mixdog 1.2.6 → 1.3.1

package/LICENSES/simple-icons-CC0-1.0.txt

@@ -0,0 +1,30 @@
+# CC0 1.0 Universal
+
+## Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an “owner”) of an original work of authorship and/or a database (each, a “Work”).
+
+Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works (“Commons”) that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the “Affirmer”), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights (“Copyright and Related Rights”). Copyright and Related Rights include, but are not limited to, the following:
+    1. the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work;
+    2. moral rights retained by the original author(s) and/or performer(s);
+    3. publicity and privacy rights pertaining to a person’s image or likeness depicted in a Work;
+    4. rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(i), below;
+    5. rights protecting the extraction, dissemination, use and reuse of data in a Work;
+    6. database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and
+    7. other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer’s Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the “Waiver”). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer’s heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer’s express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer’s express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer’s Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the “License”). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer’s express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+    1. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.
+    2. Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.
+    3. Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person’s Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work.
+    4. Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work.
+
+For more information, please see <https://creativecommons.org/publicdomain/zero/1.0>.

package/NOTICE.md

@@ -20,6 +20,8 @@ Full license texts live in `LICENSES/`:
   notice referenced by the generated files.
 - `LICENSES/browser-import-NOTICE.txt` — source and license boundary for the
   optional GPL Chrome password import sidecar.
+- `LICENSES/simple-icons-CC0-1.0.txt` — the CC0 1.0 dedication of the Simple
+  Icons brand marks used for connectors.
 - Tidy engine license texts listed in the Tidy engines section below.
 
 ## MIT
@@ -123,15 +125,75 @@ downloads it from this repository's `effort-judge-v*` GitHub releases, as
 listed in `src/runtime/effort-judge/model-manifest.json`.
 
 Statement of changes (Apache-2.0 section 4(b)): only the text encoder is kept,
-reduced to 12 of its layers; a four-level classification head is added and the
-model is fine-tuned to rate the reasoning effort a request needs; the weights
-are exported to ONNX and quantized to 4 bits. Full license text:
-`LICENSES/Apache-2.0.txt`.
-
-Its training data includes requests from SWE-chat
-(<https://huggingface.co/datasets/cfahlgren1/SWE-chat>), made available under
-the Open Data Commons Attribution License 1.0, and from DataClaw exports that
-their authors published on the Hugging Face Hub under the MIT License.
+reduced to 18 of its layers; a four-level classification head is added and the
+model is fine-tuned to rate the reasoning effort a request or an agent step
+needs; the weights are exported to ONNX and quantized to 4 bits. Full license
+text: `LICENSES/Apache-2.0.txt`.
+
+Its training data includes requests and agent steps from SWE-chat
+(<https://huggingface.co/datasets/SALT-NLP/SWE-chat>, Open Data Commons
+Attribution License 1.0); OpenAssistant oasst2
+(<https://huggingface.co/datasets/OpenAssistant/oasst2>, Apache License 2.0);
+DataClaw exports that their authors published on the Hugging Face Hub under the
+MIT License (<https://huggingface.co/datasets/di-zhang-fdu/ShareDataClaw>);
+DevGPT by Tao Xiao, Christoph Treude, Hideaki Hata and Kenichi Matsumoto
+(<https://doi.org/10.5281/zenodo.16392320>, CC BY 4.0); issue texts from the
+SWE-bench training split (<https://github.com/SWE-bench/SWE-bench>, MIT
+License); and agent steps from NVIDIA's SWE-Hero OpenHands trajectories
+(<https://huggingface.co/datasets/nvidia/SWE-Hero-openhands-trajectories>,
+CC BY 4.0).
+
+Contains information from WildChat-4.8M
+(<https://huggingface.co/datasets/allenai/WildChat-4.8M>) which is made
+available under the ODC Attribution License
+(<https://opendatacommons.org/licenses/by/1-0/>).
+
+Since `effort-judge-v7` it also includes questions from Stack Exchange sites
+(via <https://huggingface.co/datasets/HuggingFaceTB/stackexchange_2025_md>;
+each post is licensed CC BY-SA 2.5, 3.0 or 4.0 by its author, and its URL and
+author are kept with the training item); GitHub issues and pull requests of
+permissively licensed repositories (via
+<https://huggingface.co/datasets/common-pile/github_archive>, with each item's
+repository, URL, license and authors kept); issues and pull requests from
+Nebius SWE-rebench-V2 (<https://huggingface.co/datasets/nebius/SWE-rebench-V2>,
+<https://huggingface.co/datasets/nebius/SWE-rebench-V2-PRs>, CC BY 4.0,
+permissively licensed repositories only); and agent steps from Nebius
+SWE-agent trajectories
+(<https://huggingface.co/datasets/nebius/SWE-agent-trajectories>, CC BY 4.0),
+Nebius SWE-rebench OpenHands trajectories
+(<https://huggingface.co/datasets/nebius/SWE-rebench-openhands-trajectories>,
+CC BY 4.0), Kwai-Klear SWE-smith mini-swe-agent-plus trajectories
+(<https://huggingface.co/datasets/Kwai-Klear/SWE-smith-mini_swe_agent_plus-trajectories-66k>,
+MIT License), SWE-Factory DeepSWE-Agent Kimi-K2 trajectories
+(<https://huggingface.co/datasets/SWE-Factory/DeepSWE-Agent-Kimi-K2-Trajectories-2.8K>,
+MIT License), SWE-Gym OpenHands SFT trajectories
+(<https://huggingface.co/datasets/SWE-Gym/OpenHands-SFT-Trajectories>, MIT
+License), SWE-ZERO-12M trajectories
+(<https://huggingface.co/datasets/AlienKevin/SWE-ZERO-12M-trajectories>, Apache
+License 2.0), SWE-Lego real and synthetic data
+(<https://huggingface.co/datasets/Lego-X/SWE-Lego-Real-Data>,
+<https://huggingface.co/datasets/Lego-X/SWE-Lego-Synthetic-Data>, Apache
+License 2.0) and TIGER-Lab SWE-Next SFT trajectories
+(<https://huggingface.co/datasets/TIGER-Lab/SWE-Next-SFT-Trajectories>, MIT
+License). Each `effort-judge-v*` release lists its files, hashes and
+attributions.
+
+## CC0-1.0
+
+### Simple Icons 16.35.0
+
+<https://simpleicons.org> · <https://github.com/simple-icons/simple-icons>
+
+The connector brand marks in
+`apps/desktop/src/renderer/connectors-brand-icons.ts` carry Simple Icons path
+data and brand colours unmodified (Airtable, Blender, Confluence, Discord,
+Dropbox, Figma, GitHub, Gmail, Google Calendar, Google Drive, Hugging Face,
+Jira, Linear, Notion, PostgreSQL, Sentry, Stripe, Supabase, Telegram, Trello,
+Unity, Vercel); Unity's mark is drawn in black, as its listed colour is white.
+Simple Icons is dedicated to the public domain under CC0 1.0; each
+mark remains the trademark of its owner and is shown only to name that
+service. Slack is not in Simple Icons and its mark is not openly licensed, so
+it is shown as a letter tile. Full text: `LICENSES/simple-icons-CC0-1.0.txt`.
 
 ## GPL-3.0-only
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "1.2.6",
+  "version": "1.3.1",
   "private": false,
   "type": "module",
   "description": "Open-source coding agent that matches Codex on Terminal-Bench 2.1 with 63% fewer tokens.",
@@ -60,6 +60,7 @@
     "prepack": "npm run build:shipped-history && npm run build:tui",
     "build:shipped-history": "node scripts/build-shipped-history.mjs",
     "check:shipped-history": "node scripts/build-shipped-history.mjs --check",
+    "check:model-recommendations": "node scripts/check-model-recommendations.mjs",
     "prepublishOnly": "node -e \"if(!process.env.CI){console.error('local npm publish is disabled — run npm run release:patch');process.exit(1)}\"",
     "start": "node src/cli.mjs",
     "test": "node scripts/test.mjs",
@@ -165,11 +166,13 @@
     "chalk": "^5.6.2",
     "cli-highlight": "^2.1.11",
     "diff": "^9.0.0",
+    "imapflow": "^2.5.7",
     "ink": "https://github.com/tribgames/mixdog/releases/download/ink-runtime-v7.1.0-mixdog.1/ink-7.1.0.tgz",
     "jsdom": "^27.0.0",
     "jszip": "^3.10.1",
     "marked": "^14.1.4",
     "node-cron": "^4.5.0",
+    "nodemailer": "^10.1.7",
     "onnxruntime-node": "1.30.0",
     "openai": "^6.44.0",
     "pdf-lib": "^1.17.1",

package/scripts/check-model-recommendations.mjs

@@ -0,0 +1,89 @@
+// Validates the setup-guide model recommendation list and exits non-zero when
+// it is older than its own staleAfterDays.
+//
+//   node scripts/check-model-recommendations.mjs
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const file = join(
+  dirname(fileURLToPath(import.meta.url)),
+  '..',
+  'src/defaults/skills/setup-guide/model-recommendations.json'
+);
+const data = JSON.parse(readFileSync(file, 'utf8'));
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+const errors = [];
+const str = (v) => typeof v === 'string' && v.trim() !== '';
+
+if (!DATE.test(data.asOf ?? '')) errors.push('asOf must be YYYY-MM-DD');
+if (!Number.isInteger(data.staleAfterDays) || data.staleAfterDays <= 0) {
+  errors.push('staleAfterDays must be a positive integer');
+}
+if (!Array.isArray(data.roles) || data.roles.length === 0) errors.push('roles must be a non-empty array');
+for (const [i, entry] of (Array.isArray(data.roles) ? data.roles : []).entries()) {
+  const at = `roles[${i}]`;
+  if (!Array.isArray(entry.roles) || entry.roles.length === 0 || !entry.roles.every(str)) {
+    errors.push(`${at}.roles must be a non-empty string array`);
+  }
+  if (entry.preferOtherProviderThan !== undefined) {
+    const known = new Set(data.roles.flatMap((r) => r.roles ?? []));
+    const list = entry.preferOtherProviderThan;
+    if (!Array.isArray(list) || !list.length || !list.every((r) => known.has(r))) {
+      errors.push(`${at}.preferOtherProviderThan must list existing role names`);
+    }
+  }
+  if (!Array.isArray(entry.picks) || entry.picks.length === 0) errors.push(`${at}.picks must be non-empty`);
+  for (const [j, pick] of (Array.isArray(entry.picks) ? entry.picks : []).entries()) {
+    for (const key of ['provider', 'model', 'effort', 'source']) {
+      if (!str(pick[key])) errors.push(`${at}.picks[${j}].${key} is required`);
+    }
+    if (!DATE.test(pick.checkedAt ?? '')) errors.push(`${at}.picks[${j}].checkedAt must be YYYY-MM-DD`);
+    if (str(pick.source) && !/^https?:\/\//.test(pick.source)) errors.push(`${at}.picks[${j}].source must be a URL`);
+  }
+}
+const MODES = ['none', 'focused', 'balanced', 'swarm'];
+const knownRoles = new Set((Array.isArray(data.roles) ? data.roles : []).flatMap((r) => r.roles ?? []));
+const roleList = (v) => Array.isArray(v) && v.every((r) => knownRoles.has(r));
+const d = data.delegation;
+if (!d || typeof d !== 'object') errors.push('delegation is required');
+else {
+  if (!roleList(d.baseRoster) || !d.baseRoster.length) errors.push('delegation.baseRoster must list existing roles');
+  const modes = Array.isArray(d.modes) ? d.modes : [];
+  if (modes.map((m) => m.mode).join() !== MODES.join())
+    errors.push(`delegation.modes must be ${MODES.join(', ')} in order`);
+  for (const m of modes) {
+    if (!str(m.label) || !roleList(m.agents))
+      errors.push(`delegation.modes ${m.mode}: label and existing-role agents required`);
+    if (!m.plans || typeof m.plans !== 'object') errors.push(`delegation.modes ${m.mode}: plans required`);
+  }
+  const lean = d.leanReview;
+  if (
+    !lean ||
+    !roleList(lean.agentsOff) ||
+    !roleList(lean.agentsOn) ||
+    !lean.fitsModes?.every((x) => MODES.includes(x))
+  ) {
+    errors.push('delegation.leanReview needs valid fitsModes, agentsOff, agentsOn');
+  }
+}
+for (const [i, entry] of (Array.isArray(data.roles) ? data.roles : []).entries()) {
+  for (const [j, pick] of (Array.isArray(entry.picks) ? entry.picks : []).entries()) {
+    if (pick.plans !== undefined && !(pick.plans && Object.values(pick.plans).every(str))) {
+      errors.push(`roles[${i}].picks[${j}].plans must map plan to model string`);
+    }
+  }
+}
+if (errors.length) {
+  console.error(`[model-recommendations] invalid:\n- ${errors.join('\n- ')}`);
+  process.exit(1);
+}
+
+const ageDays = Math.floor((Date.now() - Date.parse(data.asOf)) / 86_400_000);
+if (ageDays > data.staleAfterDays) {
+  console.error(
+    `[model-recommendations] stale: asOf ${data.asOf} is ${ageDays} days old (limit ${data.staleAfterDays}). Re-check the picks and update the file.`
+  );
+  process.exit(1);
+}
+console.log(`[model-recommendations] ok (asOf ${data.asOf}, ${ageDays} days old)`);

package/scripts/gate-local.mjs

@@ -32,6 +32,13 @@ if (failedPreChecks.length) {
   process.exit(1);
 }
 
+// Warning-level: a stale model list never blocks the gate.
+if (
+  spawnSync('node scripts/check-model-recommendations.mjs', { cwd: root, stdio: 'inherit', shell: true }).status !== 0
+) {
+  console.warn('[gate:local] warning: model recommendations stale or invalid (not blocking)');
+}
+
 const build = spawnSync('npm run build:spawn:test', { cwd: root, stdio: 'inherit', shell: true });
 if (build.status !== 0) {
   console.error('[gate:local] build:spawn:test failed');

package/scripts/lib/isolated-test-env.mjs

@@ -0,0 +1,16 @@
+// Side-effect import for tests that touch Mixdog user data. Import it FIRST (ESM
+// evaluates imports in order) so the data/home dirs resolve to a scratch dir
+// before any module under test reads them, even under plain `node --test` from a
+// shell that exports the signed-in profile's MIXDOG_DATA_DIR.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const root = mkdtempSync(join(tmpdir(), 'mixdog-test-profile-'));
+process.env.MIXDOG_DATA_DIR = join(root, 'data');
+process.env.MIXDOG_HOME = join(root, 'home');
+process.on('exit', () => {
+  try {
+    rmSync(root, { recursive: true, force: true });
+  } catch {}
+});

package/src/agents/reviewer/AGENT.md

@@ -1,12 +1,14 @@
 ---
 name: Reviewer
-description: Use only at the end, as the final independent check of non-trivial work; otherwise Lead's own review suffices.
+description: Use once at the end, as the single final independent check of non-trivial work, never a second full pass over work already reviewed; otherwise Lead's own review suffices.
 ---
 
 Independent final-check review agent.
 
 You are called only at the end, after the deliverable is written and the
-Lead's own verification has run, before completion is reported.
+Lead's own verification has run, before completion is reported. You run once.
+When the work was already reviewed scope by scope, check the integrated
+result and its highest-risk changes instead of repeating those reviews.
 
 Inspect the diff, affected boundaries, existing tests, and stated acceptance
 criteria with independent judgment. Reuse still-valid passing results; rerun failed or invalidated checks. Actively seek regressions, unsupported assumptions, security

package/src/agents/reviewer/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "reviewer",
   "name": "Reviewer",
-  "description": "Use only at the end, as the final independent check of non-trivial work; otherwise Lead's own review suffices.",
+  "description": "Use once at the end, as the single final independent check of non-trivial work, never a second full pass over work already reviewed; otherwise Lead's own review suffices.",
   "entry": "AGENT.md"
 }

package/src/defaults/shipped-history.json

@@ -30,6 +30,7 @@
       "07643b62440d3eba29b7360b8a33f09f",
       "0d45f8d9a2a67373462840e8bf930694",
       "1593af04edd24cdd5f05fe89a7386407",
+      "1a8115cec6ae4414f8637b1765948cdd",
       "25b44b46269490e26ca31c1852925171",
       "a60ea68f9287d55489e92e5450432f62",
       "a61cb4557def4e7ed647d4bdacbb72e4",
@@ -115,6 +116,7 @@
       "8d343d0a406fd5817b7fd98a3ac47010",
       "a1b73ce404125d3ce0a5762e4a1e1555",
       "a28fb01bb21ceebbde1bc6c4a02d3db6",
+      "c7fdabb946eed7283db656493d95749b",
       "d40c23517c4803afdac3fc056bb65cda",
       "db1af5417849abc2f6bb1d1d2b63939f"
     ],
@@ -175,6 +177,7 @@
     "browser-use": [
       "00085086a7649ec6631f5cf0a3bbbf60",
       "08eee52328524eb032fd14f342742c41",
+      "25a6744e7591ea5597abbda008d123fe",
       "43eeb0b9c5792f08f2223c76846926cb",
       "4ab5316454013712cedb25d9b75f4e43",
       "646365a3f7041a3da3d7d7d896a0c3b6",
@@ -280,6 +283,7 @@
       "bdf26b0f2ac9f3126bfa74ced15a7d73"
     ],
     "memory-management": [
+      "1533630b81ebace2bc9ece6fda02bb11",
       "261a34fce0fb0f73abfd1b1e2add3602",
       "356bf57f7087fe2c40c5dcd99622c3e9",
       "a8ffffd02f438cdd6005e09cfe6cf42f",
@@ -341,6 +345,7 @@
       "0d6926aaca2890da9347f15a826546e3",
       "0f14ba0a3d8b3896b717dc144bbe49a4",
       "15d86146cfbd58d85adf0c25cf1d683f",
+      "18dc665b96ee0ba5a1645180e173b1af",
       "1c317db86e1ff80a5c4102e09e36f5fb",
       "242f11864abdef90fa0cc9cb4599a579",
       "29a347c4d3a2f773fa92c627260301ba",
@@ -365,10 +370,15 @@
       "e04e6abe9a54e7d07b37f8fc32b5ad30",
       "e38d606df69865a9cf1cc48386535e8b",
       "e5ac8ea16905815e36e88d883195a617",
+      "e848b92962dee0d4c3d7e3721d2e3294",
       "e9b89f9193bd9d9c80ba6cf4419e58ff",
       "feabe973080344c4d52787a96043ab68",
       "ff18ac1a9f5961925aec27ffb870bae0"
     ],
+    "setup-guide": [
+      "633e15b84dbe22f2b578b67cc35853d4",
+      "920d5b29ccfe6c88f623cf0892b29285"
+    ],
     "skill-creator": [
       "020817866da73a69544ba35086bdcd5f",
       "2f3f44805618783fbcca9a56652a5e91",

package/src/defaults/skills/browser-use/SKILL.md

@@ -316,9 +316,14 @@ in the page instead of retrying the same `navigate`.
 - A refused or restricted action stays refused; do not reach the same effect
   through another page, tool, or `evaluate`.
 - Tool-side confirmation does not replace the user's approved scope.
+  Submitting a form (`submit`, Enter) or clicking a send/post control asks the
+  user once in the desktop app; a denial dispatches nothing.
   `MIXDOG_BROWSER_CONFIRM_ACTIONS` and
   `MIXDOG_BROWSER_DENY_ACTIONS` optionally name comma-separated public actions
   (or `*`) the desktop app confirms once or refuses; denial takes precedence.
+- For a password or token, focus the field and call `ask_user` with
+  `handoff: { kind: 'secret', surface: 'browser' }`; for sign-in, CAPTCHA or
+  2FA use `kind: 'takeover'` with instructions. Never ask for secrets in chat.
 - Cookie listings never expose values. Registered secret values remain
   redacted across redirects. A blocked result is not success; an inconclusive
   postcondition is not proof.

package/src/defaults/skills/memory-management/SKILL.md

@@ -32,7 +32,10 @@ as preferences; automatic history already preserves them.
 
 Omit `project_id` for the current Project, use `common` for shared memory,
 or an explicit Project slug for another Project. The `*` scope is read-only.
-Confirm the target before destructive changes.
+`agent_id: "self"` selects your own agent memory instead: only you read it,
+and it is the only pool an unattended run (schedule, webhook, group room,
+delegated agent) may write; common and Project memory change only while the
+user is chatting. Confirm the target before destructive changes.
 
 Memory indices start at 1 independently in common memory and each Project.
 Deletion and movement compact the affected scope's indices; new memories

package/src/defaults/skills/setup/references/actions.md

@@ -52,6 +52,7 @@ Read this when choosing a `setup` mutation.
 | Remove stored provider authentication (one OAuth account at a time) | `forget_provider_auth` |
 | Select, rename, or reorder OAuth accounts, set the switching policy, or allow paid credits | `set_provider_account` |
 | Developer options such as risk-gated OAuth providers | `set_developer_option` |
+| Connect a catalog service (Notion, Linear, Gmail, …; not GitHub, which is the GitHub CLI) for the user: shows a one-click connect card | `connect_connector` |
 | Add an MCP server | `add_mcp_server` |
 | Edit or rename an MCP server | `save_mcp_server` |
 | Remove an MCP server | `remove_mcp_server` |
@@ -71,9 +72,10 @@ Read this when choosing a `setup` mutation.
 | Create a workflow, agent, or machine-global user skill | `create_definition` |
 | Partially edit a workflow, agent, or machine-global user skill | `save_definition` |
 | Delete a user workflow/agent definition or override | `delete_definition` |
-| Save a schedule/webhook; explicitly overwrite to edit | `save_automation` |
+| Save a schedule/webhook; explicitly overwrite to edit. A new one belongs to the calling thread's agent (Mixy = `lead`); `entry.owner` moves it to another agent | `save_automation` |
 | Delete an existing schedule/webhook | `delete_automation` |
-| Enable/disable a schedule/webhook | `set_automation_enabled` |
+| Enable/disable (pause/resume) a schedule/webhook | `set_automation_enabled` |
+| Run a schedule once now, or re-run a webhook on its latest received payload; the result posts into the owning agent's thread | `run_automation` |
 | Webhook listener enabled state, port, or domain | `set_webhook_config` |
 | Desktop keep-awake, run in background after window close, turn-completion notifications, notification volume (Windows), usage pin, usage rail short + long bars, or Computer observe-only state | `set_desktop_settings` |
 | Desktop theme, display language, side panels, markdown default view, link previews, or tool activity expansion | `set_appearance` |
@@ -110,6 +112,9 @@ workflow` before changing the corresponding domain.
   `originalName` and `name`. Skill deletion is not exposed; disable it instead.
   Built-in and plugin skills accept only `toolDependencies` edits (`null`
   restores their declared dependencies).
+- A created agent is a bot (`definition.kind: "bot"`) or a workflow agent
+  (`"agent"`); omitted, the representative bot's chat creates a bot and any other chat a
+  workflow agent. The kind is fixed after creation.
 - Changing orchestration does not rewrite workflow instructions or agents.
 
 ## Providers and authentication
@@ -235,6 +240,12 @@ markers are read with `status desktop`.
   `add_mcp_server`, `save_mcp_server`, and `remove_mcp_server` refuse plugin
   servers. Declaration problems and naming conflicts are reported as
   `declarationErrors` and `warnings`.
+- `connect_connector` is how to connect a catalog service the user asks for
+  ("Slack 연결해 줘"): it leaves a connect card in the conversation whose
+  press runs the browser sign-in (or the key sheet) in Desktop; nothing
+  connects until the user presses it, so tell them to press the card and read
+  `status mcp` afterwards. `add_mcp_server` with the service URL is not the
+  sign-in flow; never use it for a catalog service.
 - `enable_plugin_mcp` turns every server the plugin declares back on and
   reconnects them; a disabled plugin stays disabled, and it fails for a plugin
   that declares no MCP servers.
@@ -248,8 +259,7 @@ markers are read with `status desktop`.
 - A Project removal unregisters it only.
 - Inspect schedules/webhooks before editing. `overwrite:true` updates an
   existing named entry and preserves omitted fields; a new schedule needs
-  instructions, a `model` (no default-model fallback), and exactly one of cron
-  `time` or one-shot `at`.
+  instructions and exactly one of cron `time` or one-shot `at`.
 - Attachment contents and webhook signing secrets are not returned by setup.
   Omitted attachments and existing webhook secrets are preserved. A saved
   secret is never shown again: tell the user to open the Webhooks panel, edit

package/src/defaults/skills/setup-guide/SKILL.md

@@ -0,0 +1,178 @@
+---
+name: setup-guide
+description: Guide a new user through first setup and explain Mixdog concepts.
+when_to_use: 'Mixy''s first chat; how to start, what to do first, what a Mixdog term means; not one named setting.'
+dependencies:
+  tools:
+    - type: tool
+      value: setup
+---
+
+# Setup guide
+
+Walk a new user through Mixdog's first setup one step at a time, and explain
+Mixdog's concepts in plain words. Changes go through the `setup` tool, never
+through file edits. One named setting the user already chose belongs to `setup`.
+
+## Style
+
+Reply as in bot mode: one step or one concept per message, short plain
+sentences, no tables or headings, in the user's language. In Korean use the
+formal polite style (~합니다 / ~하세요, never ~해요). Say "봇" for Mixy and
+other contacts, "에이전트" only for workflow agents. Never print ids, file
+names or dotted internal names. End a step with one question, not a list of options.
+
+## Mode
+
+- Setup walk-through: the user accepted setup help ("기본 설정부터 같이 할까요?"),
+  or asks how to start or what to do first.
+- Concept question: answer it from the glossary below, then stop. Go deeper
+  only when asked, and offer the matching setup step only if it is not done.
+
+## Opening
+
+Start in this order, one message each:
+
+1. Say you will go through setup one thing at a time.
+2. Check `status features` and `status mcp` first. Offer add-ons tier by tier;
+   finish a tier before the next. Never mention a feature that is already on
+   or installed, and skip a tier with nothing missing.
+3. Then the connectors, then the steps below.
+
+Tier 1, essential: Media generation, Git & GitHub (`git`), Visualize. If any
+is missing or off, say it is essential and ask once for all of them
+("필수 기능인데 설치할까요?").
+
+Tier 2, recommended: Memory (`memory`), Computer Use (`computer`), Browser Use
+(`browser`). Offer the missing ones in one short line.
+
+Tier 3, optional: Voice transcription (`voice`), Local Provider
+(`localProvider`), Code Tidy (`tidy`). Offer the missing ones in one short line.
+
+Install only what the user accepts. How each is done:
+
+- `install_builtin` with the name for git, memory, autoEffort, computer,
+  browser, voice, localProvider and tidy. Git installs system Git through the
+  Desktop when this chat is open there. Auto reasoning can be unsupported on
+  a machine: report that instead of retrying. Computer Use and Browser Use
+  need the Desktop, and the user approves OS permission dialogs. Local
+  Provider only prepares the runtime; models belong to `local-provider`.
+- Memory is install-only; its later on/off is `set_memory_enabled`.
+- Visualize has no install: `set_builtin_enabled` turns it on.
+- Media generation has no setup action: `open plugins` and let the user turn
+  it on there, then re-check `status features`.
+
+Connectors come after the tiers. First explain in a sentence or two: a
+connector links an outside service so bots and agents can read and act in it,
+and anything that sends or posts asks first through an approval card. Then
+suggest by what the user does, only these: Gmail (with a Google app password;
+it needs 2-Step Verification on the Google account, and the connect window
+opens the app-password page in the browser), Notion, Linear or Jira. GitHub is
+not a connector; it is the signed-in GitHub CLI of Git & GitHub. Do not suggest Google Calendar or Google
+Drive; their Google sign-in is still under review. Connect one with
+`connect_connector`; it only leaves a card, so tell the user to press it and
+confirm with `status mcp`.
+
+## Walk-through
+
+The steps mirror the desktop starter guide and its checklist; do not keep
+separate progress. Read state first with `setup` `status` (`providers`,
+`onboarding`, `mcp`, `plugins`, `agents`, `connection`) and skip steps already
+done. Take the first open step, explain it in a sentence or two, ask, then act.
+
+1. provider: done when a provider is authenticated (`status providers`). Sign-in
+   and API keys are entered by the user: `open providers`, never ask for a key
+   in chat. Suggest a subscription sign-in (Claude, ChatGPT, Gemini and the
+   like) first; an API key only when the user has no subscription or asks.
+2. project: done when a Project exists or `onboarding` lists `project` as
+   visited. A folder is optional. Register one with `save_project` for a path
+   the user names.
+3. workflow: done when `onboarding` lists `workflow` as visited. Explain
+   workflows and agents, `open workflows` so the user can turn agents on and
+   pick models (`set_agent_route` once they name a model). Recommend models
+   from `${MIXDOG_SKILL_DIR}/model-recommendations.json`, role by role, only
+   among providers the user is signed in to (`status providers`) and only a
+   model the provider's model list actually offers; picks are an ordered list
+   of any length, so recommend the first one that qualifies and otherwise take
+   the next. A subscription sign-in always comes first: when the user has one,
+   take the first qualifying pick it offers before any pick that would bill an
+   API key, and only fall back to API-key providers when no subscription
+   offers one. If `asOf` is older than `staleAfterDays`, say the list may be out of
+   date. Never print ids or file names. Roles with
+   `preferOtherProviderThan` (Reviewer, Advisor) work best with the opposite
+   tendency from the model doing the work: pick the first qualifying model whose
+   provider differs from the chosen Lead's and Heavy Worker's providers, and
+   fall back to the plain first pick only when the user has a single signed-in
+   provider. Give the reason in one line: a different model family catches what
+   the main one misses. Suggest turning on the Maintainer with
+   a cheap model at the lowest effort; it also decides turns in group rooms.
+   A pick may carry `plans`: when the Lead provider's plan (`plan` in
+   `status providers`) is listed there, recommend that model instead. A null or
+   unlisted plan keeps the pick as is; never fail on an unknown plan.
+   Delegation and roster come from `delegation` in the data file. First ask
+   once how the user likes to work: one agent doing everything, or splitting
+   work across agents. Say plainly that Solo is a good choice at any plan: it
+   is the most efficient, and with a strong model its quality is often not much
+   lower; delegation trades more usage for speed and parallel work. Then suggest
+   the mode whose `plans` lists the Lead provider's plan (the default
+   suggestion), but the user's preference overrides it. Ask once; set it with
+   `set_orchestration_mode`, and say it can be changed later in settings. The
+   roster follows the chosen mode: turn on only `baseRoster` plus that mode's
+   `agents`, using `set_agent_route` with `route.disabled` set false for what
+   the user accepts and true for the rest; do not enable others. Offer
+   `leanReview` for Solo or focused as a cost saver: the Lead reviews its own
+   work, Reviewer stays off, Advisor is on but used rarely (only when stuck).
+   Advisor in balanced or swarm is a light, occasional second opinion from a
+   different model family at key decision points, not on every task. Say in
+   one line that more agents can be turned on later on the Workflows page.
+   Right after the models are picked, explain Auto reasoning: it adjusts
+   reasoning depth per message, so hard work may come out slightly lower in
+   quality but cost is much lower. Ask whether to turn it on
+   (`install_builtin` `autoEffort`). If declined, say in one line that it can
+   be turned on later from the model picker.
+4. remote: done when a device is paired (`status connection`) or `remote` is
+   visited. Pairing is user-operated: `open connection`.
+5. extensions: done when `extensions` is visited. Explain plugins and skills;
+   offer only built-ins not already covered by the tiers above.
+6. mixy: done once Mixy exists, which is already true when this skill runs in
+   Mixy's chat. Offer to make another bot when the user wants one.
+
+After a change, report it in a sentence and move on. The user may stop at any
+step; do not insist.
+
+## Glossary
+
+- Bot (봇): a contact you chat with in bot mode (봇 모드). Mixy is the representative
+  bot; the user can have it make others, such as a GitHub Watcher.
+- Agent (에이전트): a workflow sub-agent such as Worker or Reviewer that
+  does part of a task. Users add their own on the Workflows page with the
+  "에이전트 +" button. Bots are people-facing; agents work behind a task.
+- Default agents (기본 에이전트): built-in helpers listed on Workflows, such as
+  Web Search (runs the web search tool) and the Maintainer (memory upkeep and
+  session titles). They need a model route to work.
+- Agent mode (에이전트 모드): a coding work session run by Lead and agents.
+  A session a bot starts for a job is an agent task session (에이전트 작업
+  세션); others are just sessions (세션).
+- Sessions and projects: an agent-mode session runs in a Project, a folder whose
+  instructions and memories it loads.
+- Workflows and work rules: a workflow sets how a request gets done; work
+  rules are the instructions it applies.
+- Connectors and extensions: connectors are MCP services such as Notion or
+  Linear (`connect_connector`, the user presses the card); extensions are
+  plugins that add tools and skills that teach how to work.
+- Group rooms (그룹 대화방): one chat with several bots. `@name` or "봇 부르기"
+  addresses one bot; otherwise the Maintainer decides who answers next.
+- Schedules and webhooks: a timed or incoming-event trigger (`save_automation`).
+  Each run is one turn in its bot's own chat, with that bot's persona, rules,
+  permissions, memory and model. Without a bot they cannot be used.
+- Approval cards: when a tool needs permission it waits in the chat until the
+  user approves or declines.
+- Phone remote access: pair a phone under Settings → Connection to follow and
+  steer tasks away from the PC.
+
+## Pitfalls
+
+- Do not claim a step is done from memory; re-read state after acting.
+- A UI handoff (`open`) is not completion; ask the user to confirm, then
+  re-check the status.
+- Do not run several steps in one message or queue the next question early.