mixdog 1.4.0 → 1.4.2

package/scripts/lib/scoped-temp.mjs

@@ -0,0 +1,124 @@
+// Scoped scratch directories for tests: every directory this module creates is
+// named `mixdog-<prefix>-*` in the system temp dir and is removed whether the
+// test passed or failed. Removal retries a bounded number of times, because on
+// Windows a just-closed file or a just-exited child can hold a path for a
+// moment (EBUSY / EPERM / ENOTEMPTY).
+//
+// Pick the narrowest scope that fits the test:
+//   tempDirFor(t, prefix)            removed after the node:test context `t`
+//   scopedTempDir(prefix)            `.path` + dispose; use `await using` on
+//                                    Node 24+, or `try { } finally { await d.remove() }`
+//   withTempDir(prefix, fn)          removed when `fn` settles
+//   makeTempDirSync(prefix)          removed by removeTempDirSync, and always swept at
+//                                    process exit (a late write may recreate it)
+// Close anything holding files inside the directory (sqlite handles, servers,
+// child processes) before the removal runs.
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join, resolve } from 'node:path';
+import { removeTempDirSync as removeDirWithRetrySync } from './stale-temp.mjs';
+
+const live = new Set();
+let exitHookInstalled = false;
+
+function directoryPrefix(prefix) {
+  const bare = String(prefix)
+    .replace(/^mixdog-/, '')
+    .replace(/-+$/, '');
+  return `mixdog-${bare}-`;
+}
+
+function removeAllAtExit() {
+  for (const dir of live) removeDirWithRetrySync(dir);
+}
+
+function installExitHook() {
+  if (exitHookInstalled) return;
+  exitHookInstalled = true;
+  process.on('exit', removeAllAtExit);
+  // A module under test may add its own exit handler (a final flush can
+  // recreate its directory), so keep this one the last to run.
+  process.on('newListener', (event, listener) => {
+    if (event !== 'exit' || listener === removeAllAtExit) return;
+    queueMicrotask(() => {
+      process.removeListener('exit', removeAllAtExit);
+      process.on('exit', removeAllAtExit);
+    });
+  });
+}
+
+/** Creates `mixdog-<prefix>-*` in the system temp dir; removed at process exit unless removed sooner. */
+export function makeTempDirSync(prefix) {
+  const dir = mkdtempSync(join(tmpdir(), directoryPrefix(prefix)));
+  live.add(dir);
+  installExitHook();
+  return dir;
+}
+
+/**
+ * Registers a directory its creator made as test-owned, so it is swept again
+ * as the last exit step (a late write by the code under test can recreate it
+ * after the creator's own exit handler ran). Only an exact `mixdog-*` child of
+ * the system temp dir is accepted; nothing is ever inferred from an env var.
+ */
+export function registerOwnedTempDir(dir) {
+  const resolved = resolve(dir);
+  const same = (a, b) => (process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b);
+  if (!basename(resolved).startsWith('mixdog-') || !same(dirname(resolved), resolve(tmpdir()))) {
+    throw new Error(`refusing to own a directory outside the system temp root: ${dir}`);
+  }
+  live.add(resolved);
+  installExitHook();
+  return resolved;
+}
+
+/**
+ * For code under test that makes its own mixdog-* directories in the system
+ * temp dir: points TEMP/TMP/TMPDIR at one scoped directory for the rest of the
+ * process, so everything created there is removed with it at exit.
+ */
+export function redirectSystemTemp(prefix = 'temp-root') {
+  const dir = makeTempDirSync(prefix);
+  process.env.TEMP = dir;
+  process.env.TMP = dir;
+  process.env.TMPDIR = dir;
+  return dir;
+}
+
+export function removeTempDirSync(dir) {
+  if (!removeDirWithRetrySync(dir)) process.stderr.write(`scratch folder ${dir} could not be removed\n`);
+}
+
+export async function removeTempDir(dir) {
+  removeTempDirSync(dir);
+}
+
+/** A directory removed after the node:test context (test or suite) `t` finishes, pass or fail. */
+export function tempDirFor(t, prefix) {
+  const dir = makeTempDirSync(prefix);
+  t.after(() => removeTempDir(dir));
+  return dir;
+}
+
+/** A directory with `.path`, `join()` and `remove()`; also `await using` / `using` disposable. */
+export function scopedTempDir(prefix) {
+  const path = makeTempDirSync(prefix);
+  return {
+    path,
+    join: (...parts) => join(path, ...parts),
+    remove: () => removeTempDir(path),
+    removeSync: () => removeTempDirSync(path),
+    [Symbol.asyncDispose]: () => removeTempDir(path),
+    [Symbol.dispose]: () => removeTempDirSync(path),
+  };
+}
+
+/** Runs `fn(dir)` with a fresh directory and removes it when `fn` settles. */
+export async function withTempDir(prefix, fn) {
+  const dir = makeTempDirSync(prefix);
+  try {
+    return await fn(dir);
+  } finally {
+    await removeTempDir(dir);
+  }
+}

package/scripts/lib/stale-temp.mjs

@@ -0,0 +1,44 @@
+// Temp dirs a test run or the local gate owns. A normal exit removes them, but
+// a killed process runs no exit handler, so each run starts by sweeping what an
+// earlier killed run left behind.
+import { lstatSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// How long a kept test log stays readable; also what counts as a leftover.
+export const STALE_TEMP_MS = 3 * 24 * 60 * 60 * 1000;
+
+// rmSync retries the lock errors itself (EBUSY, EPERM, ENOTEMPTY, ...) a
+// bounded number of times per entry before it throws. Returns whether the
+// directory is gone; a held file leaves it for the next start-of-run sweep.
+export function removeTempDirSync(dir) {
+  try {
+    rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Removes every directory in `root` whose name starts with one of `prefixes`
+// and whose mtime is older than `maxAgeMs`.
+export function pruneStaleTempDirs(prefixes, { root = tmpdir(), maxAgeMs = STALE_TEMP_MS, now = Date.now() } = {}) {
+  let names = [];
+  try {
+    names = readdirSync(root);
+  } catch {
+    return;
+  }
+  const cutoff = now - maxAgeMs;
+  for (const name of names) {
+    if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;
+    const path = join(root, name);
+    try {
+      // lstat: a link or a plain file that merely matches the prefix is not ours to remove.
+      const info = lstatSync(path);
+      if (info.isDirectory() && info.mtimeMs < cutoff) removeTempDirSync(path);
+    } catch {
+      /* another run may own or be removing it */
+    }
+  }
+}

package/scripts/lib/test-failure-records.mjs

@@ -36,7 +36,20 @@ export function failureRecord(event, stacks) {
   if (event.data.todo) return null;
   if (event.data.details?.error?.failureType === 'subtestsFailed') return null;
   const ancestors = (stacks.get(file) ?? []).slice(0, event.data.nesting);
-  return { file, name: [...ancestors, event.data.name].join(' > ') };
+  const exit = processExit(event.data.details?.error);
+  return { file, name: [...ancestors, event.data.name].join(' > '), ...(exit ? { exit } : {}) };
+}
+
+// A test file whose process ended badly fails with only "test failed"; node
+// keeps how it ended on the error. A Windows NTSTATUS code (e.g. 0xC0000142,
+// the process could not initialise) reads better in hex.
+export function processExit(error) {
+  if (error?.failureType !== 'testCodeFailure') return '';
+  if (error.signal) return `test process killed by ${error.signal}`;
+  const code = error.exitCode;
+  if (!Number.isInteger(code) || code === 0) return '';
+  const hex = code > 255 || code < 0 ? ` (0x${(code >>> 0).toString(16).toUpperCase().padStart(8, '0')})` : '';
+  return `test process exited with code ${code}${hex}`;
 }
 
 // The runner sets FAILURE_RECORDS_ENV to a per-spawn JSONL path. Without it

package/scripts/lib/test-failure-summary.mjs

@@ -46,19 +46,31 @@ export function policyLine(rerunFailed) {
 // `hung` holds one "hung after N min: <files>" message per batch the runner's
 // watchdog killed; such a batch fails the run whatever its tests reported.
 // A non-zero `exitCode` with no failed test, flaky test or hung batch behind it
-// (a bad node flag, a crashed runner) is its own failure, never "0 failed".
-export function formatFailureSummary({ failed = [], flaky = [], rerunFailed = 0, hung = [], exitCode = 0 }) {
+// (a bad node flag, a crashed runner, a kill from outside) is its own failure,
+// never "0 failed". `pids` names the node --test processes that exited
+// non-zero, so a kill can be matched to the "Killing ... <pid>" line of
+// whatever killed them.
+export function formatFailureSummary({
+  failed = [],
+  flaky = [],
+  rerunFailed = 0,
+  hung = [],
+  exitCode = 0,
+  pids = [],
+}) {
   const hungCount = hung.length > 0 ? `, ${hung.length} hung batch(es)` : '';
   const unexplained = exitCode !== 0 && failed.length === 0 && hung.length === 0;
+  const runner = pids.length > 0 ? `node --test pid ${pids.join(' ')}: ` : '';
   const lines = [
     unexplained
-      ? `${SUMMARY_TAG} RUN FAILED: exit code ${exitCode} with no failed test recorded (bad argument or runner error; see output above)`
+      ? `${SUMMARY_TAG} RUN FAILED: exit code ${exitCode} with no failed test recorded (${runner}bad argument, runner error or killed from outside; see output above)`
       : `${SUMMARY_TAG} ${failed.length} failed, ${flaky.length} flaky${hungCount} (every failed test is named below)`,
   ];
   for (const message of hung) lines.push(`${SUMMARY_TAG} HUNG ${message}`);
   for (const record of failed) {
     const origin = record.firstSeenOnRerun ? ` (first seen on re-run ${record.firstSeenOnRerun})` : '';
-    lines.push(`${SUMMARY_TAG} FAILED ${record.file} > ${record.name}${origin}`);
+    const exit = record.exit ? ` (${record.exit})` : '';
+    lines.push(`${SUMMARY_TAG} FAILED ${record.file} > ${record.name}${exit}${origin}`);
   }
   for (const record of flaky) {
     lines.push(

package/scripts/lib/test-spawn-ledger.mjs

@@ -1,5 +1,5 @@
 // Preloaded (--import) into every test process the runner starts: records
-// "<pid> <spawn time ms>" for each child process, so a process a test leaves
+// each child process's pid, spawn time and exit, so a process a test leaves
 // running can be traced back to the run after its parent exited
 // (scripts/lib/run-node-tests.mjs). Without the runner's environment it does
 // nothing.
@@ -54,11 +54,20 @@ if (
 
 const ledger = spawnLedgerPath(process.env[FAILURE_RECORDS_ENV]);
 if (ledger) {
-  // spawn, exec, execFile and fork all start their process here.
+  // spawn, exec, execFile and fork all start their process here. A spawn is
+  // "<pid> <before> <since>", the clock just before and just after it; the
+  // same line plus "<exited>" follows once its exit is seen. The 'exit' event
+  // comes before the child's handle is closed, so the pid is still this
+  // child's when the exit is written: from then on another process may hold it.
   const spawn = ChildProcess.prototype.spawn;
   ChildProcess.prototype.spawn = function recordedSpawn(...args) {
+    const before = Date.now();
     const result = spawn.apply(this, args);
-    if (this.pid) appendFileSync(ledger, `${this.pid} ${Date.now()}\n`);
+    if (this.pid) {
+      const spawned = `${this.pid} ${before} ${Date.now()}`;
+      appendFileSync(ledger, `${spawned}\n`);
+      this.once('exit', () => appendFileSync(ledger, `${spawned} ${Date.now()}\n`));
+    }
     return result;
   };
 }

package/scripts/post-release-check.mjs

@@ -215,12 +215,7 @@ export function getReleaseByTag(repo, tag, run = gh) {
  * rethrown, so an API outage fails the job instead of silently skipping
  * verification of a release that may be public.
  */
-export async function detectPublished({
-  fetchRelease,
-  sleep = defaultSleep,
-  attempts = 5,
-  firstDelayMs = 2000,
-}) {
+export async function detectPublished({ fetchRelease, sleep = defaultSleep, attempts = 5, firstDelayMs = 2000 }) {
   let delay = firstDelayMs;
   for (let attempt = 1; ; attempt++) {
     try {

package/scripts/pptx-kit-index.mjs

@@ -21,8 +21,11 @@ const SOURCES = [
 // A statement this short says its whole meaning (a constant, a one-line arrow); a longer one gives its first line.
 const WHOLE_STATEMENT = 240;
 
-const propertyName = (property) =>
-  property.type === 'Property' ? String(property.key.name ?? property.key.value ?? '') : property.type === 'SpreadElement' ? '…' : '';
+function propertyName(property) {
+  if (property.type === 'Property') return String(property.key.name ?? property.key.value ?? '');
+  if (property.type === 'SpreadElement') return '…';
+  return '';
+}
 
 // The keys an object literal offers a script, one level into object-valued keys ("body: { x, y, w, h }"). A table of
 // like entries (STYLES: an id per style, each with the same fields) reads as its ids and the fields each carries.
@@ -30,7 +33,9 @@ function objectShape(node) {
   const properties = node.properties.filter((property) => propertyName(property));
   const nested = properties.filter((property) => property.value?.type === 'ObjectExpression');
   if (properties.length >= 4 && nested.length === properties.length) {
-    const fields = [...new Set(nested.flatMap((property) => property.value.properties.map(propertyName)))].filter(Boolean);
+    const fields = [...new Set(nested.flatMap((property) => property.value.properties.map(propertyName)))].filter(
+      Boolean
+    );
     return `{ ${properties.map(propertyName).join(', ')} } each { ${fields.join(', ')} }`;
   }
   const keys = properties.map((property) =>
@@ -48,7 +53,8 @@ function returnedShape(fn) {
   const visit = (node) => {
     if (!node || typeof node.type !== 'string') return;
     if (node !== fn.body && /Function/.test(node.type)) return;
-    if (node.type === 'ReturnStatement' && node.argument?.type === 'ObjectExpression') shapes.push(objectShape(node.argument));
+    if (node.type === 'ReturnStatement' && node.argument?.type === 'ObjectExpression')
+      shapes.push(objectShape(node.argument));
     for (const value of Object.values(node)) {
       if (Array.isArray(value)) value.forEach(visit);
       else if (value && typeof value === 'object' && typeof value.type === 'string') visit(value);
@@ -116,7 +122,13 @@ function summarizeFile({ file, prose }) {
       output.push('```js', summarizeCode(part).trimEnd(), '```');
       return;
     }
-    const kept = prose === 'all' ? part.trim() : part.split('\n').filter((line) => /^#{1,3} /.test(line)).join('\n');
+    const kept =
+      prose === 'all'
+        ? part.trim()
+        : part
+            .split('\n')
+            .filter((line) => /^#{1,3} /.test(line))
+            .join('\n');
     if (kept) output.push(kept.replace(/^# /m, '## '));
   });
   return [`# ${file}`, ...output].join('\n\n');

package/scripts/suite-health.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 // Weekly opt-out sweep: run every test:*/smoke:* npm script in the repository
-// so no locally-registered suite can rot silently (docs/testing.md, "A
-// contract suite runs in CI or it drifts"). New scripts join automatically;
+// so no locally-registered suite can rot silently (docs/testing.md, "CI coverage"). New scripts join automatically;
 // exclusions are explicit, reasoned, and fail closed when they go stale.
 import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -36,13 +35,9 @@ export const WORKSPACES = [
       'test:daemon:e2e': 'needs the built daemon; the release gate desktop job owns it',
       'test:spec-advisory': 'advisory by design (MIXDOG_TEST_ADVISORY)',
       'test:browser-host:integration': 'live desktop integration harness',
-      'test:browser-login-persistence:integration':
-        'live desktop integration harness; launches real Electron, which needs a display the Linux sweep runner lacks',
-      'test:browser-login-popup:integration':
-        'live desktop integration harness; launches real Electron, which needs a display the Linux sweep runner lacks',
       'test:browser-profile-import:integration': 'live desktop integration harness',
       'test:remote-webrtc-sender:integration':
-        'live desktop integration harness; launches real Electron, which needs a display the Linux sweep runner lacks',
+        'live desktop integration harness; launches real Electron and has never run in the sweep, so it stays out until verified under Xvfb',
       'test:computer-host:integration': 'live desktop integration harness',
       'test:computer-host:scenarios': 'live desktop scenario harness',
       'test:computer-host:repeats': 'live desktop scenario harness',
@@ -50,6 +45,32 @@ export const WORKSPACES = [
   },
 ];
 
+// Swept scripts that launch a real Electron window. The headless Linux runner
+// has no X server, so they run inside a virtual one (xvfb-run, as
+// linux-desktop-verify.yml does). The runner also has no usable keyring (a
+// keyring daemon there prompts for an unlock on a display it cannot open and
+// stalls the entry), and these entries check Mixdog's own persistence and
+// sign-out logic, not the OS keychain. So on Linux the sweep sets
+// TEST_PLAINTEXT_SAFE_STORAGE_ENV and the test harness alone (never the app)
+// switches Electron's safeStorage to its in-memory-password fallback.
+export const DISPLAY_SUITES = ['test:browser-login-persistence:integration', 'test:browser-login-popup:integration'];
+export const TEST_PLAINTEXT_SAFE_STORAGE_ENV = 'MIXDOG_TEST_PLAINTEXT_SAFE_STORAGE';
+
+const runsUnderDisplay = (ws, name, platform) =>
+  platform === 'linux' && ws.dir !== '.' && DISPLAY_SUITES.includes(name);
+
+export function sweepCommand(ws, name, platform = process.platform) {
+  const args = ['run', name, ...(ws.dir === '.' ? [] : ['--prefix', ws.dir])];
+  if (runsUnderDisplay(ws, name, platform)) {
+    return ['xvfb-run', ['-a', '--server-args=-screen 0 1440x900x24', 'npm', ...args]];
+  }
+  return [platform === 'win32' ? 'npm.cmd' : 'npm', args];
+}
+
+export function sweepEnv(ws, name, platform = process.platform, base = process.env) {
+  return runsUnderDisplay(ws, name, platform) ? { ...base, [TEST_PLAINTEXT_SAFE_STORAGE_ENV]: '1' } : base;
+}
+
 export function selectSuiteScripts(scripts, exclusions) {
   const names = Object.keys(scripts).filter((name) => /^(test|smoke)(:|$)/.test(name));
   const stale = Object.keys(exclusions).filter((name) => !names.includes(name));
@@ -59,6 +80,81 @@ export function selectSuiteScripts(scripts, exclusions) {
   return names.filter((name) => !(name in exclusions));
 }
 
+const TAIL_LINES = 25;
+const lastLines = (text, name) => {
+  const lines = String(text || '')
+    .trim()
+    .split('\n');
+  if (lines.length <= TAIL_LINES) return lines.join('\n');
+  return [`[${name} truncated: last ${TAIL_LINES} of ${lines.length} lines]`, ...lines.slice(-TAIL_LINES)].join('\n');
+};
+
+// What a failed entry shows in the report: how it ended, every failure-summary
+// and failed-test line from either stream (a long stderr must not hide them),
+// then each stream's tail.
+export function failureParts({ stdout, stderr, status, signal, error }) {
+  const failedLines = `${stdout || ''}\n${stderr || ''}`
+    .split('\n')
+    .filter((line) => /^\[failure-summary\]|^\s*✖ /.test(line));
+  const ended = error
+    ? `spawn error: ${error.message}`
+    : `exit ${status ?? 'none'}${signal ? `, signal ${signal}` : ''}`;
+  const tails = [lastLines(stdout, 'stdout'), lastLines(stderr, 'stderr')].filter(Boolean).join('\n');
+  return { ended, failedLines, tails };
+}
+
+const failureText = ({ ended, failedLines, tails }) =>
+  [ended, failedLines.join('\n'), tails].filter(Boolean).join('\n').trim();
+
+export const failureTail = (child) => failureText(failureParts(child));
+
+// GitHub rejects an issue body over 65,536 characters (HTTP 422). Past the
+// limit the tails go first, then failure lines from the end; the omission is
+// always stated, and the full diagnostics stay in the workflow log.
+const ISSUE_BODY_LIMIT = 60_000;
+
+export function buildReport({ checked, runUrl, reportLines, failures, limit = ISSUE_BODY_LIMIT }) {
+  const render = (withTails, keep) => {
+    let left = keep;
+    let omitted = 0;
+    const blocks = failures.map(({ title, parts }) => {
+      const shown = parts.failedLines.slice(0, left);
+      left -= shown.length;
+      omitted += parts.failedLines.length - shown.length;
+      const text = failureText({ ...parts, failedLines: shown, tails: withTails ? parts.tails : '' });
+      return `${title}\n\n\`\`\`\n${text}\n\`\`\``;
+    });
+    const notes = [];
+    if (!withTails) notes.push('Stdout/stderr tails omitted to fit the issue size limit; see the workflow log.');
+    if (omitted) notes.push(`${omitted} more failure lines omitted — see the workflow log: ${runUrl}`);
+    return [
+      '# Weekly suite health sweep failed',
+      '',
+      `Checked: ${checked}`,
+      `Workflow run: ${runUrl}`,
+      '',
+      ...reportLines,
+      '',
+      ...blocks,
+      '',
+      ...notes,
+    ]
+      .join('\n')
+      .trimEnd()
+      .concat('\n');
+  };
+  const total = failures.reduce((sum, { parts }) => sum + parts.failedLines.length, 0);
+  if (render(true, total).length <= limit) return render(true, total);
+  let low = 0;
+  let high = total;
+  while (low < high) {
+    const mid = Math.ceil((low + high) / 2);
+    if (render(false, mid).length <= limit) low = mid;
+    else high = mid - 1;
+  }
+  return render(false, low);
+}
+
 function runSweep() {
   const failures = [];
   const reportLines = [];
@@ -68,8 +164,9 @@ function runSweep() {
     for (const name of names) {
       const label = ws.dir === '.' ? name : `${ws.dir} ${name}`;
       const started = Date.now();
-      const args = ['run', name, ...(ws.dir === '.' ? [] : ['--prefix', ws.dir])];
-      const child = spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, {
+      const [command, args] = sweepCommand(ws, name);
+      const child = spawnSync(command, args, {
+        env: sweepEnv(ws, name),
         encoding: 'utf8',
         shell: process.platform === 'win32',
         maxBuffer: 64 * 1024 * 1024,
@@ -79,10 +176,12 @@ function runSweep() {
         reportLines.push(`- ${label}: OK (${seconds}s)`);
         console.log(`${label}: OK (${seconds}s)`);
       } else {
-        const tail = `${child.stdout || ''}\n${child.stderr || ''}`.trim().split('\n').slice(-25).join('\n');
-        failures.push(`- ${label}: FAILED (${seconds}s)\n\n\`\`\`\n${tail}\n\`\`\``);
+        // Tail each stream on its own: a long stderr (cargo build chatter) must
+        // not push the test failure summary on stdout out of the report.
+        const parts = failureParts(child);
+        failures.push({ title: `- ${label}: FAILED (${seconds}s)`, parts });
         reportLines.push(`- ${label}: FAILED (${seconds}s)`);
-        console.error(`${label}: FAILED (${seconds}s)\n${tail}`);
+        console.error(`${label}: FAILED (${seconds}s)\n${failureText(parts)}`);
       }
     }
   }
@@ -91,18 +190,10 @@ function runSweep() {
     const runUrl = process.env.GITHUB_RUN_ID
       ? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
       : '(local run)';
-    const report = [
-      '# Weekly suite health sweep failed',
-      '',
-      `Checked: ${new Date().toISOString()}`,
-      `Workflow run: ${runUrl}`,
-      '',
-      ...reportLines,
-      '',
-      ...failures,
-      '',
-    ].join('\n');
-    writeFileSync('suite-health-report.md', report);
+    writeFileSync(
+      'suite-health-report.md',
+      buildReport({ checked: new Date().toISOString(), runUrl, reportLines, failures })
+    );
     process.exitCode = 1;
   }
 }

package/scripts/test-data-dir.mjs

@@ -1,19 +1,22 @@
 // Side-effect module: import FIRST in tests that touch the read-snapshot store.
 // Points the Mixdog data dir at a per-run temp dir before snapshot-store.mjs
 // resolves SNAPSHOT_DIR at module load, so tests never write to the real one.
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { registerOwnedTempDir } from './lib/scoped-temp.mjs';
+import { pruneStaleTempDirs, removeTempDirSync } from './lib/stale-temp.mjs';
 
 if (!process.env.MIXDOG_TEST_DATA_DIR_OWNED) {
-  const dir = mkdtempSync(join(tmpdir(), 'mixdog-test-data-'));
+  // The exit handler never runs for a killed process, so each start sweeps
+  // what earlier killed processes left.
+  const prefix = 'mixdog-test-data-';
+  pruneStaleTempDirs([prefix]);
+  const dir = mkdtempSync(join(tmpdir(), prefix));
+  registerOwnedTempDir(dir);
   process.env.MIXDOG_DATA_DIR = dir;
   process.env.MIXDOG_TEST_DATA_DIR_OWNED = '1';
   process.on('exit', () => {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* best effort */
-    }
+    removeTempDirSync(dir);
   });
 }

package/scripts/test.mjs

@@ -40,12 +40,11 @@ export const USAGE = `Usage: node scripts/test.mjs [--lane ${LANES.join('|')}] [
   --exclude-lane  drop one lane from the selection, repeatable. Electron and
                   window-capture tests cannot run twice at once, so a second
                   concurrent --lane all run uses --exclude-lane electron.
-  --rerun-failed <n>  re-run the failed files up to n times. Default: 1 for a
-                  local run, 0 (off) when CI is set; MIXDOG_TEST_RERUN_FAILED
-                  overrides the default. A test that passes on a re-run is
-                  reported as flaky and does NOT fail the run; a test that
-                  fails every re-run still exits 1. With 0 every failure fails
-                  the run.
+  --rerun-failed <n>  re-run the failed files up to n times to classify flaky
+                  tests. Default 0: every failure fails the run;
+                  MIXDOG_TEST_RERUN_FAILED overrides the default. A test that
+                  passes on a re-run is reported as flaky and does NOT fail the
+                  run; a test that fails every re-run still exits 1.
   Per-file timeout: --test-timeout (default 120000 ms for the fast lane, 600000
                   ms otherwise); MIXDOG_TEST_TIMEOUT_MS overrides, 0 disables.
   --import        forwarded to node (desktop passes its test-env and tsx loaders).
@@ -88,15 +87,11 @@ function rerunCount(value) {
   return Number(value);
 }
 
-// Files run in parallel on every core, which exposes timing-sensitive tests
-// that pass alone. A local run therefore re-runs failed files once and reports
-// a pass on the re-run as flaky (named in the failure summary). CI keeps the
-// strict policy unless it opts in with --rerun-failed or MIXDOG_TEST_RERUN_FAILED;
-// MIXDOG_TEST_RERUN_FAILED=0 turns the local default off.
+// Every failure fails the run, locally and in CI: a test that passes only on a
+// re-run is a defect to fix, not a pass. Re-runs happen only on an explicit
+// --rerun-failed or MIXDOG_TEST_RERUN_FAILED, to classify a failure as flaky.
 export function defaultRerunFailed(env = process.env) {
-  if (/^\d+$/.test(String(env.MIXDOG_TEST_RERUN_FAILED ?? ''))) return Number(env.MIXDOG_TEST_RERUN_FAILED);
-  const ci = String(env.CI ?? '').toLowerCase();
-  return ci && ci !== '0' && ci !== 'false' ? 0 : 1;
+  return /^\d+$/.test(String(env.MIXDOG_TEST_RERUN_FAILED ?? '')) ? Number(env.MIXDOG_TEST_RERUN_FAILED) : 0;
 }
 
 export function parseArgs(argv) {

package/src/agents/advisor/AGENT.md

@@ -1,13 +1,13 @@
 ---
 name: Advisor
-description: "Use when the approach is genuinely unclear, when errors recur or results stop converging, before changing approach, or when the user asks for a second opinion. Never for final verification."
+description: "Use as a second mind on hard work: consulting before a risky or complex change is built, hunting a bug whose cause is unclear, errors that recur or results that stop converging, or when the user asks. Never for final verification."
 ---
 
 Independent technical advisor.
 
-You are consulted at decision points: when the approach is genuinely
-unclear, when errors recur or results stop converging, before a
-change of approach, and when the user asks for a second opinion or
+You are a second mind on hard work: consulted before a risky or complex
+change is built, to hunt a bug whose cause is unclear, when errors recur or
+results stop converging, and when the user asks for a second opinion or
 cross-validation. You do not see the Lead's conversation; work from the brief
 and verify its evidence against the source yourself.
 

package/src/agents/advisor/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "advisor",
   "name": "Advisor",
-  "description": "Use when the approach is genuinely unclear, when errors recur or results stop converging, before changing approach, or when the user asks for a second opinion. Never for final verification.",
+  "description": "Use as a second mind on hard work: consulting before a risky or complex change is built, hunting a bug whose cause is unclear, errors that recur or results that stop converging, or when the user asks. Never for final verification.",
   "entry": "AGENT.md"
 }

package/src/agents/explore/AGENT.md

@@ -0,0 +1,22 @@
+---
+name: Explore
+description: Use when Mixdog runs the explore tool. The tool stays off until a model is picked.
+permission: read
+---
+
+Read-only explorer for one query of the explore tool. Search and read the
+working directory; never edit, run commands or delegate.
+
+Answer the query in the message, then stop:
+
+- First a short direct answer.
+- Then the evidence: one `path:line` per finding, copied from tool output,
+  with a few words on what is there.
+- Only what you found. If nothing answers the query, say so in one line and
+  name what you searched.
+- Nothing else: no locations the query did not ask about, no notes on what
+  you did not read.
+
+Batch independent patterns and paths in one call. A location a tool returned
+is final: do not re-read or reconfirm it. Stop as soon as the answer is
+supported.

package/src/agents/explore/agent.json

@@ -0,0 +1,6 @@
+{
+  "id": "explore",
+  "name": "Explore",
+  "description": "Use when Mixdog runs the explore tool. The tool stays off until a model is picked.",
+  "entry": "AGENT.md"
+}

package/src/app.mjs

@@ -24,6 +24,10 @@ export { parseHeadlessExecCommand };
  * running behavior will NOT match the tree, so warn loudly.
  */
 function warnWhenTuiBundleStale(bundle) {
+  // Only a source checkout can drift from its bundle: src/tui/dev is left out
+  // of the npm package, and an npm install stamps every file with its own
+  // extraction time, so the mtime comparison below would misfire there.
+  if (!existsSync(join(__dirname, 'tui', 'dev', 'jit-rebuild.mjs'))) return;
   try {
     const bundleMtime = statSync(bundle).mtimeMs;
     const hotSources = [