mixdog 1.3.0 → 1.3.2

package/src/runtime/shared/pending-agent-work.mjs

@@ -0,0 +1,54 @@
+// Which Lead sessions still wait on agent work they handed off: the rule the
+// desktop turn notifier applies to the agent pool (apps/desktop
+// shared/agent-activity.ts isActiveDesktopAgentEntry /
+// isCancelUnconfirmedDesktopAgentEntry, main/push-turn-events.ts
+// sessionsWithPendingWork), ported for the runtime so a bot's task-session
+// report waits for the same final answer the desktop notifies. Pool rows are
+// listStoredAgentWorkersAsync rows (`sessionId`, root `ownerSessionId`,
+// `status`, `stage`); nested descendants keep the Lead as their owner.
+
+const TERMINAL_STATUS = /idle|done|complete|success|closed|error|fail|cancel|killed|timeout/i;
+const ACTIVE_STATUS =
+  /^(?:connecting|requesting|streaming|tool[-_\s]?running|running|queued|pending|starting|resource_wait)$/i;
+const CANCELLED_STATUS = /cancel|killed|aborted|interrupted/i;
+const CANCEL_UNCONFIRMED_STATUS = /cancel[-_\s]?(?:unconfirmed|pending)|cancell?ing/i;
+
+const record = (value) => (value && typeof value === 'object' && !Array.isArray(value) ? value : {});
+
+function statusValues(value) {
+  const entry = record(value);
+  return [entry.stage, entry.status]
+    .map((status) => String(status || '').trim())
+    .filter((status, index, values) => Boolean(status) && values.indexOf(status) === index);
+}
+
+/** A running or queued row: `status` decides, `stage` only for a row without one. */
+function isActiveAgentRow(value) {
+  const statuses = statusValues(value);
+  if (statuses.length === 0 || statuses.some((status) => CANCELLED_STATUS.test(status))) return false;
+  const lifecycle = String(record(value).status || '').trim() || statuses[0];
+  return !TERMINAL_STATUS.test(lifecycle) && ACTIVE_STATUS.test(lifecycle);
+}
+
+/** A cancel whose stop is not proven yet. */
+function isCancelUnconfirmedAgentRow(value) {
+  return statusValues(value).some((status) => CANCEL_UNCONFIRMED_STATUS.test(status));
+}
+
+/** Agent work still in flight on one pool row. */
+export function hasPendingAgentWork(value) {
+  return isActiveAgentRow(value) || isCancelUnconfirmedAgentRow(value);
+}
+
+/** The owner (Lead) session ids with a child row still in flight. The Lead's
+ *  own row is skipped: its turn state comes from the session itself. */
+export function sessionsWithPendingWork(rows) {
+  const pending = new Set();
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const sessionId = String(row?.sessionId || '');
+    const ownerSessionId = String(row?.ownerSessionId || '') || sessionId;
+    if (!ownerSessionId || sessionId === ownerSessionId) continue;
+    if (hasPendingAgentWork(row)) pending.add(ownerSessionId);
+  }
+  return pending;
+}

package/src/runtime/shared/plain-preview.mjs

@@ -5,23 +5,28 @@
 /** `text` without markdown syntax, whitespace folded to single spaces. */
 export function plainPreviewText(text) {
   // HTML comments never show in markdown (a greeting's suggestions ride one).
-  return String(text ?? '')
-    .replace(/<!--[\s\S]*?(?:-->|$)/g, ' ')
-    .replace(/^[ \t]*(`{3,}|~{3,})[^\n]*$/gm, ' ')
-    .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
-    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
-    .replace(/^[ \t]{0,3}#{1,6}[ \t]+/gm, '')
-    .replace(/^[ \t]*>[ \t]?/gm, '')
-    .replace(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/gm, '')
-    .replace(/^[ \t]*(?:[-*_][ \t]*){3,}$/gm, ' ')
-    .replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, '$2')
-    .replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?!\w)/g, '$1$2')
-    .replace(/(^|[^\w_])_(?=\S)([^_\n]*?\S)_(?!\w)/g, '$1$2')
-    .replace(/~~(?=\S)([\s\S]*?\S)~~/g, '$1')
-    .replace(/`+([^`\n]*)`+/g, '$1')
-    .replace(/\s+/g, ' ')
-    .trim()
-    .slice(0, PREVIEW_CAP);
+  return (
+    String(text ?? '')
+      .replace(/<!--[\s\S]*?(?:-->|$)/g, ' ')
+      .replace(/^[ \t]*(`{3,}|~{3,})[^\n]*$/gm, ' ')
+      .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
+      .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+      .replace(/^[ \t]{0,3}#{1,6}[ \t]+/gm, '')
+      .replace(/^[ \t]*>[ \t]?/gm, '')
+      .replace(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/gm, '')
+      .replace(/^[ \t]*(?:[-*_][ \t]*){3,}$/gm, ' ')
+      .replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, '$2')
+      .replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?!\w)/g, '$1$2')
+      .replace(/(^|[^\w_])_(?=\S)([^_\n]*?\S)_(?!\w)/g, '$1$2')
+      .replace(/~~(?=\S)([\s\S]*?\S)~~/g, '$1')
+      .replace(/`+([^`\n]*)`+/g, '$1')
+      .replace(/\s+/g, ' ')
+      // A summary stored before newlines were kept already folded its list: a
+      // dash or bullet right after a sentence end is a marker, not a hyphen.
+      .replace(/([.!?。…:：])\s[-*+•]\s+(?=\S)/g, '$1 ')
+      .trim()
+      .slice(0, PREVIEW_CAP)
+  );
 }
 
 /** A safety cap only: the row clamps the shown text to two lines. */

package/src/runtime/shared/process-lifecycle.mjs

@@ -1,7 +1,6 @@
 import {
   closeSync,
   existsSync,
-  fsyncSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -15,7 +14,7 @@ import {
 import { join } from 'node:path';
 import { execFile } from 'node:child_process';
 import { isDeepStrictEqual, promisify } from 'node:util';
-import { withFileLock, withFileLockSync } from './atomic-file.mjs';
+import { withFileLock, withFileLockSync, writeJsonAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const execFileAsync = promisify(execFile);
@@ -338,24 +337,21 @@ function markerOwned(active) {
 function writeMarker(active) {
   try {
     mkdirSync(active.markerDir, { recursive: true, mode: 0o700 });
-    writeFileSync(
+    // Flushed through the handle that wrote it: reopening the file read-only to
+    // fsync it is refused on Windows (EPERM), which reported a failure after
+    // the marker was already written.
+    writeJsonAtomicSync(
       active.markerPath,
-      `${JSON.stringify({
+      {
         version: 1,
         timestamp: new Date().toISOString(),
         pid: process.pid,
         ppid: process.ppid,
         token: active.token,
         processIdentity: active.processIdentity,
-      })}\n`,
-      { encoding: 'utf8', mode: 0o600 }
+      },
+      { compact: true, mode: 0o600 }
     );
-    const fd = openSync(active.markerPath, 'r');
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
     return true;
   } catch {
     return false;

package/src/runtime/shared/projects.mjs

@@ -8,9 +8,9 @@
  * Data shape: { projects: [{ name, path, addedAt, lastSelectedAt? }] }
  */
 import { homedir } from 'node:os';
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { basename, isAbsolute, join, resolve } from 'node:path';
-import { withFileLockSync, writeJsonAtomicSync } from './atomic-file.mjs';
+import { holdsNoData, readJsonStateSync, updateJsonAtomicSync, writeFileAtomicSync } from './atomic-file.mjs';
 
 const MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
 const PROJECTS_FILE = process.env.MIXDOG_PROJECTS_FILE
@@ -30,47 +30,57 @@ function normalizeKey(absPath) {
   return process.platform === 'win32' ? text.replace(/[\\/]+$/, '').toLowerCase() : text.replace(/\/+$/, '');
 }
 
+// The registry document as a store. A strict read (permission checks and
+// mutations) drops entries without an absolute path: they can never grant
+// anything, and the replaced file survives as projects.json.bak.
+function normalizeStore(parsed, strict) {
+  const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
+  return {
+    projects: projects
+      .filter(
+        (entry) => entry && typeof entry.path === 'string' && entry.path.trim() && (!strict || isAbsolute(entry.path))
+      )
+      .map((entry) => ({
+        name: String(entry.name || basename(entry.path) || entry.path),
+        path: String(entry.path),
+        addedAt: Number(entry.addedAt) || 0,
+        ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
+      })),
+  };
+}
+
+// A damaged registry file (NUL, truncated, malformed) is kept aside as
+// projects.json.corrupt-<ts> and the last good projects.json.bak is restored
+// when there is one, else the registry starts empty: a damaged file never
+// blocks adding, removing or selecting a project. Strict callers still see a
+// real I/O failure (EACCES, EIO) as an error — an unreadable registry is not
+// an empty one; the tolerant listing reads it as empty.
 function readStore(strict = false) {
   try {
-    if (!strict && !existsSync(PROJECTS_FILE)) return { projects: [] };
-    const raw = readFileSync(PROJECTS_FILE, 'utf8');
-    const parsed = JSON.parse(raw);
-    if (
-      strict &&
-      (!Array.isArray(parsed?.projects) ||
-        parsed.projects.some(
-          (entry) => !entry || typeof entry.path !== 'string' || !entry.path.trim() || !isAbsolute(entry.path)
-        ))
-    )
-      throw new TypeError('Project registry is invalid.');
-    const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
-    return {
-      projects: projects
-        .filter((entry) => entry && typeof entry.path === 'string' && entry.path.trim())
-        .map((entry) => ({
-          name: String(entry.name || basename(entry.path) || entry.path),
-          path: String(entry.path),
-          addedAt: Number(entry.addedAt) || 0,
-          ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
-        })),
-    };
+    return normalizeStore(readJsonStateSync(PROJECTS_FILE), strict);
   } catch (error) {
-    if (strict && error?.code !== 'ENOENT') throw error;
+    if (strict) throw error;
     return { projects: [] };
   }
 }
 
 // Serialize the entire read/modify/write across cooperating processes, not
-// just publication. Unlike the generic JSON updater, a corrupt registry must
-// never be repaired into an empty document. Preserve synchronous return values
-// and no-op behavior; failed reads, lock acquisition and writes propagate.
+// just publication: the file is read under the registry lock. Preserve
+// synchronous return values and no-op behavior (an unchanged store is not
+// written); failed reads, lock acquisition and writes propagate. Each write
+// keeps the replaced version as projects.json.bak.
 function mutateStore(mutator) {
-  return withFileLockSync(`${PROJECTS_FILE}.lock`, () => {
-    const store = readStore(true);
-    const { value, changed } = mutator(store);
-    if (changed) writeJsonAtomicSync(PROJECTS_FILE, store, { lock: false });
-    return value;
-  });
+  let outcome;
+  updateJsonAtomicSync(
+    PROJECTS_FILE,
+    (current) => {
+      const store = normalizeStore(current, true);
+      outcome = mutator(store);
+      return outcome.changed ? store : undefined;
+    },
+    { backup: true }
+  );
+  return outcome.value;
 }
 
 /**
@@ -78,7 +88,8 @@ function mutateStore(mutator) {
  * selection store and memory project_id classification (resolveProjectId)
  * agree. Rules:
  *   - Never overwrite an existing marker (user may have set 'common' or a
- *     custom id — respect it).
+ *     custom id — respect it). A marker holding no data (empty or NUL, what a
+ *     crash leaves) is no id: it is rewritten.
  *   - Only act when absPath is a real directory on disk; never create the
  *     project folder itself (addProject does NOT create the directory).
  *   - Marker value = provided name, else basename(absPath). Skip when the
@@ -97,14 +108,12 @@ function ensureProjectIdMarker(absPath, name) {
       return; // missing / unstattable → silently skip
     }
     const markerPath = join(absPath, '.mixdog', 'project.id');
-    if (existsSync(markerPath)) return; // preserve existing value
+    const present = existsSync(markerPath);
+    if (present && !holdsNoData(readFileSync(markerPath))) return; // preserve existing value
     const value = String(name || basename(absPath) || '').trim();
     if (!value || value.toLowerCase() === 'common') return;
-    const markerDir = join(absPath, '.mixdog');
-    mkdirSync(markerDir, { recursive: true });
-    const tmp = `${markerPath}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${value}\n`, 'utf8');
-    renameSync(tmp, markerPath);
+    // A missing marker is created only if still missing (a concurrent creator's wins).
+    writeFileAtomicSync(markerPath, `${value}\n`, { createOnly: !present });
   } catch {
     /* best-effort marker; never throw */
   }

package/src/runtime/shared/provider-accounts.mjs

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { parseJsonText, updateJsonAtomic } from './atomic-file.mjs';
+import { readJsonStateSync, unsupportedState, updateJsonAtomic } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 export const ACCOUNT_PROVIDERS = Object.freeze([
@@ -34,12 +33,19 @@ function requireAccountId(id) {
 
 function validate(raw) {
   if (raw == null) return { version: 1, providers: {} };
+  // A newer build's roster is left in place: reads see no accounts and writes
+  // refuse, so a downgrade never discards it.
+  if (Number.isSafeInteger(raw.version) && raw.version > 1) {
+    throw unsupportedState(`Provider account settings version ${raw.version} is newer than this build.`);
+  }
   if (raw.version !== 1 || !raw.providers || typeof raw.providers !== 'object') {
     throw new Error('Provider account settings are unreadable.');
   }
   for (const [provider, pool] of Object.entries(raw.providers)) {
-    requireAccountProvider(provider);
-    if (!Array.isArray(pool.accounts) || pool.accounts.length > MAX_ACCOUNTS) {
+    // A provider a newer build added is carried as is: this build never reads
+    // or writes its pool, and treating it as damage would discard it.
+    if (!ACCOUNT_PROVIDERS.includes(provider)) continue;
+    if (!Array.isArray(pool?.accounts) || pool.accounts.length > MAX_ACCOUNTS) {
       throw new Error('Invalid provider account list.');
     }
     const ids = pool.accounts.map((row) => requireAccountId(row.id));
@@ -48,13 +54,11 @@ function validate(raw) {
   return raw;
 }
 
+// Every OAuth provider's init reads the roster, so a damaged one (crash
+// leftovers, truncation, a shape this build rejects) must never throw: it is
+// kept aside and the last good copy, which every write keeps, is restored.
 function read(dataDir) {
-  try {
-    return validate(parseJsonText(readFileSync(file(dataDir), 'utf8')));
-  } catch (error) {
-    if (error.code === 'ENOENT') return validate(null);
-    throw error;
-  }
+  return readJsonStateSync(file(dataDir), { validate, fallback: validate(null), secret: true });
 }
 
 // Labels an earlier build assigned automatically. They read as a different
@@ -106,7 +110,8 @@ export function readProviderAccountPool(provider, dataDir = resolvePluginData())
 
 async function update(provider, mutate) {
   requireAccountProvider(provider);
-  // Read failures must not be interpreted as an empty account roster.
+  // A roster that parses yet fails validation is recovered here first; the
+  // mutator's validate would otherwise refuse every write. I/O failures throw.
   read();
   const result = await updateJsonAtomic(
     file(),
@@ -117,7 +122,7 @@ async function update(provider, mutate) {
       state.providers[provider] = pool;
       return validate(state);
     },
-    { mode: 0o600, secret: true, fsyncDir: true }
+    { mode: 0o600, secret: true, fsyncDir: true, backup: true }
   );
   return normalizePool(result.providers[provider]);
 }

package/src/runtime/shared/routine-trigger.d.mts

@@ -4,7 +4,12 @@ export interface RoutineTrigger {
   event?: string;
 }
 
-export declare function routineTriggerHeader(input: { kind: string; name: string; project?: string }): string;
+export declare function routineTriggerHeader(input: {
+  kind: string;
+  name: string;
+  project?: string;
+  now?: Date | number;
+}): string;
 export declare function stripRoutineTriggerHeader(text: unknown): string;
 export declare function normalizeRoutineTrigger(value: unknown): RoutineTrigger | null;
 export declare function routineTriggerField(value: unknown): { routineTrigger?: RoutineTrigger };

package/src/runtime/shared/routine-trigger.mjs

@@ -4,18 +4,26 @@
 // carries (live, persisted in meta.transcript, restored) so a chat paints it
 // as a routine marker instead of a user bubble.
 
+import { localTimestampParts } from './time-format.mjs';
+
 const HEADER_PREFIX = '[Routine trigger]';
 const KINDS = new Set(['schedule', 'webhook']);
 
-/** The first line of a routine turn's prompt: which routine fired and how to
- *  treat the turn. Only the turn's content carries it, never the system
- *  prompt, so the thread's prompt cache is untouched. */
-export function routineTriggerHeader({ kind, name, project = '' }) {
+/** The first line of a routine turn's prompt: which routine fired, when (local
+ *  time and zone: the turn gets no other date), and how to treat the turn.
+ *  It is the routine's only conduct text. Only the turn's content carries it,
+ *  never the system prompt, so the thread's prompt cache is untouched. */
+export function routineTriggerHeader({ kind, name, project = '', now = new Date() }) {
   const what = kind === 'webhook' ? 'webhook' : 'schedule';
+  const at = localTimestampParts(now);
   return [
     `${HEADER_PREFIX} Your ${what} "${String(name)}" fired.`,
-    'Carry out its instructions below now, yourself or by delegating; nobody is watching this turn, so approvals wait for the user.',
-    'Reply in this chat with the result.',
+    ...(at ? [`Local time: ${at.date} ${at.time.slice(0, 5)} ${at.timeZone} (${at.offset}).`] : []),
+    'Carry out its instructions below now, yourself or by delegating.',
+    'Nobody is watching this turn and nothing asks for approval: act within your permissions.',
+    'Payments and permanent deletes are refused here: report that and suggest doing it from the chat.',
+    'If a sign-in, code or CAPTCHA blocks you, stop and say which site needs the user.',
+    'Reply in this chat in plain words, without tool names; if you handed work off, say it started — its result arrives here later.',
     ...(project ? [`Project folder: ${project}`] : []),
   ].join(' ');
 }

package/src/runtime/shared/run-child.d.mts

@@ -0,0 +1,3 @@
+import type { ChildProcess } from 'node:child_process';
+
+export function killChildTree(child: ChildProcess): void;

package/src/runtime/shared/run-child.mjs

@@ -8,6 +8,29 @@
 // maxBytes, or the spawn error itself.
 import { spawn } from 'node:child_process';
 
+/** Kills `child` with everything it started. On Windows a plain kill ends only
+ *  the child itself: `git` there is a launcher whose git.exe (and the alias,
+ *  hook or filter it runs) would live on, still holding the output pipes. */
+export function killChildTree(child) {
+  if (process.platform === 'win32' && child.pid && child.exitCode === null) {
+    const taskkill = `${process.env.SystemRoot || 'C:\\Windows'}\\System32\\taskkill.exe`;
+    const fallback = () => {
+      try {
+        child.kill();
+      } catch {}
+    };
+    spawn(taskkill, ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true })
+      .once('error', fallback)
+      .once('exit', (code) => {
+        if (code !== 0) fallback();
+      });
+    return;
+  }
+  try {
+    child.kill();
+  } catch {}
+}
+
 export function runChild({ command, args, cwd, input, env, timeoutMs, maxBytes, stdoutEncoding = 'utf8' }) {
   return new Promise((resolvePromise, rejectPromise) => {
     const hasInput = (typeof input === 'string' || ArrayBuffer.isView(input)) && input.length > 0;
@@ -35,9 +58,7 @@ export function runChild({ command, args, cwd, input, env, timeoutMs, maxBytes,
         ? setTimeout(() => {
             const error = new Error(`${command} ${args.join(' ')} timed out after ${timeoutMs}ms`);
             error.code = 'ETIMEDOUT';
-            try {
-              child.kill();
-            } catch {}
+            killChildTree(child);
             finish(error);
           }, timeoutMs)
         : null;

package/src/runtime/shared/sensitive-path-rules.d.mts

@@ -0,0 +1,15 @@
+export interface SensitiveScope {
+  root: string[];
+  /** Subfolders of the root that stay reachable. */
+  except: readonly string[];
+  /** Whole tree (a registered private root) or Mixdog's secret subset. */
+  whole: boolean;
+}
+export function sensitivePathSegments(path: string): string[];
+export function matchesSensitivePath(
+  path: string,
+  within?: readonly SensitiveScope[],
+  options?: { envTemplates?: boolean }
+): boolean;
+export function mixdogSensitiveScopes(extraData?: readonly string[]): SensitiveScope[];
+export function isSensitiveLocalPath(path: string, options?: { extraData?: readonly string[] }): boolean;