execution boundary retargets
 // MIXDOG_resolvePluginData() at runtime, so an import-time capture would write into the
@@ -588,6 +596,21 @@ export function saveSecret(account, value) {
   try {
     _setSecret(account, value);
   } catch (err) {
+    throw saveSecretError(account, err);
+  }
+}
+
+/** Non-blocking saveSecret: Linux secret-tool runs off the event loop. */
+export async function saveSecretAsync(account, value) {
+  try {
+    await _setSecretAsync(account, value);
+  } catch (err) {
+    throw saveSecretError(account, err);
+  }
+}
+
+function saveSecretError(account, err) {
+  {
     // On WSL/headless Linux (and any host missing a usable keychain provider,
     // e.g. secret-tool/libsecret not installed or no running Secret Service) the OS
     // write throws a cryptic provider error. Surface an actionable message that
@@ -599,11 +622,10 @@ export function saveSecret(account, value) {
     const envHint = stdEnv ? `${stdEnv} (or ${envKey})` : envKey;
     const e = new Error(
       `[config] could not save secret to the OS keychain: ${err?.message ? err.message : err}\n` +
-        `  No usable keychain provider on this host (common on WSL / headless Linux without libsecret).\n` +
         `  Set the ${envHint} environment variable instead — the runtime reads it directly.`
     );
     e.cause = err;
-    throw e;
+    return e;
   }
 }
 
@@ -611,6 +633,32 @@ export function deleteSecret(account) {
   _deleteSecret(account);
 }
 
+/** Non-blocking deleteSecret: Linux secret-tool runs off the event loop. */
+export async function deleteSecretAsync(account) {
+  await _deleteSecretAsync(account);
+}
+
+/** Retry a failed Linux keyring read; true when it just recovered. */
+export async function retryKeychain(options) {
+  return typeof _retryKeychain === 'function' ? await _retryKeychain(options) : false;
+}
+
+/** Passively detect a keyring that locked after it was read and re-snapshot a
+ *  stale cache (no unlock prompt). Resolves true when stored values changed. */
+export async function refreshKeychainStatus(options) {
+  return typeof _refreshKeychainStatus === 'function' ? (await _refreshKeychainStatus(options)) === true : false;
+}
+
+/** Subscribe to a locked/failed Linux keyring becoming readable again. */
+export function onKeychainRecovered(listener) {
+  return typeof _onKeychainRecovered === 'function' ? _onKeychainRecovered(listener) : () => {};
+}
+
+/** Keyring health for the UI: { state: ok|locked|missing|error|unknown, message }. */
+export function getKeychainStatus() {
+  return typeof _keychainStatus === 'function' ? _keychainStatus() : { state: 'unknown', message: '' };
+}
+
 /**
  * Whether a secret is stored in the OS keychain for `account` (ignores env).
  * Lets the setup UI show "Set" WITHOUT ever sending the secret value to the

package/src/runtime/shared/developer-options.mjs

@@ -30,6 +30,13 @@ export const DEVELOPER_SECTIONS = Object.freeze([
         warning: OAUTH_RISK_WARNING,
         provider: 'cursor-oauth',
       }),
+      Object.freeze({
+        id: 'mimoOAuth',
+        label: 'MiMo',
+        description: 'Show Xiaomi MiMo OAuth in Providers and the model picker.',
+        warning: OAUTH_RISK_WARNING,
+        provider: 'mimo-oauth',
+      }),
     ]),
   }),
 ]);