mixdog 1.2.0 → 1.2.1

package/README.md

@@ -6,8 +6,12 @@
 
 <p align="center">
   The open-source coding agent that uses 63% fewer tokens.
+  <br>
+  <a href="#installation"><b>Download ↓</b></a>
 </p>
 
+https://github.com/user-attachments/assets/af515dc9-b0fb-4b6a-aaa1-1d82db792ed0
+
 <p align="center">
   <a href="https://github.com/tribgames/mixdog/releases/latest/download/mixdog-desktop-win-x64.exe"><img src="https://raw.githubusercontent.com/tribgames/mixdog/main/docs/assets/download-windows.svg" alt="Download for Windows" height="48"></a>
   &nbsp;
@@ -30,8 +34,6 @@
   <a href="#documentation"><b>Docs</b></a>
 </p>
 
-https://github.com/user-attachments/assets/af515dc9-b0fb-4b6a-aaa1-1d82db792ed0
-
 ## Highlights
 
 - [63% fewer tokens](#benchmarks) than Codex CLI on the same model, at the
@@ -116,9 +118,9 @@ shell networking — headless exec is not an offline sandbox. Run
 
 <p align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/tribgames/mixdog/main/benchmarks/terminal-bench-2.1/tb21-sol-vs-codex-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/tribgames/mixdog/main/benchmarks/terminal-bench-2.1/tb21-sol-vs-codex-light.svg">
-    <img alt="Bar chart: Mixdog vs Codex CLI on Terminal-Bench 2.1" src="https://raw.githubusercontent.com/tribgames/mixdog/main/benchmarks/terminal-bench-2.1/tb21-sol-vs-codex-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/tribgames/mixdog/main/design/promo/tb21-sol-vs-codex-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/tribgames/mixdog/main/design/promo/tb21-sol-vs-codex-light.svg">
+    <img alt="Bar chart: Mixdog vs Codex CLI on Terminal-Bench 2.1" src="https://raw.githubusercontent.com/tribgames/mixdog/main/design/promo/tb21-sol-vs-codex-light.svg">
   </picture>
 </p>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "private": false,
   "type": "module",
   "description": "Open-source coding agent that matches Codex on Terminal-Bench 2.1 with 63% fewer tokens.",

package/src/defaults/shipped-history.json

@@ -285,9 +285,11 @@
       "07802a61d913c3fb7c431774e7f4ebb7",
       "0a34c5b6011578bebdb6cca63edfcec4",
       "0ddf9f9845e1fcfc76d81592d6a71e70",
+      "0e044c22eb0786162ebb33a30f3bd5ae",
       "44171df8144101dc74bf21f72cb5b7c0",
       "48247c1645fd94aad7711082d4512c49",
       "4f94016363acccd788a724a2d414744e",
+      "56e474f78faafae39aebe921ccff112d",
       "6358ad25dd07a2f92ad65c249a4f360b",
       "7fb12aeb07b79ae113c0deb0a90c6da7",
       "804afd71ebc3f68614a4dc419af4b98e",
@@ -319,6 +321,7 @@
       "0d5c8c6e2349addf71d2ed2b4c1ccb1f",
       "0d6926aaca2890da9347f15a826546e3",
       "0f14ba0a3d8b3896b717dc144bbe49a4",
+      "15d86146cfbd58d85adf0c25cf1d683f",
       "1c317db86e1ff80a5c4102e09e36f5fb",
       "242f11864abdef90fa0cc9cb4599a579",
       "29a347c4d3a2f773fa92c627260301ba",
@@ -364,6 +367,7 @@
       "fe0512acbb2fc8f80c5961b9f44aa5e2"
     ],
     "visualize": [
+      "aa3531bfc4fd6ec3820493d0c190cc75",
       "f65924f0691284ad31000469a9855b62"
     ],
     "xlsx": [

package/src/defaults/skills/pptx/SKILL.md

@@ -23,9 +23,9 @@ The model designs; the runtime converts and measures. Write HTML/CSS for the act
 |---|---|---|
 | **New deck**, or a redesign the user wants rebuilt | one `author` call per deck: HTML slides in `script` by default (`references/html.md`), or a pptxgenjs script (§2-§4) when the kit's devices are wanted or no local browser exists; a new deck is never assembled from `batch` operations | `author` returns `audit.status: 'pass'`; `render` on that session returns the pages and a `reviewToken` |
 | **Existing deck** — template fill, partial rewrite, reorder, merging decks | `open` → `snapshot` → `batch` slide and shape operations (§6); a new page is a duplicated source page, never a runtime-composed one | every `batch` returns its own `audit` for the edited slides |
-| **Read or extract** — outline, text, or figures from a deck, or the material a deck is built from | `open` + a paged `snapshot` (`pages:[…]` or `cursor:`), or `node "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <file>` for blocks with citable locators | blocks prefixed `[slide 4]`, `[p3]`, `[Sheet1!B4]`, `[line 42]` |
+| **Read or extract** — outline, text, or figures from a deck, or the material a deck is built from | `open` + a paged `snapshot` (`pages:[…]` or `cursor:`), or `${MIXDOG_SKILL_NODE} "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <file>` for blocks with citable locators | blocks prefixed `[slide 4]`, `[p3]`, `[Sheet1!B4]`, `[line 42]` |
 
-Prerequisites: the Office capability (`metadata.requires`) — its portable backend needs no installed PowerPoint, and Office on Windows is used in the background when present; fonts that render reliably for the recipient; a signed-in `media` lane only for generated pictures; an explicit `--provider` and `--model` for the reviewer and page-QC scripts, which reuse the existing sign-in and never ask for credentials.
+Prerequisites: the Office capability (`metadata.requires`) — its portable backend needs no installed PowerPoint, and Office on Windows is used in the background when present; fonts that render reliably for the recipient; a signed-in `media` lane only for generated pictures; an explicit `--provider` and `--model` for the reviewer and page-QC scripts, which reuse the existing sign-in and never ask for credentials. Run bundled scripts with `${MIXDOG_SKILL_NODE}` (on PATH in any shell), never plain `node`.
 
 ## 1. Load routing
 | File | Owns | Read when |
@@ -59,10 +59,10 @@ Prerequisites: the Office capability (`metadata.requires`) — its portable back
    **Bounded refinement**: fix factual and material visual defects before taste edits. Keep each pass focused on the highest-impact changes. After two unsuccessful corrections of the same defect, preserve the last valid artifact and report the limitation rather than cycling for a higher score. This limit is not permission to call an inadequate design complete. If an asset fails, repair or replace it; if it is removed, recompose the space it owned.
 8. **Page QC (new decks; skip for a one-page edit)**: after the measured audit, `qa render:false`, and the first render, check overflow, clipping, collision, canvas edge, contrast, and distortion; never redesign, reword, add, or delete. In Solo, Lead reviews directly. Only with workflow-approved delegation, use the runner below: each fresh fixer sees one page's image, inventory, and measured defects, uses only office, and edits a working copy. The runner adopts it only if defects did not grow and no other page changed. For this delegated route, `close` the session before running:
    ```text
-   node "${MIXDOG_SKILL_DIR}/scripts/qc-pages.mjs" <deck.pptx> --provider <provider> --model <model> --output qc-report.json [--pages 1-12] [--no-vision]
+   ${MIXDOG_SKILL_NODE} "${MIXDOG_SKILL_DIR}/scripts/qc-pages.mjs" <deck.pptx> --provider <provider> --model <model> --output qc-report.json [--pages 1-12] [--no-vision]
    ```
    Provider and model are explicit, as for the reviewer; `--no-vision` runs the geometry read only (a text-only model, or no renderer); at most 20 pages per run. Read the report (`pages[].reason`: improved, polished as unchanged, clean, scope, regression, audit_failed, execution_failed). A page whose run never replied is not a page that passed: `execution_failed` counts into `failed`, turns `ok` false, and exits the command, so rerun those pages before delivery rather than reading the report as clean. Then `open` the deck again and `render` it: the QC edits invalidate the earlier `reviewToken`, and a reopened session no longer carries the brief, which is why the brief read (`qa render:false`) comes before this step.
-9. Reader and art director pass — read the contact sheet for sequence and full-size pages for detail. For substantial new work, use the source questions in `references/review.md`; its separate reviewer procedure (`node "${MIXDOG_SKILL_DIR}/scripts/review-deck.mjs" packet.json --provider <provider> --model <model> --output review.json`) requires workflow-approved delegation. Otherwise, explicitly label the pass self-review. Check the reader's answers against the original source key, then judge message visibility, focal hierarchy, and coherent variation before consulting `deck.rhythm`.
+9. Reader and art director pass — read the contact sheet for sequence and full-size pages for detail. For substantial new work, use the source questions in `references/review.md`; its separate reviewer procedure (`${MIXDOG_SKILL_NODE} "${MIXDOG_SKILL_DIR}/scripts/review-deck.mjs" packet.json --provider <provider> --model <model> --output review.json`) requires workflow-approved delegation. Otherwise, explicitly label the pass self-review. Check the reader's answers against the original source key, then judge message visibility, focal hierarchy, and coherent variation before consulting `deck.rhythm`.
    **Output**: a slide-specific keep/fix decision with the visible reason. Resolve phrase-breaking wraps, weak evidence, and accidental empty regions; do not move a title merely to vary the sequence or change a successful page to reach a quota. Select at most two high-impact design revisions per pass; zero is valid.
    **Default — reuse the review**: small text, shape or data edits use `batch`, not re-author; every `batch` returns its own `audit` for the edited slides, read before the next edit. Portable renders report `changedPages` and `reusedPages` for up to 12 requested pages: inspect changed pages and carry forward the unchanged pages' critique. Shared resources invalidate the cache conservatively; PDF export remains whole-document. COM and long-deck contact sheets refresh normally. Always use the new complete render token, never the previous approval.
 10. `office action:'finalize' session:<id> design:{ reviewed:true, reviewToken, critique:[...] }` — reuses a complete current preview, checks the document, saves, validates, and closes. Use the token from the final complete render; after detail-page inspection, restore a complete render before finalizing. An edit invalidates the previous approval. `fixes` lists work still owed; applied fixes belong in `note`. A render/export failure leaves the deliverable unfinished: preserve the session and artifacts, report the failure, and never substitute a manual save for successful finalize. Finalize an authored deck in its authoring session: a deck reopened in `mode:'background'` is re-saved by PowerPoint, which rewrites the theme, layout, and embedded-workbook parts, and the validation baseline then reports `changed_protected_part` / `lost_protected_part` against the file it opened. Done when finalize reports the saved, validated file and the session is closed.
@@ -84,7 +84,7 @@ Prerequisites: the Office capability (`metadata.requires`) — its portable back
 ```
 **Hard rule — the plan is the page's contract**: every slide's plan line names its job, relationship, move, composition move, carriers, texture, and rhythm before any geometry exists, so the design is decided before it is drawn. **The runtime gates on it** from two slides up: `author` refuses a deck whose brief has no `slide plan:` line (`plan_missing`), whose plan leaves a slide unwritten (`plan_slide_unplanned`), whose line names no job or carriers (`plan_incomplete`), or whose page does not carry what its own line named (`plan_promise_missing`) — `reason: plan_gate` with the slides listed, the previous deck and its session untouched, and the answer is the plan line or the page, not a retry. A single-slide specimen is not gated, and a stale slide count stays information (`plan_count_mismatch`). A thin request gets a defensible brief invented from the subject, never blank fields. The `facts:`, `directions:`, and `slide plan:` lines may wrap across comment lines; each continuation line is read as more ` · ` items — so ` · ` is the separator and never appears inside a value or a source (write "관측치와 측정", not "관측치·측정"; a fact cut at an inner ` · ` silently disappears and every figure it carried becomes `number_without_fact`). → runtime `plan_gate` at author (`plan_missing`, `plan_slide_unplanned`, `plan_incomplete`, `plan_promise_missing`); `plan_count_mismatch` in qa
 **Hard rule — every figure has a fact**: `facts:` lists each number the deck will show, with its source (a page, a cell, a URL, or "user brief"). Dates and slide numbers are exempt. A chart series is one fact listing its values in order (`F3 운영비 1Q–6Q 10.5 10.8 9.1 7.9 7.0 6.5 — 재무팀 시트 B4:G4`); the values in the script's `chart()` call are copied from that line. With source material, the fact sheet is written first; without it, the facts come from the request and say so. **The runtime gates on it**: `author` reads the staged deck and refuses to land one that shows a figure no fact covers (`reason: facts_gate`, the figures listed per slide) — the previous deck and its session stay untouched, and the answer is the facts line, not a retry. A sketch or template with no source at all declares `facts: sample — <why>`: every figure is illustrative, the deck lands with `factsMode: 'sample'`, and the delivery tells the user the numbers are examples. → runtime `facts_gate` at author; `number_without_fact`, `facts_missing`, `facts_illustrative` in qa
-**Hard rule — supplied material is cited**: when the deck is built from files or pages the user gave, `sources:` names them and every fact's source points where a reader can open it — a page (`p.12`), a cell (`Sheet1!B4`), a section (`§3`), or a URL. `node "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <file>` prints the material as blocks already prefixed with those locators, which is what the fact sheet quotes. A figure that came from somewhere else (a conversation, a live system) says so in its own source. → runtime `fact_without_locator` (advisory)
+**Hard rule — supplied material is cited**: when the deck is built from files or pages the user gave, `sources:` names them and every fact's source points where a reader can open it — a page (`p.12`), a cell (`Sheet1!B4`), a section (`§3`), or a URL. `${MIXDOG_SKILL_NODE} "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <file>` prints the material as blocks already prefixed with those locators, which is what the fact sheet quotes. A figure that came from somewhere else (a conversation, a live system) says so in its own source. → runtime `fact_without_locator` (advisory)
 
 ## 4. Script contract and library boundaries
 - The kit prelude creates `pres` (`pptxgenjs`, `LAYOUT_WIDE` 13.33 × 7.5 in, coordinates in inches) and every helper; a script that declares its own `pres` runs without the prelude. Available modules: `pptxgenjs`, `sharp`, `node:fs`, `node:path`, `node:buffer`; no network and no photo library. Icons come from the injected `ICON` (256 offline Lucide stroke icons; `ICON.names` lists them, the kit's `icon()` / `iconRow()` place them) — a feature marker, a list prefix, or a stage glyph is an icon by name, never a Unicode emoji or a hand-drawn shape.
@@ -113,7 +113,7 @@ The runtime absorbs what it can (one `a:pPr` per paragraph; package validation a
 | A secondary-axis combo needs `valAxes` and `catAxes` with two entries each | PowerPoint drops the chart → runtime `chart_axis_undeclared` |
 
 ## 5. QA and finalize
-**Content before pixels**: read the deck's text once against the fact sheet — `node "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <deck.pptx>` on the saved file, or the snapshot's `text` — for missing material, typos, and order; a wrong order or a dropped fact is cheaper to catch in text than on a contact sheet. → manual
+**Content before pixels**: read the deck's text once against the fact sheet — `${MIXDOG_SKILL_NODE} "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <deck.pptx>` on the saved file, or the snapshot's `text` — for missing material, typos, and order; a wrong order or a dropped fact is cheaper to catch in text than on a contact sheet. → manual
 Then inspect every rendered slide in this order. Read actual phrase endings, compare peer baselines and gaps, trace each connector to its intended boundary, and check that labels belong to the right object. Record a visible keep/fix reason rather than inferring a pass from a clean QA report. Hard hits need correction; the runtime's actual severity and source determine what blocks finalize. "Manual" means only the rendered image shows it.
 
 **Preview fidelity**: the portable preview is LibreOffice, and it spaces Hangul and CJK *chart category labels* by character — `1분기` is drawn as `1 분기` while the chart part holds the unspaced string, and PowerPoint draws it unspaced. Check the string (`source-extract.mjs` or the chart's `c:v` values) before treating it as a defect; slide text is unaffected.

package/src/defaults/skills/pptx/references/review.md

@@ -52,12 +52,14 @@ policy. Provider and model must be explicit; it uses the existing sign-in, never
 asks to paste credentials. This is context separation, not an OS filesystem
 sandbox or proof that the model's judgement is unbiased.
 
-Run from the Project; `<pptx-skill-directory>` is the `<base-dir>` the runtime
-printed when the skill loaded (`SKILL.md` §2 step 9 carries the command with
-that directory already resolved):
+Run it from the Project with the command `SKILL.md` §2 step 9 carries, which
+the runtime resolved when the skill loaded. It starts with the launcher command
+named there (on the shell tool's PATH), not plain `node`, which cannot load the
+script in every installation. Its shape, with `<pptx-skill-directory>` the
+`<base-dir>` the runtime printed:
 
 ```text
-node "<pptx-skill-directory>/scripts/review-deck.mjs" packet.json --provider <provider> --model <model> --output review.json
+<launcher command from SKILL.md> "<pptx-skill-directory>/scripts/review-deck.mjs" packet.json --provider <provider> --model <model> --output review.json
 ```
 
 Packet format (all paths relative to the packet file unless absolute):

package/src/defaults/skills/pptx/scripts/source-extract.mjs

@@ -6,7 +6,7 @@
 // portable session that is closed without saving; anything else is read as
 // UTF-8 text. Output is bounded by --chars (default 4000) and every block is
 // cut at BLOCK_CHARS, so a large source never floods the context.
-//   node "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <file> [--chars 4000]
+//   ${MIXDOG_SKILL_NODE} "${MIXDOG_SKILL_DIR}/scripts/source-extract.mjs" <file> [--chars 4000]
 import { access, readFile } from 'node:fs/promises';
 import { extname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';

package/src/defaults/skills/setup/references/actions.md

@@ -57,7 +57,7 @@ Read this when choosing a `setup` mutation.
 | Refresh a plugin checkout | `update_plugin` |
 | Enable or disable a plugin | `set_plugin_enabled` |
 | Remove a plugin | `remove_plugin` |
-| Install or reconfigure the MCP server a plugin ships | `enable_plugin_mcp` |
+| Turn back on and reconnect every MCP server a plugin declares | `enable_plugin_mcp` |
 | Available hosted models and their options; optionally one provider, native-search capable only, or a refreshed catalog | `list_models` |
 | Agent orchestration, independent of workflow instructions | `set_orchestration_mode` |
 | Safe MCP edit metadata, excluding raw connection/credential values | `get_mcp_server` |
@@ -204,8 +204,18 @@ markers are read with `status desktop`.
 - Environment/header maps are partial patches. Omitted keys are preserved;
   `null` explicitly removes one key, including a stored credential.
 - Plugin enablement moves its contributed skills and MCP integrations together.
-- `enable_plugin_mcp` writes the MCP server a plugin ships and reconnects; it
-  fails for a plugin without an MCP script.
+- A registered plugin's MCP servers (its `.mcp.json` and manifest
+  `mcpServers`) appear automatically with `source: "plugin"` and `plugin` /
+  `pluginServer` in `status mcp`; nothing is copied into the MCP list. A plugin
+  server runs only while both the plugin and the server are enabled;
+  `set_mcp_enabled` toggles the server, `set_plugin_enabled` the plugin, and
+  `set_extension_scope` limits it (the plugin's scope still applies).
+  `add_mcp_server`, `save_mcp_server`, and `remove_mcp_server` refuse plugin
+  servers. Declaration problems and naming conflicts are reported as
+  `declarationErrors` and `warnings`.
+- `enable_plugin_mcp` turns every server the plugin declares back on and
+  reconnects them; a disabled plugin stays disabled, and it fails for a plugin
+  that declares no MCP servers.
 
 ## Desktop, Projects, and automation
 

package/src/defaults/skills/visualize/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: visualize
-description: Show mockups, design options, diagrams, and finished artifacts beside the chat with the visualize tool.
-when_to_use: 'Mockups before UI work, design options, visual explanations, or showing a produced artifact; not production code alone.'
+description: Show mockups, design options, diagrams, and finished artifacts in the side panel beside the chat.
+when_to_use: 'Mockups, previews, design options, diagrams, or showing any finished artifact; not code alone.'
 metadata:
   requires: visualize
 dependencies:
@@ -68,13 +68,16 @@ testing a page belong to `browser`.
    panel keeps each saved state as a version (v1…vN) the user can step back
    to, compare side by side, or restore, so never copy the file to keep an
    old version. The user can also point at the page: their message then carries a
-   `<visualize_feedback>` block of numbered pins (`pin N` = the "📌 N" they
-   saw), each with the note, tab and project-relative file, and for an HTML
-   element its selector, label, trimmed HTML, key styles and box (a PDF or
-   image pin gives a region instead), plus the crop image "visualize pin N"
-   when there is one. Answer pin by pin by number and act on the element
-   the selector names; secret values arrive as `[redacted]`, so never restore
-   them from the crop or guess them.
+   `<visualize_feedback>` block of numbered pins (`pin N` = the pin numbered
+   N they saw), each with its label, note, tab, project-relative file and
+   `kind` (pane kind + element or region). An HTML element pin adds its
+   selector, `inside` path, trimmed HTML, key styles and box; a region pin
+   (an HTML drag, a document, PDF, image, diagram, or video frame) adds its
+   area, plus `elements` for an HTML drag and `time` for a video. The crop
+   image "visualize pin N" comes when there is one (`crop: none` otherwise).
+   Answer pin by pin by number and act on what the selector or area names;
+   secret values arrive as `[redacted]`, so never restore them from the crop
+   or guess them.
 8. **After approval**: implement from the approved mockup; its values are the
    spec. When the work needs a record, `export` the approved tab to PNG or PDF
    beside the page (`export` with `format` and a project-relative `output`,

package/src/rules/shared/60-verification.md

@@ -5,7 +5,9 @@
   independent invariants, never from the output itself or from recall.
 - After all edits, cover each required check once: one runner per runtime,
   independent checks in parallel; no read/list/diff to confirm your own
-  writes; rerun only failed or invalidated checks.
+  writes; rerun only failed or invalidated checks. If repeated fixes leave
+  the same failure unchanged, test the underlying assumptions before
+  another fix.
 - Use supplied commands unchanged except inputs, else documented defaults; no
   stricter flags or unrequested suites.
 - Warnings or blocked checks never justify editing passing code. Fix obsolete

package/src/rules/shared/70-delivery.md

@@ -8,8 +8,10 @@
   `src/app.ts:42`); files outside the Project always by absolute path; never a
   bare name, a path relative to another folder, or a `file://` URI.
 - Deliver requested visual artifacts (SVG, diagrams, HTML pages) as saved files
-  and give their path, which opens them in the browser panel; never open them
-  in the system browser or paste their source unless the user asks.
+  and give their path; never open them in the system browser or paste their
+  source unless the user asks.
+<!-- tools: visualize -->
+- Open each finished artifact beside the chat with `visualize open` when available.
 
 <!-- tools: git -->
 - A commit request includes selecting and staging its changes; a stage-only

package/src/runtime/agent/orchestrator/cache-mtime.mjs

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { statSync, readdirSync } from 'node:fs';
 
 /**
@@ -14,6 +15,28 @@ import { statSync, readdirSync } from 'node:fs';
  */
 export function maxMtimeRecursive(paths, depth = 3) {
   let max = 0;
+  walkMtimes(paths, depth, (_p, m) => {
+    if (m > max) max = m;
+  });
+  return max;
+}
+
+/**
+ * Exact change signature over the same walk as maxMtimeRecursive: every
+ * stat'ed path with its own mtime, so any single path changing (even to an
+ * older time) changes the result. Compare for equality only.
+ *
+ * @param {string[]} paths
+ * @param {number}   [depth=3]
+ * @returns {string}
+ */
+export function mtimeSignatureRecursive(paths, depth = 3) {
+  const parts = [];
+  walkMtimes(paths, depth, (p, m) => parts.push(`${p}:${m}`));
+  return createHash('sha1').update(parts.join('\n')).digest('hex');
+}
+
+function walkMtimes(paths, depth, visit) {
   function walk(p, d) {
     let st;
     try {
@@ -22,7 +45,7 @@ export function maxMtimeRecursive(paths, depth = 3) {
       return;
     }
     if (st.isDirectory()) {
-      if (st.mtimeMs > max) max = st.mtimeMs;
+      visit(p, st.mtimeMs);
       if (d <= 0) return;
       let entries;
       try {
@@ -36,17 +59,15 @@ export function maxMtimeRecursive(paths, depth = 3) {
           walk(child, d - 1);
         } else if (e.isFile() && (e.name.endsWith('.md') || e.name.endsWith('.json'))) {
           try {
-            const m = statSync(child).mtimeMs;
-            if (m > max) max = m;
+            visit(child, statSync(child).mtimeMs);
           } catch {
             /* unreadable entry: skipped like a missing path */
           }
         }
       }
     } else {
-      if (st.mtimeMs > max) max = st.mtimeMs;
+      visit(p, st.mtimeMs);
     }
   }
   for (const p of paths) walk(p, depth);
-  return max;
 }

package/src/runtime/agent/orchestrator/config.mjs

@@ -4,10 +4,7 @@ import { mergeStoredProviders } from './config-providers-merge.mjs';
 import { normalizeExtensionScopes } from '../../shared/extension-scopes.mjs';
 import { applyConfigPatch, diffConfig } from '../../shared/config-patch.mjs';
 import { normalizeWorkflowSelection } from '../../shared/orchestration.mjs';
-import {
-  DEFAULT_INSTRUCTION_FILES_MODE,
-  normalizeInstructionFilesMode,
-} from '../../shared/instruction-files-mode.mjs';
+import { DEFAULT_INSTRUCTION_FILES_MODE, normalizeInstructionFilesMode } from '../../shared/instruction-files-mode.mjs';
 import {
   DEFAULT_DISABLED_AGENT_ROSTER,
   canonicalizeAgentRouteStorage,
@@ -45,6 +42,7 @@ import {
 import { oauthCredentialProbeState, isOAuthProviderAvailable } from './providers/oauth-credential-probes.mjs';
 import { normalizeDeveloperConfig } from '../../shared/developer-options.mjs';
 import { normalizeWorktreeSettings } from '../../shared/worktrees/settings.mjs';
+import { normalizePluginMcpIntents } from './runtime-core/plugin-mcp.mjs';
 
 export const {
   PROFILE_LANGUAGES,
@@ -114,6 +112,8 @@ export function buildDefaultConfig(options = {}) {
   providers['grok-oauth'] = oauthEntry('grok-oauth');
   // Muse Code subscription (Meta Muse Spark), enabled from its stored key.
   providers['muse-code-oauth'] = oauthEntry('muse-code-oauth');
+  // Command Code Provider API, enabled from its stored Studio API key.
+  providers['command-code-oauth'] = oauthEntry('command-code-oauth');
   // Dev-only providers (Settings → Developer → Providers, one option each):
   // omitted entirely from the default config while their option is off so
   // they never surface in settings.
@@ -253,6 +253,7 @@ export function loadConfig(options = {}) {
       const loaded = canonicalizeAgentRouteStorage({
         providers: mergedProviders,
         mcpServers,
+        pluginMcp: normalizePluginMcpIntents(raw.pluginMcp),
         presets: withDefaultPresets(normalizedPresets),
         default: raw.default || null,
         maintenance: { ...DEFAULT_MAINTENANCE, ...normalizedMaint },
@@ -305,6 +306,7 @@ export function loadConfig(options = {}) {
   return {
     ...defaults,
     mcpServers: {},
+    pluginMcp: {},
     presets: DEFAULT_PRESETS.map((p) => ({ ...p })),
     default: null,
     maintenance: { ...DEFAULT_MAINTENANCE },
@@ -432,6 +434,10 @@ function buildAgentSaveBuilder(config) {
       modules,
       builtins,
     };
+    // Per-server intent for plugin-declared MCP servers; empty stays absent.
+    const pluginMcp = normalizePluginMcpIntents(config.pluginMcp);
+    if (Object.keys(pluginMcp).length) next.pluginMcp = pluginMcp;
+    else delete next.pluginMcp;
     // Developer options (developer-options.mjs); an empty set stays absent.
     if (Object.keys(developer).length) next.developer = developer;
     else if (Object.hasOwn(config, 'developer')) delete next.developer;

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -13,11 +13,12 @@ export {
   collectSkillsCached,
   filterSkillsExcludingDisabled,
   invalidateSkillsCache,
-  invalidateSkillsMtimeGate,
   isSkillDisabled,
   loadSkillResource,
   skillBodyPresentInSession,
   skillMissingFeature,
+  skillOutsideScope,
+  skillOutsideScopeError,
 } from './skill-catalog.mjs';
 export {
   composeSystemPrompt,

package/src/runtime/agent/orchestrator/context/deferred-tools.mjs

@@ -1,4 +1,5 @@
 // Deferred-pool and MCP-instruction manifests injected into BP2.
+import { parseMcpToolName } from '../../../shared/tool-primitives.mjs';
 
 export function compactPromptManifestText(value, max = 250) {
   const text = String(value || '')
@@ -100,16 +101,21 @@ function sanitizeMcpInstructionText(text, max = MCP_INSTRUCTION_MAX_CHARS) {
  * names per server doubled the MCP share of the BP2 prefix (2026-08-05 audit).
  * Server membership stays evident from the mcp__<server>__ name prefix.
  */
-function buildMcpInstructionsManifest(mcpServerInstructions, poolNames) {
+function buildMcpInstructionsManifest(mcpServerInstructions, poolNames, catalog = []) {
   const map = mcpServerInstructions && typeof mcpServerInstructions === 'object' ? mcpServerInstructions : {};
   const pool = [
     ...new Set((Array.isArray(poolNames) ? poolNames : []).map((name) => sanitizeManifestName(name)).filter(Boolean)),
   ];
+  // Tool definitions carry their server (shortened names cannot be parsed).
+  const byName = new Map();
+  for (const tool of Array.isArray(catalog) ? catalog : []) {
+    const name = String(tool?.name || '').trim();
+    if (name && !byName.has(name)) byName.set(name, tool);
+  }
   const deferredServers = new Set();
   for (const name of pool) {
-    const match = name.match(/^mcp__(.+?)__(.+)$/);
-    if (!match) continue;
-    deferredServers.add(match[1]);
+    const server = parseMcpToolName(byName.get(name) || name)?.server;
+    if (server) deferredServers.add(server);
   }
   const servers = [...deferredServers]
     .filter((server) => sanitizeManifestName(server) && sanitizeMcpInstructionText(map[server]))
@@ -170,7 +176,7 @@ function composeDeferredBp2Manifest(session, pool) {
   const parts = [];
   const deferredManifest = buildDeferredToolManifest(deferredManifestEntries(session, pool));
   if (deferredManifest) parts.push(deferredManifest);
-  const mcpManifest = buildMcpInstructionsManifest(session.mcpServerInstructions, pool);
+  const mcpManifest = buildMcpInstructionsManifest(session.mcpServerInstructions, pool, session.deferredToolCatalog);
   if (mcpManifest) parts.push(mcpManifest);
   return parts.join('\n\n');
 }

package/src/runtime/agent/orchestrator/context/skill-catalog.mjs

@@ -3,15 +3,16 @@
 
 import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
-import { maxMtimeRecursive } from '../cache-mtime.mjs';
+import { maxMtimeRecursive, mtimeSignatureRecursive } from '../cache-mtime.mjs';
 import { mixdogHome, resolvePluginData, mixdogRoot } from '../../../shared/plugin-paths.mjs';
-import { pluginSkillsRoots } from '../../../shared/plugin-manifest.mjs';
+import { PLUGIN_MANIFEST_FILES, pluginSkillsRoots } from '../../../shared/plugin-manifest.mjs';
 import {
   parseSkillDocument,
   SKILL_TRIGGER_LISTING_MAX,
   SKILL_TRIGGER_LISTING_MIN,
 } from '../../../shared/skill-document.mjs';
 import { readSkillToolDependencies, skillToolDependenciesRoot } from '../../../shared/skill-tool-dependencies.mjs';
+import { SKILL_LAUNCHER_COMMAND } from '../../../shared/skill-script-runtime.mjs';
 import { loadConfig, normalizeSkillsConfig } from '../config.mjs';
 import { builtinFeatureActive, withGrandfatheredBuiltins } from '../runtime-core/builtin-features.mjs';
 import { SKILL_TOOL } from '../runtime-core/tool-defs.mjs';
@@ -88,6 +89,32 @@ function pluginSkillDirs() {
   return dirs;
 }
 
+/** Paths whose own mtime (no recursion) gates the skill list for enabled
+ *  registered plugins: every manifest file, plus the nearest existing ancestor
+ *  of each candidate skills root (so a skills dir created later is noticed). */
+function pluginShallowWatchPaths() {
+  const registryPath = pluginRegistryPath();
+  let registry;
+  try {
+    registry = JSON.parse(readFileSync(registryPath, 'utf-8'));
+  } catch {
+    return [];
+  }
+  const paths = [];
+  for (const entry of Array.isArray(registry?.plugins) ? registry.plugins : []) {
+    if (entry?.enabled === false) continue;
+    const root = entry && typeof entry.root === 'string' ? entry.root : null;
+    if (!root || !existsSync(root)) continue;
+    for (const rel of PLUGIN_MANIFEST_FILES) paths.push(join(root, ...rel.split('/')));
+    for (const skillsDir of pluginSkillsRoots(root)) {
+      let dir = skillsDir;
+      while (!existsSync(dir) && dirname(dir) !== dir) dir = dirname(dir);
+      paths.push(dir);
+    }
+  }
+  return paths;
+}
+
 export function readSafe(path) {
   try {
     if (!existsSync(path)) return null;
@@ -216,24 +243,39 @@ function followsBuiltinFeature(skill) {
   return skill?.source === 'builtin' && Array.isArray(skill.requires) && skill.requires.length > 0;
 }
 
-function findCachedSkillByKey(key) {
-  return collectSkillsCached(null).find((entry) => normalizeSkillNameKey(entry.name) === key);
+function findCachedSkillByKey(key, skills = null) {
+  return (skills || collectSkillsCached(null)).find((entry) => normalizeSkillNameKey(entry.name) === key);
 }
 
-export function isSkillDisabled(name, config = null) {
+/** `skills`: optional snapshot from one collectSkillsCached() call, reused so a
+ *  batch of per-skill checks scans the disk once. */
+export function isSkillDisabled(name, config = null, skills = null) {
   const n = normalizeSkillNameKey(name);
   if (!n) return false;
-  const skill = findCachedSkillByKey(n);
+  const skill = findCachedSkillByKey(n, skills);
   if (!followsBuiltinFeature(skill) && getDisabledSkillNameSet(config).has(n)) return true;
   return Boolean(skill && missingFeature(skill, featureConfig(config)));
 }
 
 /** The built-in feature a skill needs that is not active, or null. */
-export function skillMissingFeature(name, config = null) {
-  const skill = findCachedSkillByKey(normalizeSkillNameKey(name));
+export function skillMissingFeature(name, config = null, skills = null) {
+  const skill = findCachedSkillByKey(normalizeSkillNameKey(name), skills);
   return skill ? missingFeature(skill, featureConfig(config)) : null;
 }
 
+/** True when an installed skill exists but its (or its plugin's) project scope
+ *  excludes `cwd` — the same scope rule filterSkillsExcludingDisabled applies. */
+export function skillOutsideScope(name, cwd, config = null, skills = null) {
+  const skill = findCachedSkillByKey(normalizeSkillNameKey(name), skills);
+  if (!skill) return false;
+  return !skillAllowedForCwd(extensionScopesFromConfig(featureConfig(config)), skill, cwd);
+}
+
+/** The Skill tool result for a skill skillOutsideScope refuses. */
+export function skillOutsideScopeError(name) {
+  return `Error: skill "${name}" is not available in this project (its project scope excludes the current folder)`;
+}
+
 /**
  * Skills a session may see: not switched off, feature available, and — when
  * `cwd` is given — inside the skill's (or its plugin's) project scope. Without
@@ -260,8 +302,6 @@ export function collectPromptSkillsCached(cwd, config = null) {
 }
 // --- Global skill cache (mtime-based) ---
 const _skillsCache = new Map();
-const _mtimeCache = new Map();
-const _MTIME_TTL_MS = 2000;
 
 export function collectSkillsCached(cwd) {
   if (skillsDisabled()) return [];
@@ -273,32 +313,41 @@ export function collectSkillsCached(cwd) {
   skillsDirs.push(...pluginSkillDirs().map(({ dir }) => dir), ...builtinSkillDirs());
   // registry.json itself gates plugin add/remove: removal deletes the
   // plugin's skills dir (so no dir mtime advances), but saveRegistry()
-  // always rewrites this file. maxMtimeRecursive stats plain files directly.
+  // always rewrites this file. mtimeSignatureRecursive stats plain files directly.
   const registryPath = pluginRegistryPath();
   if (registryPath) skillsDirs.push(registryPath);
-  const mtime = mtimeWithTtl(_mtimeCache, key, skillsDirs, _MTIME_TTL_MS);
+  // Exact, un-timed gate: stat every call. The shallow watch list covers
+  // manifest edits and skill roots that do not exist yet.
+  const signature = `${mtimeSignatureRecursive(skillsDirs)}|${mtimeSignatureRecursive(pluginShallowWatchPaths(), 0)}`;
   const entry = _skillsCache.get(key);
-  if (entry && entry.mtime >= mtime) {
+  if (entry && entry.signature === signature) {
     return entry.value;
   }
   const skills = collectSkills(cwd);
-  _skillsCache.set(key, { value: skills, mtime });
+  _skillsCache.set(key, { value: skills, signature });
   capMapSize(_skillsCache);
   return skills;
 }
 export function invalidateSkillsCache(cwd) {
   void cwd;
   _skillsCache.clear();
-  _mtimeCache.clear();
 }
-/** Drop only the mtime TTL so the next call re-stats the skill roots while the
- *  cached list stays — lets a test prove the gate itself notices an edit. */
-export function invalidateSkillsMtimeGate() {
-  _mtimeCache.clear();
+
+/**
+ * Directory the model hands to external processes for a skill. A packaged
+ * desktop runtime reads built-in skills from inside `runtime.asar`, which only
+ * Electron can open; the build ships them as real files beside the archive
+ * under `runtime.asar.unpacked`, so a built-in skill's directory points there.
+ * Every other source keeps its own on-disk directory.
+ */
+export function skillExecutionDir(dir, source) {
+  if (source !== 'builtin') return dir;
+  return String(dir).replace(/([\\/])runtime\.asar(?=[\\/]|$)/, '$1runtime.asar.unpacked');
 }
 
 /**
- * Load full skill content plus its on-disk directory (for base-dir + ${MIXDOG_SKILL_DIR}).
+ * Load full skill content plus its on-disk directory (for base-dir + ${MIXDOG_SKILL_DIR};
+ * ${MIXDOG_SKILL_NODE} is resolved at render time in buildSkillResultEnvelope).
  */
 export function loadSkillResource(name, cwd) {
   const skillName = String(name || '').trim();
@@ -311,7 +360,7 @@ export function loadSkillResource(name, cwd) {
   try {
     return {
       content: parseSkillDocument(content).body,
-      dir: dirname(skill.filePath),
+      dir: skillExecutionDir(dirname(skill.filePath), skill.source),
       filePath: skill.filePath,
       source: skill.source || 'global',
       toolDependencies: skill.toolDependencies || [],
@@ -335,6 +384,10 @@ export function buildSkillResultEnvelope(name, content, skillDir) {
   const escapedName = escapeSkillXmlText(name);
   let body = String(content == null ? '' : content);
   let dirLine = '';
+  // `${MIXDOG_SKILL_NODE}` runs a bundled script on this daemon's own runtime
+  // (plain node cannot load runtime internals from a packaged archive). It is
+  // one shell-neutral command name that model shells find on their PATH.
+  body = body.replace(/\$\{MIXDOG_SKILL_NODE\}/g, SKILL_LAUNCHER_COMMAND);
   if (skillDir) {
     const normDir = String(skillDir).replace(/\\/g, '/');
     body = body.replace(/\$\{MIXDOG_SKILL_DIR\}/g, normDir);