mixdog 1.3.4 → 1.4.0

package/src/defaults/skills/code-tidy/references/agent-cleanup.md

@@ -40,7 +40,7 @@ evidence as `kept`.
 ## Deletion ladder
 
 Run the ladder on every selected unit (function, class, module, config knob)
-in the current round before looking for smells. Only code that lands on the
+in scope before looking for smells. Only code that lands on the
 last rung goes on to the lenses.
 
 | Rung | Question | Typical win |
@@ -55,7 +55,7 @@ in-place cleanup; take it before analysing the unit's smells.
 
 ## Lenses
 
-Each lens judges the current partition's units and may search the whole
+Each lens judges the units in scope and may search the whole
 repository for evidence (an existing helper, a sibling call site); a finding
 without a path-plus-symbol pointer is dropped. Run every lens unless the user named a focus.
 Judge each selected function or class in its full context, including relevant
@@ -116,8 +116,8 @@ Every finding carries one tier:
 
 | Tier | Meaning | Examples | Handling |
 |---|---|---|---|
-| SAFE | equivalence established, including initialization and parsing | verified unused binding with no initialization effects, nonsemantic comment, redundant type assertion | apply as one batch; verify the affected behavior without repeating unchanged checks |
-| CAREFUL | same semantics, structure changes | rename a local, flatten a ternary, guard clause, verified wrapper inlining, extract a helper, split responsibilities while preserving entry points, consolidate duplicates, name a magic number | apply one source unit at a time (including required new modules); targeted verification at behavior boundaries, final checks once; undo only this run's edits on failure |
+| SAFE | equivalence established, including initialization and parsing | verified unused binding with no initialization effects, nonsemantic comment, redundant type assertion | apply as one batch |
+| CAREFUL | same semantics, structure changes | rename a local, flatten a ternary, guard clause, verified wrapper inlining, extract a helper, split responsibilities while preserving entry points, consolidate duplicates, name a magic number | apply one source unit at a time (including required new modules); verified by the single final check; undo only this run's edits if it cannot be fixed |
 | RISKY | may change behavior or a contract | public API or export rename, route/DB column/config key rename, error-handling change, concurrency change, N+1 restructuring, altitude fix in shared infrastructure | report only, with the test coverage status; never auto-apply |
 
 Conflict resolution when lenses disagree: correctness > the user's stated

package/src/defaults/skills/code-tidy/references/cleanup-report.md

@@ -1,88 +1,43 @@
-# Cleanup inventory and report
+# Candidate list and report
 
-Read this before registering the first candidate, and again when closing the
-last round. It owns candidate registration, statuses, completion criteria, and
-the final report template. Findings and their risk tiers come from the
-agent-level analysis; this file owns how they are recorded and reported.
+Findings and risk tiers come from `agent-cleanup.md`; this file owns how they
+are recorded and reported. Keep the list in the conversation, not a file.
 
-## Candidate inventory
+## Candidates
 
-The candidate inventory grows as rounds reveal findings. Register candidates
-using stable candidate IDs:
+One line per candidate, with a stable ID (`C-01`):
 
 ```text
-[ID] path · symbol → problem → cost (what it duplicates, wastes, or makes harder) → planned action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished | verification: <test/check>
+[ID] path · symbol → problem → cost → action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished
 ```
 
-- **Stable IDs & Grouping**: Assign stable IDs (e.g. `C-01`, `C-02` or `MOD-01`).
-  When multiple locations share an identical root cause (e.g. an unused helper
-  referenced across three call sites, or repeated boilerplate), group them under
-  one ID without losing each member's path and symbol. Counts track
-  candidate IDs, not raw diagnostics or individual member locations.
-- **Origin tracking**: When code moves during extraction or splitting, retain
-  the origin candidate ID and record the new target location under that ID.
-- **Candidate classification**: Register only a lens finding with a
-  path-plus-symbol location, a cost, and an action. Line numbers appear only
-  when copied from engine diagnostics or grep output. Mechanical threshold hits (files > 1,000 lines,
-  functions > 50 lines, nesting > 3) are investigation signals only; without a
-  finding, do not register them or write a Keep justification.
-- **Cost, Confidence & Nits**: A finding that cannot name its cost is a nit:
-  do not register it. An unresolved registered finding remains `unfinished`;
-  uncertainty is not evidence for keeping it. Confidence is `low` when
-  current code, callers, contracts, and tests do not explain why the code exists.
-  Consult history only to resolve a specific remaining question. Medium/low
-  confidence candidates stay unfinished until that question is resolved; apply
-  approval does not authorize guessing that they are safe to delete.
-- **Statuses & Reconciliation Invariants**:
-  - `completed`: verified done, with evidence of what and how changed.
-  - `kept`: preserved with concrete evidence (documented keep rule or external contract).
-  - `unfinished`: work remaining, with substatuses: `pending`, `in_progress`, `blocked`, `deferred`, or `unverified`.
-  - Formula for registered candidates: `Total Candidate IDs = Completed + Kept + Unfinished Remaining`. Counts must reconcile exactly.
+- Register only a lens finding with a path+symbol location, a cost, and an
+  action. A finding that cannot name its cost is a nit: drop it. Threshold
+  hits (long files or functions, deep nesting) are signals, not candidates.
+- Findings sharing a root cause group under one ID, each member keeping its
+  path and symbol. Code moved by an extraction keeps its origin ID.
+- Confidence is `low` when callers, contracts, and tests do not explain why
+  the code exists; medium/low candidates stay unfinished until that question
+  is resolved. Approval to apply does not authorize guessing.
+- `completed` carries evidence of what changed; `kept` carries a concrete
+  reason (keep rule or external contract); `unfinished` carries the blocker
+  (pending, blocked, deferred, unverified).
 
-Report round outcome separately from overall cleanup status. Overall cleanup
-is complete only when all partitions and applicable stages are verified and
-every registered candidate is completed or evidenced as kept. A completed round
-with remaining partitions or candidates is **round complete, overall partial**,
-with the remaining paths, IDs, and next work.
-Skipped, failed, or unverified checks never count as passed.
+Overall cleanup is complete only when every partition is done, the final
+check has passed, and every candidate is completed or kept with evidence.
+Otherwise report "overall partial" with the remaining paths and IDs.
 
-## Final report template
-
-This is the shape of the closing reply after the last round; earlier rounds
-close as the skill body's section 7 describes, while the inventory accumulates
-in the form above.
+## Final report
 
 ```text
-Scope: <user-selected paths | explicit whole project> · Mode: report|apply
-Round: Round <N> <completed|partial> · Overall: <complete|partial>
-Inventory: Total <N> · Completed <X> · Kept <Y> · Unfinished <Z> (X + Y + Z = N)
-Stages: baseline / engines / structural / ladder + lenses / tiered changes / final verification
-  <stage>: completed <evidence> | not applicable <reason> | unfinished <blocker>
-Baseline: tests <green|N pre-existing failures excluded> · typecheck <ok|…>
-Deterministic: engines used/missing · files changed · diagnostics remaining · structural matches applied/skipped
-
-Completed (what changed and how)
-  [ID] path/file.ts · symbol
-    ✓ [Quality/SAFE]   removed comment narrating the change in `renderRow` → deleted redundant comment
-    ✓ [Reuse/CAREFUL]  replaced manual join with `joinPath` from src/shared/path.mjs → consolidated helper
-
-Kept / Not Applicable (evidenced)
-  [ID] path/file.ts · symbol
-    - [Keep/Contract]  public export `parseConfig` kept → external contract
-    - [Keep/Rule]      redundant-looking guard in `fetchUser` kept → validates untrusted network input
-
-Unfinished (remaining candidates)
-  [ID] path/file.ts · symbol
-    ☐ [Structure/CAREFUL] split `handleRequest` responsibility · Status: pending|in_progress|blocked|deferred|unverified
-      Remaining: extract auth sub-handler · Reason: waiting for auth test fixture · Next: Round <N+1>
-
-Noticed but not applied (report-only or out of scope)
-  [ID] ⚠ [Altitude/RISKY] special case for caller X in `run` (src/core/run.mjs) — separate correction · coverage: none · Status: deferred
-  [ID] ⚠ [Quality]        two equal rewrites of `parseInput`; principles could not decide · Status: blocked
-
-Bugs found (not fixed here): <correctness issues surfaced while cleaning>
-Verification: tests <passed/failed/skipped/baseline-excluded counts> · typecheck <result> · lint <remaining diagnostics>
-Blocked or unavailable verification (required; write "none"): <check> — <engine unresolved through tidy | runner broken | lane conflict> → <paths left unverified>
-Needs your decision: <one consolidated list — RISKY findings, bugs found, unresolved intent, unfinished candidates>
-Next round: <scope and IDs planned for next round, or none if overall complete>
+Scope: <paths | whole project> · Mode: report|apply · Overall: complete|partial
+Deterministic: engines used/missing · files changed · diagnostics remaining · structural applied/skipped
+Completed:  [ID] path · symbol — [Lens/TIER] what changed
+Kept:       [ID] path · symbol — reason
+Unfinished: [ID] path · symbol — remaining work · status · next
+Noticed, not applied (RISKY or out of scope): [ID] path · symbol — why · test coverage
+Bugs found (not fixed here): <issues>
+Verification: tests <result> · typecheck <result> · tidy check <remaining diagnostics> · pre-existing failures <list|none>
+Blocked or unverified: <check> — <reason> → <paths>   (write "none" if none)
+Needs your decision: <RISKY findings, bugs, unresolved intent, unfinished candidates>
 ```

package/src/defaults/skills/code-tidy/references/dead-code.md

@@ -19,9 +19,7 @@ never route one through `tidy` (they are not tidy engines):
 | `deadcode` (Go, `golang.org/x/tools`) / `cargo machete` | unreachable functions / unused crates | only when on PATH |
 | `code_graph mode:symbols` per selected file | private helpers with no callers (`callers`) | universal, no install |
 
-Keep optional unused-code diagnostics separate from the build baseline.
-Do not add stricter compiler flags for a routine cleanup check; an explicitly
-requested additional diagnostic does not redefine the project's build criteria.
+Do not add stricter compiler flags for a routine cleanup.
 
 An import the project cannot resolve, or one whose package is absent from the
 manifest, is not dead code but a phantom dependency: report it under "Bugs
@@ -48,7 +46,7 @@ found" and never settle it by installing the package.
    module for registration or initialization. Preserve required initialization
    rather than deleting it with the binding.
 5. Record the symbol, kind, classified usage and contract evidence, side-effect
-   result, and proposed action in the shared candidate inventory.
+   result, and proposed action in the candidate list.
 
 ## Never dead
 
@@ -81,9 +79,7 @@ evidence. Apply this procedure before classifying an old path as dead:
 4. For a verified obsolete path, inventory its callers, flags/config, tests,
    docs, files, and dependencies. Remove only approved members in the order
    below; request scope expansion before editing related files outside it.
-5. Verify the current path and remaining supported compatibility cases with
-   documented checks. Record the retirement evidence and any remaining items.
-   A still-required path is kept with its contract; an unknown obligation
+5. Record the retirement evidence and any remaining items. A still-required path is kept with its contract; an unknown obligation
    leaves the candidate blocked, not assumed obsolete.
 
 ## Remove in order
@@ -98,11 +94,9 @@ evidence. Apply this procedure before classifying an old path as dead:
    project's own package manager.
 
 Group edits by file so one batch never touches a file another batch edits.
-Verification and failure rollback follow the skill body (section 4 step 3 and
-the test-failure pitfall); never patch forward past a failure.
+Verification and rollback follow the skill body (section 5).
 
 ## Report
 
-Use the shared candidate inventory and closing report, not a second dead-code
-ledger. Include the symbol/kind, usage and side-effect evidence, any legacy
-obligations, and verification result for each completed, kept, or unfinished ID.
+Use the shared candidate list and closing report, with usage and side-effect
+evidence per ID.

package/src/defaults/skills/computer-use/SKILL.md

@@ -41,8 +41,11 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
 - Mixdog browser pages → Browser Use (`browser`). A refused or unfinished
   page action stays on that route for recovery or user handoff; never retry
   it through `computer` or move it to another browser.
-- On either route, permission denials, CAPTCHA/2FA, identity checks, and user
-  stops are not fallback signals: report or hand off, never bypass them.
+- On either route, permission denials, CAPTCHA/2FA (authenticator, SMS,
+  passkey), identity checks, and user stops are not fallback signals: report
+  or hand off, never bypass them. A "check your e-mail" step of a sign-up or
+  sign-in Mixdog started is not one: finish it from a connected mailbox
+  (browser-use skill, E-mail verification).
 - Use the screen when a UI itself is the subject: checking a desktop app's GUI
   after a change, a GUI-only bug, UI-only settings, a cross-app flow.
 - Service CLIs and deterministic file, process, or config work → `shell`/`edit`;
@@ -83,8 +86,10 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
   `input_may_have_executed:true` or unknown delivery is not a no-input refusal.
   A refusal applies to that action, not to earlier completed steps. Keep the
   selected app/browser session when choosing another supported delivery route.
-- User intervention means pending work, not permission to work around the pause
-  through background input. Resume only through the recovery flow below.
+- Background work continues while the user works. A foreground step is refused
+  or interrupted (that action only, `user_input_active`) when the user acts; it
+  never pauses the session. Retry it after the user pauses. Explicit
+  Stop/Pause still halts everything; resume through the recovery flow below.
 
 ## Rules
 
@@ -114,11 +119,14 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
 - Window pixels come only from a window-owned capture, never a sampled region
   of the shared desktop. If that surface is unavailable, use semantic refs or
   report `pixel_unavailable`; do not substitute a screen grab.
-- If the user intervenes, preserve their cursor and focus. Worker termination
-  and input cleanup must finish before resuming. The user's Resume on the
-  overlay continues a pause; an ordinary physical-input pause may also resume
-  after the host's configured quiet interval (renewed input resets it), while
-  explicit pauses, stops and uncertain cleanup never auto-resume. Stop (or
+- If the user's physical input interrupts an action, it fails alone with
+  `user_input_active` (input may have landed: capture fresh state, never replay,
+  no `wait_for_user`). Their cursor and focus stay theirs. Worker
+  termination and input cleanup must finish before resuming a pause. The user's
+  Resume on the overlay continues a pause; an unverified-recovery pause may
+  also resume after the host's configured quiet interval (renewed input resets
+  it), while explicit pauses, stops and uncertain cleanup never auto-resume.
+  Stop (or
   `Ctrl+Alt+Esc`) cancels the task, which then reports the stop as a failure.
   A cleanup that could not be confirmed is retried before the next input
   command; if it still fails, that command returns the reason — relay it to
@@ -222,6 +230,22 @@ refs still work.
 `type` text, optional `key` Enter → inspect the returned value. Use `verify`
 only if the result does not establish the required value or completion state.
 
+**Sign in inside the user's browser window** — prefer the session or SSO the
+browser already has, or Browser Use's saved sign-in. As a fallback, focus the
+login field (`act` click), then `saved_login` with `savedAccount` (username or
+masked label) and `field` (`username` or `password`). The host writes it only
+into that field of a verified Chrome/Edge HTTPS page whose origin has
+the login (separate checks, then one write: not atomic inside the browser).
+The site receives it. The password is the protected value: it is kept out of
+your results and that browser's pixels are withheld until this turn ends
+(`ax` reads still work), but a page that redisplays it can expose it, and other
+programs of the same Windows user are outside this protection. A username is
+an identifier and is not hidden. Continue with keys (`act` key Enter). On a
+refusal, hand the secret to the user (`ask_user` kind `secret`,
+surface `computer`); one-time codes, passkeys, security keys and app approvals
+are the user's step (`ask_user` kind `takeover`). Never type a password or
+code with `type`/`set_value`, even one shown on screen.
+
 **Keyboard-driven navigation** — `act` with `key` steps such as `ctrl+s`
 and a trailing short `wait`; verify with `verify` rather than another capture.
 `alt+f4` is blocked in every delivery mode. To close a window, obtain the

package/src/defaults/skills/setup/SKILL.md

@@ -20,10 +20,15 @@ supported `setup` action, and read its result as the change receipt.
 
 - Use the `setup` tool for persisted Mixdog configuration. Never edit
   `mixdog-config.json` or internal stores directly; if the tool and UI expose no
-  supported path, report that limitation.
+  supported path, report that limitation. The one exception is the definition
+  file a workflow or agent `read_definition` returns as `path`.
 - API keys, OAuth credentials, tokens, and usage sign-ins stay out of tool
   arguments and the transcript. Open the Providers surface and let the user
   enter them.
+- Developer option "Allow all actions" (`allowAllActions`) can only be turned
+  on by the person in the desktop app; the tool refuses it even with
+  `riskAccepted:true`, and remote enablement is refused too. Open `developer`
+  instead.
 - A mutation follows the active workflow's approval rules. Status, catalog,
   definition and MCP-config reads do not change persisted settings.
 - Most changes affect new sessions. Report `appliedToCurrentSession` and
@@ -58,6 +63,28 @@ that a call returned without transport error.
 - Read `references/surfaces.md` only when the user asks where a setting lives,
   a secret must be entered, or no setup mutation exists.
 
+## What applies now vs. later
+
+- Now: built-in, connector, permission, hook-rule, cache-warming and
+  automation changes (each at its next use), and a fallback chain: running
+  sessions on that route read it at their next hop.
+- Next turn: an agent/bot route for its open chats, `reset_route_fallback`, a
+  workflow switch. A running turn finishes on its current model.
+- New sessions: the Main model (`set_route` model), instruction files, most
+  other settings. An established conversation keeps its model.
+- Session actions (`reset_route_fallback`, quota resume, `continue_in_model`)
+  answer `scope: "session"`, not a saved setting.
+
+## Stopping something already running
+
+Setup changes settings; it does not stop work. Use the tool that owns it:
+`session` `cancel` (another session's turn, a routine run in a bot's chat, a
+group room's exchange; a Browser/Computer takeover ends with its turn),
+`agent` `cancel`/`close` (sub-agents), `task` (background shell jobs), `goal`
+`pause` (an active Goal, at the user's request). Setup only prevents more: `set_automation_enabled false`
+(future routine runs), `fallbacks: []` (further hops), `cancel_quota_resume`,
+`set_builtin_enabled` browser/computer off.
+
 ## High-signal distinctions
 
 - Main model, agent models, and Web Search model are separate routes. Omitted
@@ -70,7 +97,7 @@ that a call returned without transport error.
   background cycles. Core Memory entries
   are read and changed with the `memory` tool, not setup.
 - Built-ins have installation state separate from enabled state; Visualize
-  is toggle-only (on by default, no install step). Browser Use,
+  (on by default) and Media generation are toggle-only (no install step). Browser Use,
   Computer Use actions require this conversation open in the local Desktop
   window; voice runs on the runtime and needs no Desktop.
 - Hook rules are before-tool policy, separate from MCP and plugins. Deleting a

package/src/defaults/skills/setup/references/actions.md

@@ -24,18 +24,21 @@ Read this when choosing a `setup` mutation.
 |---|---|
 | Main model route | `set_route` |
 | Agent-specific route or inheritance | `set_agent_route` |
-| Web Search model route | `set_web_search_route` |
+| Web Search model route (and its `route.fallbacks`) | `set_web_search_route` |
 | Active workflow pack | `set_workflow` |
 | Output style | `set_output_style` |
 | User title, language, or experience level | `set_profile` |
 | Idle session clearing, per provider, including `unlimited` | `set_autoclear` |
-| Automatic context compaction | `set_compaction` |
+| Automatic context compaction, compaction on model change, summary model | `set_compaction` |
+| Context → Let AI rename sessions | `set_ai_session_titles` |
+| Providers → Usage limits → Resume automatically when the limit resets | `set_quota_auto_resume` |
+| Model management: "Show in /model" and favorites, per provider model | `set_model_preferences` |
 | Memory capability | `set_memory_enabled` |
 | Background memory cycles | `set_recap_enabled` |
 | Web Search tool exposure | `set_web_search_enabled` |
 | Which user instruction files (AGENTS.md / CLAUDE.md) new sessions load: all, agents, claude, or off | `set_instruction_files` |
 | The reasoning effort Auto works around: low, medium (default), or high | `set_auto_effort_base` |
-| Git, Office, Code Tidy, Local Provider, Auto Effort, Browser, Computer, voice, or Visualize enabled state | `set_builtin_enabled` |
+| Git, Office, Code Tidy, Local Provider, Auto Effort, Browser, Computer, voice, Visualize, or Media generation enabled state | `set_builtin_enabled` |
 | Git, Memory, Office, Code Tidy, Local Provider, Auto Effort, Browser, Computer, or voice preparation | `install_builtin` |
 | Managed local model installation | `install_local_model` |
 | Start or resume a background runtime/model download | `start_local_installation` |
@@ -49,11 +52,14 @@ Read this when choosing a `setup` mutation.
 | Permanently delete confirmed, unchanged, unused model files | `delete_local_model` |
 | TUI system shell | `set_system_shell` |
 | Automatic updates | `set_auto_update` |
+| Mixy's heartbeat: a regular check that wakes her only when something needs attention and only after the user had no operation for 30 minutes (no sent turn, no keyboard/mouse/wheel input in the desktop app's windows) (on by default; `status features` reports `heartbeat.enabled` and `heartbeat.intervalMinutes`) | `set_heartbeat_enabled` |
+| How often the heartbeat checks: `minutes` 30, 60 (default), 120 or 240; applies from the next tick, counted from the last check | `set_heartbeat_interval` |
+| Bots' emoji reactions on the user's messages (on by default; `status features` reports `reactions.enabled`) | `set_reactions_enabled` |
 | Worktree defaults: new tasks on the current branch or a new worktree, branch prefix, large-repository warning size, automatic cleanup | `set_worktree_settings` |
-| Remove stored provider authentication (one OAuth account at a time) | `forget_provider_auth` |
-| Select, rename, or reorder OAuth accounts, set the switching policy, or allow paid credits | `set_provider_account` |
-| Developer options such as risk-gated OAuth providers | `set_developer_option` |
-| Connect a catalog service (Notion, Linear, Gmail, …; not GitHub, which is the GitHub CLI) for the user: shows a one-click connect card | `connect_connector` |
+| Remove stored provider authentication (one OAuth account at a time, or an API-key provider's key) | `forget_provider_auth` |
+| Select, rename, or reorder OAuth accounts, set automatic switching or the switching policy, or allow paid credits | `set_provider_account` |
+| Developer options (approvals, risk-gated providers); `allowAllActions` can only be turned off | `set_developer_option` |
+| Connect a catalog service (Notion, Linear, Gmail, …; not GitHub, which is the GitHub CLI) for the user: shows a connect card (sign-in, key sheet, or app-password dialog) | `connect_connector` |
 | Add an MCP server | `add_mcp_server` |
 | Edit or rename an MCP server | `save_mcp_server` |
 | Remove an MCP server | `remove_mcp_server` |
@@ -78,17 +84,28 @@ Read this when choosing a `setup` mutation.
 | Enable/disable (pause/resume) a schedule/webhook | `set_automation_enabled` |
 | Run a schedule once now, or re-run a webhook on its latest received payload; the result posts into the owning agent's thread | `run_automation` |
 | Webhook listener enabled state, port, or domain | `set_webhook_config` |
-| Desktop keep-awake, run in background after window close, turn-completion notifications, notification volume (Windows), usage pin, usage rail short + long bars, or Computer observe-only state | `set_desktop_settings` |
-| Desktop theme, imported color theme, UI/code font, skin transparency (outer or main panels), display language, side panels, markdown default view, link previews, or tool activity expansion | `set_appearance` |
+| Desktop keep-awake, run in background after window close, turn-completion notifications, notification volume (Windows), usage pin, usage rail short + long bars, expanded usage accounts, usage rail slots (three / all), Computer observe-only, Browser auto sign-in, or the representative bot overlay (`desktop.botOverlay`) | `set_desktop_settings` |
+| Desktop theme, imported color theme, UI/code font, UI scale, code size and ligatures, chat text size, skin transparency (outer or main panels), display language, time format, side panels and their position, markdown default view, link previews, or tool activity expansion | `set_appearance` |
 | Add a before-tool hook rule | `add_hook_rule` |
 | Enable or disable a hook rule by its `status hooks` index | `set_hook_rule_enabled` |
 | Delete a hook rule by its `status hooks` index | `delete_hook_rule` |
-| Remembered image/video lane and model used when a generation omits them | `set_media_default` |
+| Settings "Default generator" pin per kind (image/video): lane, model, account; `lane: ""` clears it (Auto) | `set_media_default` |
 | Which activity rail items are pinned, in order (current list in `status desktop`) | `set_activity_rail_pins` |
 | Register a Project and optionally set its display alias | `save_project` |
 | Unregister a Project without deleting its files | `remove_project` |
 | Revoke one linked device by its client id from `status connection`; re-pairing restores access | `revoke_linked_device` |
 | Managed local model context allocation; null restores automatic | `set_local_context` |
+| Return a session that fell back (this one by default, `sessionId`, or every chat of a bot with `agent`) to its primary route and chain | `reset_route_fallback` |
+| Switch a session whose last turn stopped on a usage limit onto another model (`sessionId`, `route`) | `continue_in_model` |
+| Resend a usage-limit-stopped turn of a session at its reset time, or drop that pending resume | `schedule_quota_resume`, `cancel_quota_resume` |
+| Prompt-cache warming on/off (`status compaction` `promptCacheWarming`) | `set_cache_warming_enabled` |
+| Read an agent's action permissions, connector switches and always-allowed tools | `read_agent_settings` |
+| Read a Project's connector switches | `read_project_connectors` |
+| An agent's action permission (block/ask per action kind) | `set_agent_permission` |
+| Switch a connector off for an agent / a Project (switching it back on is done in the desktop app) | `set_agent_connector`, `set_project_connector` |
+| One connector tool of an agent to needs_approval or disabled | `set_agent_connector_tool` |
+| Bring back an archived bot or agent (`definitionKind: "agent"`) | `restore_definition` |
+| Bot display order (Bots page, Sessions bot section; `status agents` `botOrder`) | `set_bot_order` |
 
 ## Routes and workflow
 
@@ -108,6 +125,11 @@ workflow` before changing the corresponding domain.
 - A Web Search route must support native web search; tool exposure is changed
   separately.
 - Definition actions use `definitionKind` (workflow, agent, skill).
+  A workflow or agent `read_definition` returns `path` when a user copy exists:
+  to change part of its body, edit that file with the ordinary file edit tool
+  instead of re-sending the whole body; keep its frontmatter as it is. Without
+  `path` (a shipped-only definition), make the change with `save_definition`:
+  a save equal to the shipped copy keeps no user file.
   Workflow/agent ids cannot be renamed through
   a save; change their display name instead. User skills may be renamed with
   `originalName` and `name`. A user skill's trigger line (`when_to_use`) is
@@ -121,8 +143,22 @@ workflow` before changing the corresponding domain.
 - Changing orchestration does not rewrite workflow instructions or agents.
 - `set_route` is the Lead default for new sessions. A model chosen in New Task
   changes that default only when the user actually picks one there.
-  `route.fallbacks` (ordered models on other providers; `[]` clears) works the
-  same on `set_route` (Lead), `set_agent_route` (agents and bots, Mixy included).
+  `route.fallbacks` (ordered models, each on a different provider from the
+  primary and the others; `[]` clears) works the same on `set_route` (Lead),
+  `set_agent_route` (agents and bots, Mixy included) and `set_web_search_route`.
+  Running sessions on that route read the chain at their next hop: an edit
+  applies at once, and `[]` stops further hops, so the turn ends with the
+  provider's own limit error. A session on another model follows no chain.
+  `status model` returns `route.autoEffort`, `route.fallbacks`, and the
+  position of this conversation (`session`) and other Lead conversations
+  (`sessions`): `current` vs `primary`, `onPrimary`, `fallbackIndex`, the
+  `fallbacks` it follows now, `next`, and `failures` (why it left each model);
+  `status agents` `sessions` gives the same for bot chats and sub-agents. A
+  session that fell back stays there until `reset_route_fallback` returns it
+  to its primary from its next turn (chain restarted).
+- Session actions on another session need the Mixdog app or daemon to host
+  it; a bot's thread reaches only its own bot's sessions. `continue_in_model`
+  does not resend the stopped turn: the user resumes it there.
 - A workflow switch reaches a running conversation as a reminder on its next
   turn (the cached prompt is not swapped). A bot definition's instruction,
   persona or name applies when the user presses 적용, with one cache break.
@@ -138,7 +174,21 @@ key's source.
 
 - API-key and OAuth providers: `open providers`, then the user completes
   authentication in the visible UI.
-- Custom providers are registered, tested, and removed in the Providers UI;
+- An SSH server's models run on this PC's logins by default. A server can use
+  its own instead (Settings → Connection → the server → Model login → Server
+  accounts); its logins are then managed in "Manage server logins" (a
+  subscription login opens in this PC's browser; an API key is stored on the
+  server, in an owner-only private file where it has no keychain, as on
+  Linux). No setup action exists for this. Changing the model login restarts
+  the server's Mixdog and stops its running sessions, so say so before the
+  user confirms. The login key file (Advanced options of the connect dialog,
+  or the server's settings) is also UI-only; it applies to every connection
+  to that server. The connect dialog refuses a different key or folder for a
+  server that is connected already (disconnect first); the server's own
+  settings accept and save a changed key file while connected, and it applies
+  from the next connection.
+- Custom providers are registered, edited (non-secret fields too), tested, and
+  removed in the Providers UI; no setup action exists yet;
   `status providers` with `detail: true` lists them as API rows with `custom: true`.
   Their model list (Nano-GPT included) loads there with up to a 60 s wait; the
   user can skip it and type model ids by hand.
@@ -148,9 +198,11 @@ key's source.
   and recovery. Its narrow status domain exposes installed models and progress;
   the detail dialog lists installed models rather than the download catalog.
 - Forgetting authentication is destructive and requires explicit approval.
-  It removes one OAuth account; a provider with several accounts requires
-  `accountId` from the account list in `status providers` with `detail: true`.
-- `set_provider_account` changes the selected account, paid-credit use after
+  It removes one OAuth account (a provider with several accounts requires
+  `accountId` from the account list in `status providers` with `detail: true`)
+  or an API-key provider's key (no `accountId`).
+- `set_provider_account` changes the selected account, automatic switching
+  when one is exhausted (`auto`), paid-credit use after
   plan limits (`useCredits`), account order (every account id exactly once),
   an account label, or the switching `policy`: `manual` stays on the selected
   account, `limit` switches when it hits a limit, `headroom` starts each new
@@ -159,7 +211,14 @@ key's source.
   happens in the Providers UI.
 - `status developer` lists developer options. An option with a `warning` is
   enabled only after the user explicitly accepts that warning, passed as
-  `riskAccepted:true`; never assume acceptance.
+  `riskAccepted:true`; never assume acceptance. `allowAllActions` ("Allow all
+  actions") can be turned off here, but turning it on is refused even then:
+  only the person turns it on, so `open developer`.
+- `set_quota_auto_resume` is read back as `quotaAutoResume` in `status
+  providers`; turning it off cancels pending resumes.
+- `set_model_preferences` (`hidden`, `favorite`; omitted = unchanged) matches
+  Model management. `list_models` rows show `hidden` / `favorite`; a hidden
+  custom-provider model no longer appears in `list_models`.
 
 ## Profile, session, and Memory
 
@@ -184,7 +243,11 @@ key's source.
   window, e.g. DeepSeek 24h; 1h for Codex/ChatGPT logins); unlimited does not
   disable it.
 - Compaction supports `enabled` and a `compaction` object with either
-  `mainBufferTokens` or `mainBufferPercent`. Changing representation replaces the previous budget.
+  `mainBufferTokens` or `mainBufferPercent` (changing representation replaces
+  the previous budget), `onModelChange` (compact before switching models) and
+  `summaryMode`: `smart`, `maintainer`, or `self` (Conversation model).
+  `status compaction` returns them plus `aiSessionTitles`
+  (`set_ai_session_titles`).
 - If no supported action exposes a requested Memory interval, report it as
   unavailable rather than editing configuration.
 
@@ -209,8 +272,8 @@ markers are read with `status desktop`.
   reasoning effort with a local judge model downloaded in the background.
   Enabling or installing it fails on unsupported machines; `status features`
   reports `supported`, `installing` (judge download running) and `ready`.
-- Visualize is toggle-only through `set_builtin_enabled` (on by default);
-  `install_builtin` does not accept it.
+- Visualize (on by default) and Media generation are toggle-only through
+  `set_builtin_enabled`; `install_builtin` does not accept them.
 - Terminal follows the live Desktop terminal bridge and has no toggle.
 - Environment feature overrides (`MIXDOG_FEATURE_*`) win over these toggles;
   they are diagnostics for headless or benchmark environments, not user
@@ -237,9 +300,13 @@ markers are read with `status desktop`.
   named rule; disabling with `set_hook_rule_enabled` preserves it.
 - Hook rule changes apply to open sessions and their sub-agents on the next
   tool call; no new session or restart is needed.
-- `status media` shows the remembered lane/model per kind. `set_media_default`
-  accepts only a signed-in lane that offers the kind (and the model, when
-  given) in the live media catalog; the media tool's `list` reads that catalog.
+- `status media` returns `pinned` and `remembered` ({image, video} each). The
+  pin is the Settings "Default generator"; the remembered entry is the last-used
+  generator, and the pin wins over it. A generation naming no lane/model uses
+  the pin, else the remembered one. `set_media_default` takes
+  `{kind, lane, model?, accountId?}` and accepts only a signed-in lane that
+  offers the kind (and the model, when given) in the live media catalog; the
+  media tool's `list` reads that catalog. `lane: ""` clears the pin (Auto).
 
 ## Skills, MCP, and plugins
 
@@ -272,10 +339,17 @@ markers are read with `status desktop`.
   `declarationErrors` and `warnings`.
 - `connect_connector` is how to connect a catalog service the user asks for
   ("Slack 연결해 줘"): it leaves a connect card in the conversation whose
-  press runs the browser sign-in (or the key sheet) in Desktop; nothing
-  connects until the user presses it, so tell them to press the card and read
+  press runs the service's sign-in, key sheet or (Gmail: app password only)
+  dialog in Desktop; nothing connects until the user presses it, so tell them to press the card and read
   `status mcp` afterwards. `add_mcp_server` with the service URL is not the
   sign-in flow; never use it for a catalog service.
+- Agent permissions and connector switches change only toward less: `block`
+  or `ask`, a connector off, a tool to `needs_approval`/`disabled`. Anything
+  that lets an agent do more without asking (`allow`, a connector back on, a
+  tool to `auto`) is refused ("make it on the desktop"); `open agents` and let
+  the person do it. Payments and permanent deletes always ask regardless.
+  Connector ids are MCP server names from `read_agent_settings`; a bot's
+  thread changes only its own bot.
 - `enable_plugin_mcp` turns every server the plugin declares back on and
   reconnects them; a disabled plugin stays disabled, and it fails for a plugin
   that declares no MCP servers.
@@ -285,7 +359,9 @@ markers are read with `status desktop`.
 - `status capabilities` lists supported actions and deliberate handoffs.
 - Desktop-only operations require the owning conversation visible in the local
   Desktop app. Never claim a persisted change from merely delivering a request.
-- A display-language change returns `requiresReload`.
+- A display-language change returns `requiresReload`; so does a changed
+  `timeFormat` (already-shown times update after the window reloads, which is
+  never automatic).
 - `set_appearance` also takes `uiFont` / `codeFont` (a family name, `""` =
   built-in; text it lacks falls back to the built-in fonts), skin transparency
   (0–100, defaults outer 20 / main 40; higher shows more of the skin picture):
@@ -293,12 +369,25 @@ markers are read with `status desktop`.
   `skinMainTransparency` (conversation area and its cards), or `skinTransparency`
   to set both; and `colorTheme`
   (an imported theme id from `status appearance` `colorThemes`, or `"builtin"`).
-  All are stored on that Desktop device only. Importing a theme file and
-  choosing a skin or custom picture stay in the UI.
+  Also `timeFormat` (system|12h|24h), `sidePanelPosition` (right|bottom|auto),
+  `uiScale` (0.85–1.2, step 0.05), `codeSize` (10–20), `codeLigatures`
+  (bool) and `chatTextSize` (small|default|large|extra-large). The UI label
+  "Light" is `theme: "white"`.
+  Importing, exporting or removing a theme file and choosing a skin picture
+  or its plate/accent/photo stay in the UI.
+- `set_desktop_settings` `desktop.botOverlay` takes `enabled`, `position`
+  (`pinned` above the message box, `pinnedHere`, `free` in the app window,
+  `onScreen` free on screen), `keepAbove`, `collapsed`, `autoAdvance`,
+  `autoClose` and `scale` (50–200, step 10). Enabling needs the
+  representative bot; `status desktop` returns `botOverlay`. Reset position
+  stays in the UI.
 - A Project removal unregisters it only.
 - Inspect schedules/webhooks before editing. `overwrite:true` updates an
   existing named entry and preserves omitted fields; a new schedule needs
   instructions and exactly one of cron `time` or one-shot `at`.
+- Routine instructions say what to check and report; add a reply format only
+  when the user asks. Never add a "nothing new" line ("say 변동 없음"): a run
+  with nothing to tell stays silent on its own.
 - Attachment contents and webhook signing secrets are not returned by setup.
   Omitted attachments and existing webhook secrets are preserved. A saved
   secret is never shown again: tell the user to open the Webhooks panel, edit