mixdog 1.3.5 → 1.4.1

package/src/runtime/channels/lib/owned-runtime/config-reload.mjs

@@ -1,24 +1,6 @@
-import { loadConfig, createProvider } from '../config.mjs';
+import { loadConfig } from '../config.mjs';
 
-function describeProviderChange(previous, next) {
-  const typeChanged = (next?.name || '') !== (previous?.name || '');
-  const credentialsChanged = !typeChanged && String(next?.token || '') !== String(previous?.token || '');
-  return { typeChanged, changed: typeChanged || credentialsChanged };
-}
-
-export function createConfigReloader({
-  state,
-  getConfig,
-  setConfig,
-  getProvider,
-  setProvider,
-  getBridgeRuntimeConnected,
-  scheduler,
-  statusState,
-  services,
-  stopOwnedRuntime,
-  refreshBridgeOwnershipSafe,
-}) {
+export function createConfigReloader({ state, getConfig, setConfig, getBridgeRuntimeConnected, scheduler, services }) {
   function reloadScheduler() {
     // The scheduler must be RE-ARMED by the reload whenever it is supposed to
     // be running: `restart: false` only destroys the cron/one-shot bindings and
@@ -26,50 +8,13 @@ export function createConfigReloader({
     // startAutomationRuntime() is already past its automationRunning guard, so
     // nobody would call scheduler.start() again and every saved/edited schedule
     // stayed silently disarmed until the daemon restarted.
-    scheduler.reloadConfig(getConfig().nonInteractive ?? [], getConfig().interactive ?? [], {
+    scheduler.reloadConfig(getConfig().schedules ?? [], {
       restart: state.automationRunning || getBridgeRuntimeConnected(),
     });
   }
-  async function swapProvider(nextProvider, typeChanged) {
-    const shouldRestart = getBridgeRuntimeConnected() || state.bridgeRuntimeStarting;
-    if (shouldRestart) await stopOwnedRuntime('provider config changed');
-    // A start in flight when the stop landed was signalled to bail (and
-    // disconnects the OLD provider). Wait for it to FULLY settle before the
-    // fresh start below, or startOwnedRuntime's in-flight guard would drop the
-    // restart and the NEW provider would never connect (lost-restart race).
-    if (state.inFlightStart) {
-      try {
-        await state.inFlightStart;
-      } catch {}
-    }
-    setProvider(nextProvider);
-    // A provider-type change wipes the persisted routing ids; messaging is
-    // retired, so only the status snapshot needs clearing.
-    if (typeChanged) {
-      try {
-        statusState.update((snapshot) => {
-          snapshot.channelId = '';
-          snapshot.transcriptPath = '';
-        });
-      } catch {}
-    }
-    if (shouldRestart) refreshBridgeOwnershipSafe({ restoreBinding: !typeChanged });
-  }
   return async function reloadRuntimeConfig() {
-    const previousProvider = getProvider();
-    // File-watch/tool-triggered reloads bypass the short keychain hit cache:
-    // another process may have just saved or rotated the channel credential.
-    setConfig(await loadConfig({ freshSecrets: true }));
+    setConfig(await loadConfig());
     reloadScheduler();
-    const nextProvider = createProvider(getConfig());
-    const change = describeProviderChange(previousProvider, nextProvider);
-    if (change.changed) {
-      await swapProvider(nextProvider, change.typeChanged);
-    } else if (nextProvider !== previousProvider) {
-      try {
-        await nextProvider.disconnect?.();
-      } catch {}
-    }
     if (getBridgeRuntimeConnected() || state.automationRunning) {
       services.syncWebhookAndEventRuntime({ reload: true });
     } else {

package/src/runtime/channels/lib/owned-runtime/owned-start.mjs

@@ -2,12 +2,8 @@ import { startSnapshotWriter } from '../status-snapshot.mjs';
 import { refreshActiveInstance, releaseOwnedChannelLocks, clearActiveInstance } from '../runtime-paths.mjs';
 import { initAgentProviders } from './automation-start.mjs';
 
-// Tear down the provider THIS start connected plus the owner-side adverts it
-// claimed. Every step is best-effort so a half-open gateway cannot block it.
-async function releaseStartingProvider(startingProvider, instanceId) {
-  try {
-    await startingProvider.disconnect();
-  } catch {}
+// Release the owner-side adverts a start claimed. Every step is best-effort.
+function releaseOwnerAdverts(instanceId) {
   try {
     releaseOwnedChannelLocks(instanceId);
   } catch {}
@@ -16,24 +12,6 @@ async function releaseStartingProvider(startingProvider, instanceId) {
   } catch {}
 }
 
-// Mark a start as in flight and hand back the settle function that clears
-// the marker and wakes anyone awaiting state.inFlightStart.
-function openInFlightStart(state) {
-  let settle;
-  state.bridgeRuntimeStarting = true;
-  state.stopRequested = false;
-  state.inFlightStart = new Promise((resolve) => {
-    settle = resolve;
-  });
-  return () => {
-    state.bridgeRuntimeStarting = false;
-    state.inFlightStart = null;
-    const done = settle;
-    settle = null;
-    done?.();
-  };
-}
-
 // Daemon model: the machine-global service (singleton-owner lock in
 // src/standalone) guarantees exactly one runtime per machine, so this process
 // is the unconditional bridge owner — no seat to claim, no takeover handler,
@@ -41,7 +19,6 @@ function openInFlightStart(state) {
 // metadata advert.
 export function createOwnedStarter({
   state,
-  getProvider,
   getBridgeRuntimeConnected,
   setBridgeRuntimeConnected,
   getChannelBridgeActive,
@@ -50,44 +27,20 @@ export function createOwnedStarter({
   scheduler,
   logOwnership,
   services,
-  startAutomationRuntime,
   notifyRemoteAcquired,
 }) {
-  // Explicit restore path for an already-connected owner. Reserved for
-  // explicit activation/reload recovery: re-binding status on every tick
-  // could move the transcript cursor to EOF, and probing the gateway during
-  // the provider's own reconnect window can reset a healthy reconnect loop.
-  async function selfHealOwnedRuntime(options = {}) {
-    if (options.resetProvider !== true) return;
-    if (state.selfHealing) return;
-    state.selfHealing = true;
-    try {
-      if (typeof getProvider()?._resetClient === 'function') {
-        await getProvider()
-          ._resetClient()
-          .catch((e) => {
-            process.stderr.write(
-              `mixdog: self-heal provider reset failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`
-            );
-          });
-      }
-    } finally {
-      state.selfHealing = false;
-    }
-  }
-  // Re-checked after each post-connect await so a stopOwnedRuntime() landing
+  // Checked after the await in a start so a stopOwnedRuntime() landing
   // mid-start cannot be overridden by the resuming start. Idempotent with the
-  // stop's own teardown: it covers both the pre-connected window (stop could
-  // not disconnect an in-flight provider) and the post-connected one.
-  async function bailIfStopRequested(startingProvider) {
+  // stop's own teardown.
+  function bailIfStopRequested() {
     if (!state.stopRequested) return false;
-    await releaseStartingProvider(startingProvider, instanceId);
+    releaseOwnerAdverts(instanceId);
     setBridgeRuntimeConnected(false);
     state.stopRequested = false;
     return true;
   }
-  // Reconnect after a degraded (automation-only) start must not double-arm
-  // the scheduler/snapshot timers; the webhook/event sync is idempotent.
+  // Activation after an automation-only start must not double-arm the
+  // scheduler/snapshot timers; the webhook/event sync is idempotent.
   function armAutomation() {
     if (!state.automationRunning) {
       scheduler.start();
@@ -96,76 +49,41 @@ export function createOwnedStarter({
     services.syncWebhookAndEventRuntime();
     state.automationRunning = true;
   }
-  // DEGRADED MODE: a messaging connect failure — packaged runtime without
-  // the provider library, bad token, gateway outage — must not take schedules/webhooks
-  // down with it. Sends stay dead (connected=false) but session runs, the
-  // webhook server and the relay tunnel keep working.
-  async function degradeToAutomation() {
-    if (state.stopRequested) return;
-    // Already degraded-started by an earlier attempt; this run was only a
-    // messaging reconnect retry.
-    if (state.automationRunning) return;
-    try {
-      await startAutomationRuntime();
-    } catch (e) {
-      process.stderr.write(`mixdog: degraded automation start failed: ${e instanceof Error ? e.message : String(e)}\n`);
-    }
-  }
-  async function connectAndArm(startingProvider) {
-    // Awaited so callers (and bindingReady) only resolve after the binding is
-    // real; a fire-and-forget connect let bindingReady fire before listeners
-    // were attached.
-    await startingProvider.connect();
-    if (await bailIfStopRequested(startingProvider)) return;
-    try {
-      refreshActiveInstance(instanceId, { providerReady: true });
-    } catch {}
+  async function activateBridge() {
     setBridgeRuntimeConnected(true);
-    // Reached only on a not-connected -> connected transition, so this fires
-    // exactly once per connect across every start path (boot + reload restart
-    // + activate). Notifying post-connect means a connect failure leaves the
-    // parent non-remote instead of remote-with-no-bridge.
+    // Reached only on a not-active -> active transition, so this fires exactly
+    // once per activation across every start path.
     notifyRemoteAcquired();
     await initAgentProviders();
-    if (await bailIfStopRequested(startingProvider)) return;
+    if (bailIfStopRequested()) return;
     armAutomation();
-    process.stderr.write(`mixdog: running with ${getProvider().name} provider\n`);
     logOwnership(`active owner lead=${TERMINAL_LEAD_PID} pid=${process.pid}`);
   }
-  async function startOwnedRuntime(options = {}) {
-    if (getBridgeRuntimeConnected()) {
-      if (!state.bridgeRuntimeStarting) await selfHealOwnedRuntime(options);
-      return;
-    }
+  async function startOwnedRuntime() {
+    if (getBridgeRuntimeConnected()) return;
     if (state.bridgeRuntimeStarting) return;
     if (!getChannelBridgeActive()) return;
-    const settleInFlightStart = openInFlightStart(state);
-    // Capture the provider THIS start connects: a reload hot-swap can replace
-    // the worker's provider while connect() is pending, and using the captured
-    // instance for both connect() and the bail/failure disconnect guarantees
-    // we tear down the one we started (closing the both-providers-live window).
-    const startingProvider = getProvider();
-    try {
-      refreshActiveInstance(instanceId, { providerReady: false });
-    } catch (e) {
-      settleInFlightStart();
-      process.stderr.write(
-        `mixdog: pre-connect metadata advert aborted (${e instanceof Error ? e.message : String(e)})\n`
-      );
-      return;
-    }
+    state.bridgeRuntimeStarting = true;
+    state.stopRequested = false;
     try {
-      await connectAndArm(startingProvider);
-    } catch (e) {
-      process.stderr.write(
-        `mixdog: provider connect failed (non-fatal, cycle1/MCP still up): ${e instanceof Error ? e.message : String(e)}\n`
-      );
-      // Roll back the owner-side state advertised before connect() ran; a
-      // post-connect step may have thrown while the gateway is live.
-      await releaseStartingProvider(startingProvider, instanceId);
-      await degradeToAutomation();
+      try {
+        refreshActiveInstance(instanceId);
+      } catch (e) {
+        process.stderr.write(`mixdog: metadata advert aborted (${e instanceof Error ? e.message : String(e)})\n`);
+        return;
+      }
+      try {
+        await activateBridge();
+      } catch (e) {
+        process.stderr.write(
+          `mixdog: bridge start failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`
+        );
+        // Roll back the owner-side state advertised before the start.
+        releaseOwnerAdverts(instanceId);
+        setBridgeRuntimeConnected(false);
+      }
     } finally {
-      settleInFlightStart();
+      state.bridgeRuntimeStarting = false;
     }
   }
   return { startOwnedRuntime };

package/src/runtime/channels/lib/owned-runtime/owned-stop.mjs

@@ -3,7 +3,6 @@ import { releaseOwnedChannelLocks, clearActiveInstance } from '../runtime-paths.
 
 export function createOwnedStopper({
   state,
-  getProvider,
   getBridgeRuntimeConnected,
   setBridgeRuntimeConnected,
   instanceId,
@@ -11,19 +10,9 @@ export function createOwnedStopper({
   logOwnership,
   services,
 }) {
-  // Only disconnect when connect() actually completed; disconnecting
-  // mid-connect races the connect promise. In-flight outbound sends are
-  // drained first (bounded inside drainPendingSends) so a handoff never cuts
-  // off a reply mid-delivery.
-  async function disconnectConnectedProvider() {
-    try {
-      await getProvider().drainPendingSends?.();
-    } catch {}
-    await getProvider().disconnect();
-  }
   return async function stopOwnedRuntime(reason) {
     // A start advertises owner metadata and claims channel locks before
-    // awaiting connect(); a stop landing in that window (starting=true,
+    // it finishes; a stop landing in that window (starting=true,
     // connected=false) still has partial state to tear down.
     if (
       !getBridgeRuntimeConnected() &&
@@ -33,27 +22,21 @@ export function createOwnedStopper({
     ) {
       return;
     }
-    // Signal an in-flight start to abort right after its connect() resolves;
-    // otherwise it would re-mark connected and re-launch scheduler/webhook
-    // after the teardown below.
+    // Signal an in-flight start to abort at its next checkpoint; otherwise it
+    // would re-launch scheduler/webhook after the teardown below.
     if (state.bridgeRuntimeStarting || state.automationStartPromise) state.stopRequested = true;
     if (state.automationStartPromise) {
       try {
         await state.automationStartPromise;
       } catch {}
     }
-    const wasConnected = getBridgeRuntimeConnected();
     scheduler.stop();
     stopSnapshotWriter();
     await services.stopWebhookAndEventRuntime();
     state.automationRunning = false;
     releaseOwnedChannelLocks(instanceId);
     clearActiveInstance(instanceId);
-    try {
-      if (wasConnected) await disconnectConnectedProvider();
-    } finally {
-      setBridgeRuntimeConnected(false);
-      logOwnership(`standby: ${reason}`);
-    }
+    setBridgeRuntimeConnected(false);
+    logOwnership(`standby: ${reason}`);
   };
 }

package/src/runtime/channels/lib/owned-runtime/state.mjs

@@ -8,15 +8,9 @@ export function createOwnedRuntimeState() {
     // stopOwnedRuntime() landed while an owned or automation start was in
     // flight; the in-flight run bails at its next checkpoint.
     stopRequested: false,
-    // Resolves when the current startOwnedRuntime() run fully settles, so a
-    // reload can wait before issuing a restart (lost-restart race).
-    inFlightStart: null,
-    // Automation (scheduler + webhook server + relay tunnel) can outlive a
-    // failed/absent messaging provider; tracked apart from the connect flag.
+    // Automation (scheduler + webhook server + relay tunnel) can run without
+    // the bridge being active; tracked apart from the bridge-connected flag.
     automationRunning: false,
     automationStartPromise: null,
-    // Coalesces concurrent refreshBridgeOwnership() callers.
-    refreshInFlight: null,
-    selfHealing: false,
   };
 }

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -1,15 +1,13 @@
-// Owned-runtime lifecycle: provider connect/disconnect, automation runtime
-// (scheduler + webhook/event runtime), ownership refresh and config
-// hot-reload. The phases live under owned-runtime/ and share one explicit
-// state object; config / provider / bridgeRuntimeConnected / webhookServer /
-// eventPipeline stay on the worker (get/set) so file-level reference
-// semantics are preserved.
+// Owned-runtime lifecycle: bridge activation, automation runtime (scheduler +
+// webhook/event runtime) and config hot-reload. The phases live under
+// owned-runtime/ and share one explicit state object; config /
+// bridgeRuntimeConnected / webhookServer / eventPipeline stay on the worker
+// (get/set) so file-level reference semantics are preserved.
 import { createOwnedRuntimeState } from './owned-runtime/state.mjs';
 import { createAutomationServices } from './owned-runtime/automation-services.mjs';
 import { createAutomationStarter } from './owned-runtime/automation-start.mjs';
 import { createOwnedStarter } from './owned-runtime/owned-start.mjs';
 import { createOwnedStopper } from './owned-runtime/owned-stop.mjs';
-import { createOwnershipRefresh } from './owned-runtime/ownership-refresh.mjs';
 import { createConfigReloader } from './owned-runtime/config-reload.mjs';
 
 export function createOwnedRuntime(deps) {
@@ -26,29 +24,14 @@ export function createOwnedRuntime(deps) {
     ...deps,
     state,
     services,
-    startAutomationRuntime,
     notifyRemoteAcquired,
   });
   const stopOwnedRuntime = createOwnedStopper({ ...deps, state, services });
-  const { refreshBridgeOwnership, refreshBridgeOwnershipSafe } = createOwnershipRefresh({
-    ...deps,
-    state,
-    startOwnedRuntime,
-    stopOwnedRuntime,
-  });
-  const reloadRuntimeConfig = createConfigReloader({
-    ...deps,
-    state,
-    services,
-    stopOwnedRuntime,
-    refreshBridgeOwnershipSafe,
-  });
+  const reloadRuntimeConfig = createConfigReloader({ ...deps, state, services });
   return {
     startAutomationRuntime,
     startOwnedRuntime,
     stopOwnedRuntime,
-    refreshBridgeOwnership,
-    refreshBridgeOwnershipSafe,
     reloadRuntimeConfig,
     notifyRemoteAcquired,
   };

package/src/runtime/channels/lib/parent-bridge.mjs

@@ -28,8 +28,8 @@ function setChannelNotifySink(fn) {
 function createParentBridge({ getInstanceId, ipcProcess = process }) {
   function sendNotifyToParent(method, params) {
     // The channel schema requires meta: Record<string,string>.
-    // Coerce every meta value to string so a non-string (e.g. a Discord
-    // interaction.type number) can't fail zod and silently drop the notify.
+    // Coerce every meta value to string so a non-string (e.g. a numeric
+    // meta field) can't fail zod and silently drop the notify.
     // silent_to_agent stays boolean — an internal routing flag the daemon
     // router / agentNotify consume (=== true) before the zod boundary.
     const outParams = normalizeChannelNotifyParams(method, params);

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -81,9 +81,9 @@ function activeInstanceStaleReason(state) {
   // NOTE: ownership is no longer decided here — the machine-global channels
   // daemon (singleton-owner lock in src/standalone) is the authority. This
   // PID-death check only marks a metadata advert whose owning process is gone so
-  // refreshActiveInstance can avoid preserving its owner fields. The former
-  // ui_heartbeat_at staleness branch was removed: its false-stale eviction was
-  // the Discord-flapping root cause.
+  // refreshActiveInstance can avoid preserving its owner fields. There is no
+  // ui_heartbeat_at staleness branch: its false-stale eviction wrongly dropped
+  // live owners.
   return null;
 }
 function buildRuntimeIdentity() {
@@ -126,11 +126,8 @@ function readActiveInstance() {
 /** Caller-supplied advert fields, in the order every writer publishes them. */
 function metaFields(meta) {
   return {
-    ...(meta?.channelId ? { channelId: meta.channelId } : {}),
     ...(meta?.transcriptPath ? { transcriptPath: meta.transcriptPath } : {}),
     ...(meta?.httpPort ? { httpPort: meta.httpPort } : {}),
-    ...Object.fromEntries(Object.entries(meta || {}).filter(([k]) => k.startsWith('gateway_'))),
-    ...(typeof meta?.providerReady === 'boolean' ? { providerReady: meta.providerReady } : {}),
   };
 }
 function buildActiveInstanceState(instanceId, meta) {
@@ -143,41 +140,6 @@ function buildActiveInstanceState(instanceId, meta) {
     ...metaFields(meta),
   };
 }
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return !(e && e.code === 'ESRCH');
-  }
-}
-// gateway_* fields are preserved while the gateway owner is alive: the gateway
-// child advertises itself independently, and active-owner heartbeats must not
-// erase that discovery record while its owning server-main process is still
-// alive. Writes into `preservedExtra` (and clears from `next`).
-function preserveGatewayFields(prev, meta, identity, preservedExtra, next) {
-  const prevGatewayServerPid = parsePositivePid(prev?.gateway_server_pid);
-  const prevGatewayOwnerAlive = prevGatewayServerPid !== null && isProcessAlive(prevGatewayServerPid);
-  const sameGatewayAdvertiser =
-    prevGatewayServerPid !== null && identity.server_pid !== null && prevGatewayServerPid === identity.server_pid;
-  if (!(sameGatewayAdvertiser || prevGatewayOwnerAlive)) return;
-  if (!prev || !Object.hasOwn(prev, 'gateway_port')) return;
-  for (const [key, value] of Object.entries(prev)) {
-    if (key.startsWith('gateway_')) preservedExtra[key] = value;
-  }
-  preservedExtra.gateway_server_pid = prevGatewayServerPid;
-  // Clear session-scoped gateway metrics when the transcript changes — a new
-  // session must not inherit the previous session's context usage before the
-  // gateway re-advertises.
-  const nonEmptyString = (value) => (typeof value === 'string' && value ? value : null);
-  const metricTranscript = nonEmptyString(prev.gateway_transcript_path) ?? nonEmptyString(prev.transcriptPath);
-  if (typeof meta?.transcriptPath === 'string' && meta.transcriptPath && metricTranscript !== meta.transcriptPath) {
-    delete preservedExtra.gateway_context_used_pct;
-    delete preservedExtra.gateway_last_usage;
-    delete next.gateway_context_used_pct;
-    delete next.gateway_last_usage;
-  }
-}
 function refreshActiveInstance(instanceId, meta, options) {
   ensureRuntimeDirs();
   // Periodic refresh/heartbeat callers pass options.timeoutMs:0 (try-once) so
@@ -237,7 +199,6 @@ function refreshActiveInstance(instanceId, meta, options) {
       const preservedExtra = Object.fromEntries(
         Object.entries(prevForPreserve ?? {}).filter(([k]) => k.startsWith('pg_'))
       );
-      preserveGatewayFields(prevForPreserve, meta, identity, preservedExtra, next);
       return { ...preservedExtra, ...next };
     },
     writeOpts
@@ -354,7 +315,7 @@ function cleanupInstanceRuntimeFiles(instanceId) {
   for (const target of targets) {
     removeFileIfExists(target);
   }
-  // Remove artifacts left by pre-standalone Discord approval builds.
+  // Remove per-instance permission artifacts left by pre-standalone builds.
   forEachFile(RUNTIME_ROOT, (fullPath, file) => {
     if (file.startsWith(`perm-${sanitize(instanceId)}-`)) {
       removeFileIfExists(fullPath);