mixdog 1.4.0 → 1.4.2

package/src/cli.mjs

@@ -24,6 +24,13 @@ try {
 // 2026-07-20). Default to production; an explicit NODE_ENV still wins.
 process.env.NODE_ENV ||= 'production';
 
+// HTTPS_PROXY/HTTP_PROXY work without NODE_USE_ENV_PROXY: honoured in this
+// process and in every child (the daemon included). On Windows without any
+// proxy variable, the static system proxy routes this process's own fetch and
+// is handed to the daemon this CLI starts, never exported as environment.
+(await import('./runtime/shared/llm/system-proxy.mjs')).adoptSystemProxy();
+(await import('./runtime/shared/llm/http-agent.mjs')).adoptEnvProxy();
+
 let swapped = false;
 const invocation = classifyCliInvocation(argv);
 const skipHostPrelude = invocation.kind === 'exec' || invocation.skipHostPrelude === true;

package/src/defaults/agents.json

@@ -1,5 +1,12 @@
 {
   "agents": [
+    {
+      "agent": "explore-agent",
+      "slot": "explore",
+      "description": "One-off read-only explorer, one per query of the explore tool",
+      "invokedBy": "explore",
+      "maintKey": "explore"
+    },
     {
       "agent": "cycle1-agent",
       "slot": "cycle1",

package/src/defaults/shipped-history.json

@@ -3,12 +3,14 @@
     "advisor": [
       "6bd0318995f70547c162efda92795e79",
       "895c5f4311dcbebc0c8756c9ec61a02a",
-      "d3b4a7926c9484833fe8ddba70260f9d"
+      "d3b4a7926c9484833fe8ddba70260f9d",
+      "fa56b363b9eeb07cb194dcd66dc4159b"
     ],
     "debugger": [
       "88c946270760ecbae86df65b9ce262f1"
     ],
     "explore": [
+      "baf26f0b3bd3abb0fb5a276febc8c4bc",
       "d4fa3ff93ace1dfac0b92792f42b9cbf"
     ],
     "front-worker": [
@@ -114,6 +116,7 @@
       "3f5915d27c7659ad82cdbda064acfbfa",
       "4e6134d60ee5c54c2888e874653bcdad",
       "4ecd89b0c07ad8a81aa1f84882cf1b00",
+      "88ac40e616f4c181583c35e591c32952",
       "899529696b7d6d3373ae83a76976ab48",
       "8d343d0a406fd5817b7fd98a3ac47010",
       "a1b73ce404125d3ce0a5762e4a1e1555",
@@ -163,6 +166,7 @@
     "simple.md": [
       "07c197ff8f20e24c65d844cd91711216",
       "16d8b5e7757001c614dae62f18f63aa1",
+      "2d33871a37ab8672ea550c6bfb4ba64d",
       "56b61d99f3179018f65b530d9b1491d7",
       "6e1749aa66d4416cadad4bcd26eb807a",
       "75ca4c5ec12866b2052a6d08b023759d",
@@ -180,9 +184,11 @@
       "00085086a7649ec6631f5cf0a3bbbf60",
       "08eee52328524eb032fd14f342742c41",
       "25a6744e7591ea5597abbda008d123fe",
+      "2e536962f4ff0b8f8028141050c7e7ab",
       "43eeb0b9c5792f08f2223c76846926cb",
       "4ab5316454013712cedb25d9b75f4e43",
       "4f042de090d853ed38aaa82b88d301ac",
+      "5d909abd96e4aa8636f27cf652301c5e",
       "646365a3f7041a3da3d7d7d896a0c3b6",
       "662f730d603b1e583dc777a1984b9134",
       "814b0820a05119a049cf4262dc35301b",
@@ -213,6 +219,7 @@
       "8a5a68ec13a7414b35e7f3b0089e2208",
       "9728f28dc5b23eb1bb1924213d3ffddd",
       "9a8789b3b4f5f6b3ba02f407cdfb92f7",
+      "ab5cce4a2fccad63e006cf22aa6cc6b0",
       "b50e9c0ba5e8228583eab4f0e0573838",
       "c03f4d0e008467497c0152639953b166",
       "cd1a47197762135462037ea6555ea721",
@@ -232,6 +239,7 @@
       "8236330f56f27dd283bda6da1239285d",
       "8bc93c9320b83de81baa8cf242af5c0b",
       "8fe64c8f6d81bee2120134adf0d6a471",
+      "9d5afe7dfa82ea3f4c627f71ccdca331",
       "9e7a48df5065f5073bbab6f9db3e4061",
       "b46617cc619e09c35b6bad8f6177e722",
       "c2b0c50791e358064e22be87bdab4707",
@@ -242,6 +250,7 @@
       "e10367dd4291a0b3d8ee8e8dd60eae36",
       "e1f2526aaf123fb77072aa8975f890de",
       "e67f30ec5bbdd36d7feaabd35b7504b3",
+      "edc3519cf07e37702a5793bb23e0643c",
       "f0798c546c172a742e3384d82322ede4"
     ],
     "docx": [
@@ -264,6 +273,7 @@
       "07604666cb32a7df8b1d4f0d1e137890",
       "189bca949decd5bccbbdeb49a18426b2",
       "1db9f3e81c714e7e4aa8db8c8004cca0",
+      "290d7620499a4134fdf511aa4902043d",
       "6d922fc351d6519c3d92cc5807fe0615",
       "95c83d23f3625c35cc346477a470c769",
       "a47d07ea3402854dc03e655afd5a3a6d",
@@ -329,6 +339,7 @@
       "48247c1645fd94aad7711082d4512c49",
       "4f94016363acccd788a724a2d414744e",
       "56e474f78faafae39aebe921ccff112d",
+      "5bd2e944160a64669a3e2f09466590b3",
       "60a1e22fd0c32aa283c64a2cc05b7889",
       "6358ad25dd07a2f92ad65c249a4f360b",
       "7fb12aeb07b79ae113c0deb0a90c6da7",
@@ -383,7 +394,9 @@
       "81e979463e0066e7a45cf511a31c5d68",
       "8476c811b2f02da3a434bcb23a1c3d12",
       "8af2b614e2a07b58dad6c0f1318d22e2",
+      "8b829db6b0675b62a71a1432dbd25490",
       "99d76213e70c6900d6af48ffa4045886",
+      "9a2188ce201e4394bc18182131b7a3e1",
       "9f90d3872b1ecd312977ce661b770b31",
       "ade615dd0f6ae6ed1601023e5b9cb692",
       "b21681ecfeb523c0d7dd89a299ec05a9",
@@ -407,18 +420,24 @@
       "633e15b84dbe22f2b578b67cc35853d4",
       "72e474711ecd18cfcae6c8365e08286e",
       "920d5b29ccfe6c88f623cf0892b29285",
-      "ec88a82ab5e511c0afb1738162150648"
+      "ec88a82ab5e511c0afb1738162150648",
+      "fa355d4ea5f1823e4b75219ab842c34a"
     ],
     "skill-creator": [
       "020817866da73a69544ba35086bdcd5f",
       "2f3f44805618783fbcca9a56652a5e91",
       "50e365910692a803732f68f82fc1ed1f",
       "77a4ca1c08f684780eeeebec50a3f1e6",
+      "92b2ed0b18a9c14470e434ec946a843f",
       "bd9bf738a5b3f443450c86230f3299fd",
       "bec7e5abbcae88a6781d23bcdd35e259",
       "d65265972caa7cbefc39baacc9e78157",
       "f450e6d58a7f1f06c71aa2dd557ce09c"
     ],
+    "test-suite": [
+      "df60ba4a182ee289f3550e79f1731cd4",
+      "f5c8ee5331a9b8279f997f609b10c380"
+    ],
     "video": [
       "6aad64b16521d324e355d125692a0cec",
       "82f61245cc67ce5380ab9ccf4c697c29",
@@ -431,6 +450,8 @@
       "8320fedd9dd745a332621c325a8bf355",
       "9c9fba19647b67d75a600137e38c02b8",
       "aa3531bfc4fd6ec3820493d0c190cc75",
+      "d9ba9f5f998bf42990eed838a3d1b774",
+      "df699ca05260ce37813a7fe6666927da",
       "f24ff77670e5aa43ce901dec1e0055ac",
       "f65924f0691284ad31000469a9855b62"
     ],

package/src/defaults/skills/browser-use/SKILL.md

@@ -8,6 +8,8 @@ dependencies:
   tools:
     - type: tool
       value: browser
+    - type: tool
+      value: handoff_user
 ---
 
 # Browser Use
@@ -170,7 +172,7 @@ not as two blocks joined.
     a submitted form's result.
   - **Handoff** — the user must act on the page: payment, approval, or an
     unfinished workflow they continue. A sign-in, CAPTCHA or 2FA step you
-    wait on is an `ask_user` takeover instead (User step mid-flow).
+    wait on is a `handoff_user` takeover instead (User step mid-flow).
 - `open` replies with exactly one placement: "Shown in the browser panel",
   "Not on screen yet" (this conversation or its panel is not visible; the
   page appears when the user opens it), or an error. Tell the user that and
@@ -200,12 +202,12 @@ not as two blocks joined.
   pages.
 - **User step mid-flow** — a CAPTCHA or human check, 2FA, or identity check is
   a handoff, not completion (an e-mail check of a flow you started is not one:
-  E-mail verification). With `ask_user`, call it with `handoff: { kind:
+  E-mail verification). With `handoff_user`, call it with `handoff: { kind:
   'takeover', surface: 'browser', tab, instructions, need }`: it shows the
   takeover card, notifies the user, opens that page beside the chat, and
   returns when they press Done; continue from a fresh observation. Never ask
   for the step in plain chat or tell the user to open the panel. Without
-  `ask_user` (an agent), retain the page with `open`, report the required
+  `handoff_user` (an agent), retain the page with `open`, report the required
   user action, and stop.
 - Preserve pre-existing user tabs, unfinished forms, and pages needed for
   recovery. If ownership or disposability is unclear, preserve the page;
@@ -318,7 +320,10 @@ file-reading tool instead of clicking around the page.
 **Multi-page task** — keep one snapshot per page; `list_tabs` when targets or
 ownership are unknown, then act on the intended tab. Use `back` instead of
 re-navigating when history suffices; forward is a `navigate` to the URL the
-earlier snapshot showed.
+earlier snapshot showed. A popup the page opens (`window.open`, an OAuth or
+sign-in window) becomes a background page the reply names ("Opened
+"popup-N" as a new page"), and the visible page does not switch: act on it
+by that name, and check `list_tabs` before concluding no popup opened.
 
 **Downloads / uploads** — `downloads` lists and can `wait` for and `attach`
 the newest file (≤ 8 MiB). A wait pins the newest download, or the next one to
@@ -383,7 +388,7 @@ in the page instead of retrying the same `navigate`.
   `MIXDOG_BROWSER_CONFIRM_ACTIONS` and
   `MIXDOG_BROWSER_DENY_ACTIONS` optionally name comma-separated public actions
   (or `*`) the desktop app confirms once or refuses; denial takes precedence.
-- For a password or token, focus the field and call `ask_user` with
+- For a password or token, focus the field and call `handoff_user` with
   `handoff: { kind: 'secret', surface: 'browser' }`; for sign-in, CAPTCHA or
   2FA use `kind: 'takeover'` with instructions. Never ask for secrets or
   these steps in plain chat.

package/src/defaults/skills/code-tidy/SKILL.md

@@ -15,45 +15,37 @@ dependencies:
 Layers, cheapest and safest first: project formatters and linters through
 `tidy`, structural rule packs, then agent-level cleanup. Every layer preserves
 behavior and public API; this is not a bug hunt. The `tidy` schema owns action
-fields; this file owns scope, order, and boundaries. Verification follows the
-shared rule: finish all planned edits, then check once (section 5).
+fields; this file owns scope, order, and boundaries.
 
 ## 1. Job and mode
-- Tidy owns format, lint, structure, and cleanup, not feature work. New
-  behavior and public-API refactors are out of scope. A correctness bug found
-  while cleaning goes under "Bugs found", never into a cleanup edit.
-- Never invent a formatter config. A project with Biome, Prettier,
-  clang-format, rustfmt, gofmt, or equivalent keeps it; add or rewrite
-  `biome.json`, `.prettierrc`, `.clang-format` and the like only when asked.
+- New behavior and public-API refactors are out of scope. A correctness defect
+  found while cleaning is reported, never fixed in a cleanup edit.
+- Never invent a formatter config; a project's own formatter stays. Add or
+  rewrite one only when asked.
 - Mode is `apply` unless the user asks to check, review, or "just report";
   report-only stays read-only on every layer and lists what would change.
-- An explicit focus restricts every layer ("formatting only" excludes lint
-  and semantic cleanup; "only dead code" excludes unrelated formatting). If
-  the tool cannot isolate it, use targeted edits or report the limitation
-  and ask before widening.
+- An explicit focus restricts every layer. If the tool cannot isolate it, use
+  targeted edits or report the limitation and ask before widening.
 
 ## 2. Scope
 1. Scope comes from the user: named files, directories, a feature area
    resolved to confirmed paths, or an explicitly requested whole project. If
    absent or ambiguous, ask first. Never infer it from a diff, branch,
    commit, or recent activity.
-2. Recommend (do not require, do not do it for them) that the user commit
-   existing work before an apply run. A dirty tree means preserve those edits.
+2. Recommend (do not require) that the user commit existing work before an
+   apply run. A dirty tree means preserve those edits.
 3. Drop deleted, binary, generated, vendored files and lockfiles unless
    explicitly included. Consumers and covering tests may be read; editing
    them outside the scope needs approval. New non-ignored files are included.
 4. Pass the approved paths on every `scan`/`check`/`fix`; `paths:["."]` only
    for an explicitly requested whole project.
-5. Too large to review in one pass (whole project, many directories):
-   partition by directory or responsibility so every source unit gets the
-   ladder and every survivor the lenses; hundreds of files per partition is
-   the usual failure. Work through all partitions without pausing for input.
-   Keep the partition list and candidate list across turns.
-6. Read per-rule and per-directory counts first, then page only relevant
-   rows with `tidy action:'results'` filters; never treat unreviewed in-scope
-   results as clean. Real engine truncation, timeouts, or scope leakage mark
-   that partition **unfinished**, not clean. Blocked checks stop dependent
-   edits only.
+5. For large scopes, review bounded partitions once. Preserve their
+   completion state; report blocked partitions without restarting completed
+   work.
+6. Read per-rule and per-directory counts first, then page only relevant rows
+   with `tidy action:'results'` filters. Truncation, timeouts, or scope
+   leakage mark that partition **unfinished**, not clean. Blocked checks stop
+   dependent edits only.
 
 ## 3. Deterministic layers
 1. `tidy action:'scan'` first (languages, engines used/missing,
@@ -61,109 +53,86 @@ shared rule: finish all planned edits, then check once (section 5).
 2. Downloads are automatic under the default `auto` policy. Only when
    `tidy.downloads` is `ask` does a result carry `needsApproval`: ask once,
    listing engines and bytes, then re-call with `approveDownloads:true`.
-3. Engines run only through `tidy` and are never installed by hand
-   (rustfmt, gofmt, dart, swift, zig, mix, dotnet: report `installHint`). An
-   ad-hoc `npx <engine>`, global binary, or package script is not
-   verification and may report a false clean. An engine `tidy` cannot resolve
-   leaves its check blocked, never clean.
-4. Plan with `fix` without `apply:true`; no separate `check` first. The dry
-   run is diagnostics and candidate files, not a frozen patch; apply
-   recalculates. `structural:true` (default) also runs ordinary engines;
-   `structural:false` disables structural rules only, not engine lint fixes.
-   For a restricted focus, do not use a combined apply that touches unrelated
-   code.
-5. Apply with `apply:true` once the plan for the scope is settled, then review
-   the actual changes. Skip apply when the dry run proposes nothing.
-   Rules without a fix (`no-empty-catch`, `no-nested-ternary`, `no-any-cast`,
-   `no-boolean-literal-compare`, `no-debug-statement`, `todo-marker`) are
-   diagnostics for the agent layer. Keep the engine pass a distinct change
+3. Engines run only through `tidy` and are never installed by hand; report
+   `installHint`. An ad-hoc `npx <engine>`, global binary, or package script
+   is not verification. An engine `tidy` cannot resolve leaves its check
+   blocked, never clean.
+4. Plan with `fix` without `apply:true`. The dry run is diagnostics and
+   candidate files, not a frozen patch. `structural:false` disables
+   structural rules only. For a restricted focus, avoid a combined apply that
+   touches unrelated code.
+5. Apply with `apply:true` once the plan is settled, then review the actual
+   changes; skip it when the dry run proposes nothing. Rules without a fix
+   are diagnostics for the agent layer. Keep the engine pass a distinct change
    set from semantic edits. On engine or structural failure, truncation, or a
    rejected edit, stop affected writes; a partial result is not success.
 
 ## 4. Agent-level cleanup
 Read `references/agent-cleanup.md` (ladder, lenses, slop, risk tiers); also
 `references/test-suite-slop.md` when tests are in scope, and
-`references/cleanup-report.md` for recording and the closing report.
+`references/cleanup-report.md` for the report.
 
-1. **Pin behavior (read-only).** Search the tests for source-text guards
-   (shapes in `agent-cleanup.md`) before extracting or moving anything. A file
-   whose touched behavior no test covers gets the narrowest regression test
-   that pins it, or only SAFE changes. Prose files have no behavior to pin.
-2. **Ladder, then lenses.** Run the deletion ladder on every selected source
-   unit, then the four lenses on the survivors. Engine diagnostics point at
-   units; they do not define coverage. A partition reviewed only where an
-   engine flagged is unfinished. Each finding has a path+symbol location,
-   cost, action, confidence, and risk tier; drop findings without evidence.
-   Use history only when code, contracts, and tests leave intent unclear;
-   unresolved intent blocks deletion.
+1. **Pin behavior (read-only).** Find the source-text guards a planned move
+   can affect (procedure in `agent-cleanup.md`). A unit whose touched behavior
+   no test covers gets only SAFE changes; report it instead of adding tests.
+2. **Ladder, then lenses.** Run the deletion ladder on each selected source
+   unit, then the lenses on the survivors. Engine diagnostics point at units;
+   they do not define coverage. Findings need path+symbol evidence; drop the
+   rest. Use history only when code, contracts, and tests leave intent
+   unclear; unresolved intent blocks deletion.
 3. **Apply by tier.** SAFE as one batch; CAREFUL one source unit at a time,
-   each finished and wired into its callers (never leave a new module nothing
-   imports); RISKY is reported, never auto-applied. Order within a tier:
-   comments, dead code, defensive code, duplication, complexity, abstraction,
-   performance. Dead code follows `references/dead-code.md`.
-4. **Stop rules.** Three failed attempts on one file: stop and escalate with
-   what was tried. A deeper fix larger than the cleanup: report it as its own
-   task. Principles cannot pick between two rewrites: apply neither, record
-   both.
+   each wired into its callers (never leave a new module nothing imports);
+   RISKY is reported with its evidence and applied only after the user
+   approves that item. Dead code follows
+   `references/dead-code.md`.
+4. **Stop rules.** Follow the shared verification budget. Report correctness
+   defects and changes beyond cleanup scope; do not fix them here. When
+   principles cannot pick between two rewrites, apply neither and record both.
 
-Structural signals are leads, not candidates: file > 1,000 lines, function
-> 50 lines or nesting > 3 (under ~100 lines, act only on a named symptom:
-duplication, a defect, demonstrated difficulty of change), duplicated small
-helpers (consolidate only when intent matches), history comments (remove only
-if no protected content is lost), underscore-prefixed names exported across
-modules (rename is RISKY). Do not improve names, control flow, or types
-beyond the ladder, lenses, and these signals. A confirmed
+Structural signals (file > 1,000 lines, function > 50 lines or nesting > 3,
+duplicated small helpers, history comments, exported underscore names) are
+leads, not candidates: act only on a named symptom. Do not improve names,
+control flow, or types beyond the ladder and lenses. A confirmed
 responsibility-based split that preserves behavior and entry points is
-CAREFUL; an extracted unit takes only the values it reads. Moving a whole
-body elsewhere or cutting it into numbered chunks resolves nothing.
+CAREFUL; moving a whole body elsewhere or cutting it into numbered chunks
+resolves nothing.
 
-## 5. Check once, then fix
-After every planned edit in the assigned scope is done, run the project's
-documented tests/typecheck covering the touched behavior and `tidy check` on
-the scope, once, in parallel. No check, build, lint, test, or formatter run
-before that. If it fails, read the full logs, finish the fixes, and rerun only
-the failed or invalidated checks. A failure on code you did not touch is
-pre-existing: report it separately. A broken runner leaves its scope
-unverified: say so. Skipped or failed checks never count as passed.
+## 5. Verify
+Use the shared evidence budget. Run scoped `tidy check`; select behavioral
+checks and typechecking only where the edits can invalidate their contracts.
+Reuse valid passes. Attribute failures from evidence, not from whether the
+failing file was edited. A broken runner leaves its scope unverified; say so.
+Skipped or failed checks never count as passed.
 
 If checks fail and cannot be fixed, undo only this run's edits with targeted
 patches, preserving prior or concurrent work. Never use `git checkout`,
 `reset`, `restore`, or `stash` as rollback; if the edits cannot be separated
 safely, leave them and report the blocker.
 
-New findings from the final `tidy check` (e.g. imports orphaned by removals)
-are fixed once if SAFE; others are reported.
-
 ## 6. Keep: never remove or rename
-- Validation and error handling at a trust boundary (user input, external
-  API, file, network) unless an adversarial test proves the guard redundant.
-- Export names, API routes, CLI flags, DB columns, config keys, event names,
-  wire strings: contracts. A rename is RISKY even when the name is bad.
+- Validation and error handling at a trust boundary unless an adversarial test
+  proves the guard redundant.
+- Contracts: export names, routes, CLI flags, DB columns, config keys, event
+  names, wire strings. A rename is RISKY even when the name is bad.
 - Anything on the never-dead list in `references/dead-code.md`.
 - An empty catch or ignored error that may be intentional: flag it.
 - Complexity serving a current compatibility obligation, staged migration, or
-  vendored-code isolation (see legacy retirement in `dead-code.md`).
-- License, copyright, SPDX notices; compiler, linter, bundler directives;
-  public API docs; security and compatibility explanations. Block comments
-  that may separate tokens or carry significant line breaks are left for
-  manual review.
+  vendored-code isolation.
+- Tool directives, public API docs, and security or compatibility
+  explanations. Comments that may separate tokens or carry significant line
+  breaks are left for manual review.
 - The project's own idioms (`AGENTS.md`/`CLAUDE.md`/lint config) over generic
-  ones; clarity over fewer lines; nested ternaries are flattened, never added.
+  ones; clarity over fewer lines.
 
 ## 7. Pitfalls
 - Missing engine: `installHint` only; continue others; that check is blocked.
 - User declines downloads: skip those engines and say so.
-- Structural engine unavailable (missing or outdated mixdog-graph): `check`/
-  `fix` fail with a rebuild remedy; `scan` still works. Retry with
-  `structural:false` for formatters/linters only; missing structural matches
-  are never clean. A per-language rule-pack error leaves only that language
-  unfinished.
-- A dead-code scanner report is a candidate list, not proof; verify per
-  `references/dead-code.md`.
+- Structural engine unavailable: `check`/`fix` fail with a rebuild remedy;
+  `scan` still works. Retry with `structural:false`; missing structural
+  matches are never clean.
+- A dead-code scanner report is a candidate list, not proof.
 
 ## 8. Reporting
-Report once, after the last partition, using `references/cleanup-report.md`.
-Put everything needing the user's decision in one list at the end: RISKY
-findings, bugs found, unresolved intent, unfinished candidates. Do not pause
-between partitions except for a blocker or a required approval. No separate
-report file unless requested.
+Report once, after the last partition, using `references/cleanup-report.md`,
+with everything needing the user's decision in one list. Pause only for a
+blocker or a required approval. No report file unless requested.