mixdog 1.4.0 → 1.4.2

package/src/defaults/skills/code-tidy/references/agent-cleanup.md

@@ -1,135 +1,87 @@
 # Agent-level cleanup
 
-Read this before the agent-level layer of `code-tidy`. It owns the deletion
-ladder, the lens checklists, what counts as slop, and the risk tiers. The skill
-body owns scope, order, approvals, and the list of things that are never
-removed or renamed.
+Owns the deletion ladder, lenses, slop categories, and risk tiers. The skill
+body owns scope, order, approvals, and the never-remove list.
 
 ## Behavior boundary
 
-Classify risk by evidence, not by syntax. Equivalence includes observable
-outputs and errors, side effects and module initialization, and any call
-identity, receiver, or asynchronous ordering that consumers rely on. Removing
-an unused binding can remove initialization; inlining a wrapper can change
-its call contract. Neither is SAFE merely because it looks redundant.
-
-Use current callers, contracts, and relevant tests to establish equivalence.
-Passing tests that do not exercise the affected behavior are not proof.
-An intended change to failures, returned values, compatibility, or concurrency
-is RISKY: report it as a separate correction or migration, not a cleanup edit.
-
-**Source-text guards.** Some tests assert on source text rather than behavior,
-so an extraction breaks them without touching behavior: a packaging test that
-reads three files as one concatenated string and enforces five `indexOf`
-orderings; a repo-wide audit asserting an identifier appears in no file outside
-two named modules; a coverage test requiring literal action names to stay in
-one file. Search the suite for them first (reads of source paths, ordering
-`indexOf` chains, identifier-absence assertions) and record what each pins;
-moving code across such a guard is a contract change, not a tidying.
-
-**Dependency arrays.** A hook or watcher dependency array that contradicts its
-own body — the body reads values the array does not key — is a defect
-candidate, not an idiom to preserve and report. Verify reachability at the
-producer: when the key can actually repeat (two publishers stamping
-`Date.now()` in the same millisecond drop the second update), fix it by adding
-the values the body reads while keeping the existing key, with a test that
-fails without the fix, delivered as its own change set under "Bugs found".
-When the producer makes repetition unreachable, leave the array and record that
-evidence as `kept`.
+Classify risk by evidence, not syntax. Equivalence includes observable outputs
+and errors, side effects and module initialization, and any call identity,
+receiver, or ordering consumers rely on. Removing an unused binding can remove
+initialization; inlining a wrapper can change its call contract.
+
+Establish equivalence from current callers, contracts, and tests that exercise
+the affected behavior. An intended change to failures, returned values,
+compatibility, or concurrency is RISKY: report it as a separate correction.
+
+**Source-text guards.** Some tests assert on source text rather than behavior
+(file reads of source paths, `indexOf` ordering chains, identifier-absence or
+literal-presence assertions), so a move breaks them without changing behavior.
+Search only for guards a proposed move can affect, and record what each pins.
+Moving code across such a guard is a contract change, not a tidying.
+
+**Dependency arrays.** A suspected correctness defect is outside cleanup;
+report its evidence without changing behavior.
 
 ## Deletion ladder
 
-Run the ladder on every selected unit (function, class, module, config knob)
-in scope before looking for smells. Only code that lands on the
-last rung goes on to the lenses.
+Run on each selected unit before looking for smells; only code that lands on
+the last rung goes on to the lenses.
 
-| Rung | Question | Typical win |
+| Rung | Question | Result |
 |---|---|---|
-| Delete | Is there evidence the behavior is no longer needed? Check callers, requirements, flags, and compatibility obligations | remove the verified obsolete unit; retire tests only under the test-suite slop rules |
-| Reuse | Does a helper in this repo already do it? (`code_graph symbol_search`, `grep` for the pattern's distinctive call) | reimplementation replaced by a call |
-| Platform | Does the stdlib, runtime, or an already-installed dependency do it? (`URLSearchParams`, `path.relative`, `Array.prototype.at`, `pathlib`, an imported util) | hand-rolled parser/formatter/debounce replaced |
-| Simplify | It must exist here; make it smaller | proceeds to the lenses |
-
-A unit replaced by one platform call is a larger and safer win than any
-in-place cleanup; take it before analysing the unit's smells.
+| Delete | Is there evidence the behavior is no longer needed (callers, requirements, flags, compatibility)? | remove the verified obsolete unit |
+| Reuse | Does a repo helper already do it? | replaced by a call |
+| Platform | Does the runtime, stdlib, or an installed dependency do it? | hand-rolled code replaced |
+| Simplify | It must exist; make it smaller | proceeds to the lenses |
 
 ## Lenses
 
-Each lens judges the units in scope and may search the whole
-repository for evidence (an existing helper, a sibling call site); a finding
-without a path-plus-symbol pointer is dropped. Run every lens unless the user named a focus.
-Judge each selected function or class in its full context, including relevant
-callers and tests, even when it has no pending diff. Do not restrict review to
-recently edited lines or silently widen the edit scope to its consumers.
-
-**Reuse** — new code that duplicates an existing utility, constant, type
-guard, or pattern: hand-rolled string/path manipulation, custom env checks,
-ad-hoc validation, re-implemented parsing. Name the existing thing and where it
-lives. Before flagging a new dependency import, check `package.json` /
-`pyproject.toml` for a library already installed that covers it.
-
-**Quality** — redundant state (values derivable from existing state, caches
-that need not exist); parameter sprawl (a parameter bolted on where the
-function should be restructured, a boolean parameter that selects between two
-behaviors — split the function instead); copy-paste-with-variation; leaky
-abstractions; stringly-typed code where a constant, enum, or registry exists;
-slop patterns from the table below.
-
-**Efficiency** — redundant computation, repeated file reads, duplicate API
-calls, N+1 access; independent operations run sequentially; heavy work on
-startup or per-request paths; existence pre-checks instead of doing the
-operation and handling the error; unbounded growth, missing cleanup,
-listener/handle leaks; closures capturing a whole scope for long-lived
-objects; whole-file reads where a slice would do. Only apply an efficiency
-change whose behavioral equivalence is obvious; never restructure an
-algorithm with subtle correctness implications without a test that pins it.
-
-**Altitude** — a fix applied too shallowly: a caller-specific branch added to
-a generic path (`if (caller === X)`, a magic-value escape hatch); a symptom
-patched at one call site while siblings keep the same flaw; a workaround
-stacked on a workaround; a wrapper added to avoid touching the thing that
-needs changing; a flag introduced to route around a broken default. Name
-the mechanism the change is dodging and the deeper fix. When the deeper fix
-is larger than the cleanup, report it as its own task instead of doing it
-here.
+Use the lenses to identify supported improvements within scope; stop
+investigating a candidate when its disposition is established. Each lens may
+search the whole repository for evidence; a finding without a path+symbol
+pointer is dropped. Judge units in full context, not only recently edited
+lines, and never widen the edit scope to consumers. Skip lenses the user's
+focus excludes.
+
+- **Reuse** — new code duplicating an existing utility, constant, guard, or
+  installed library. Name the existing thing.
+- **Quality** — redundant or derivable state, parameter sprawl (a boolean
+  selecting between behaviors), copy-paste-with-variation, leaky abstractions,
+  stringly-typed code where a constant or registry exists, slop below.
+- **Efficiency** — redundant work, repeated reads, N+1 access, needless
+  sequencing, leaks, existence pre-checks instead of handling the error. Apply
+  only when equivalence is obvious; otherwise report it.
+- **Altitude** — a fix applied too shallowly: a caller-specific branch in a
+  generic path, a symptom patched at one site, a workaround on a workaround.
+  Name the deeper fix; when it exceeds the cleanup, report it as its own task.
 
 ## Slop categories
 
 | Category | Flag | Keep | Fix |
 |---|---|---|---|
-| Obvious comments | restating the code, section dividers, commented-out code, vague TODOs, narration of the change or of the caller | WHY comments (business rule, workaround, invariant), ticket links, regex/algorithm notes, BDD markers, license/attribution notices, tool directives, public API docs | delete only with high confidence; preserve token boundaries and significant line breaks |
-| Over-defensive code | null checks on guaranteed values, try/catch around code that cannot throw, type checks on statically typed params, defaults for required params, validation duplicated inside a boundary, broad catch-all | I/O error handling, nullable DB fields, a top-level catch-all that logs and rethrows | remove only when a test proves the guard redundant; changing which errors are caught or propagated is RISKY |
-| Fake resilience | a fallback that turns a missing input or a failed call into a plausible value (`?? 0`, an empty-object default, a stub record); a catch that only rethrows the same error; a catch that logs without the error and continues | a default the caller's contract names, a retry or degraded mode the docs describe | remove only proven redundant behavior; replacing a default with a failure or changing the error contract is a separate RISKY correction |
-| Excessive complexity | nesting > 3, nested ternaries, 4+ predicates in one condition, > 5 positional params, functions > 50 lines doing several things, clever one-liners, a 4+ branch ladder comparing one value against constants, a hand-rolled loop the language has an idiom for (`for i in range(len(xs))`, an index loop over a collection, `count() > 0` for "any") | a hot path that intentionally uses a dense idiom | guard clauses, early returns, explicit if/else, an options object, a lookup table, the language's own idiom, extract by responsibility |
-| Needless abstraction | pass-through wrappers, single-use helpers, speculative indirection, one-implementer interfaces that add no seam, factories that only call a constructor | abstractions that give a real seam (tests, multiple implementers, framework boundary) | inline only after verifying the behavior boundary above |
-| Boundary violations | wrong-layer imports, import cycles between modules, business logic in a handler, one module reading another's private state, side effects in a pure-named function | short-circuits already established as a pattern here | move to the owning layer; break a cycle by moving the shared piece out; flag when unsure |
-| Dead code | unused imports/locals/private functions, unreachable branches, stale feature flags, debug leftovers, code removed but still referenced | whatever the dead-code procedure lists as never dead | remove through the dead-code procedure linked from the skill |
-| Duplication | copy-pasted branches with trivial differences, two helpers doing the same thing, repeated literal sequences, one exported type or interface redeclared in several files | incidental similarity between things that serve different intents and may diverge | consolidate only when intents match |
-| Type escapes | `as any`, `@ts-ignore`, `# type: ignore` without reason, a lint or compiler warning suppressed without one (`eslint-disable`, `# noqa`, `#pragma warning disable`), `object`/`Any` annotations where a union or Protocol fits, a value re-coerced to the type it already has (`String(s)` on a `string`) | an escape or suppression whose comment names the upstream bug it works around | narrow with a guard, a precise type, or `unknown` plus a check; drop a coercion the type already guarantees; fix the warning or record why it is silenced |
-| Hardcoded config | environment-specific URLs and endpoints, provider/account/project ids, absolute paths and path strings spliced with `/`, a literal branch for one caller or one environment, unnamed numeric thresholds | test fixtures, documentation examples, a literal the contract itself fixes (wire strings, protocol constants) | read it through the project's existing config or env accessor; name the literal. A credential in source is a bug — report it, never merely relocate it |
-| Placeholder naming | numbered or filler names on new code (`data2`, `helper1`, `tmp`, `handleStuff`, a `Manager` holding two functions) | names the project's own idioms establish | rename locals after their intent; an exported rename is a contract change, so RISKY |
-| Oversized modules | files past the skill's 1,000-line review threshold or mixing responsibilities | a cohesive module or script with no useful responsibility boundary | split confirmed independent responsibilities; never `utils`/`helpers`/`common`/`part2` dump files |
+| Comments | restating the code, step narration, history or changelog notes, dividers, commented-out code, a comment the code contradicts, a TODO with no owner or issue | a non-obvious why (external constraint, invariant, tradeoff), directives, public API docs, issue links | delete or correct; a "do not change" comment gets a proposed test or type that enforces it, applied only with approval |
+| Over-defensive code | checks on guaranteed values, try/catch around code that cannot throw, duplicated validation | I/O handling, trust boundaries, a logging top-level catch | remove only when a test proves the guard redundant; changing which errors propagate is RISKY |
+| Fake resilience | a fallback turning missing input or failure into a plausible value; a catch that only rethrows or swallows | a default the contract names, documented retry or degraded mode | remove only proven redundant behavior; changing the error contract is RISKY |
+| Excessive complexity | deep nesting, nested ternaries, long conditions, many params, clever one-liners, hand-rolled loops with an idiom | a deliberately dense hot path | guard clauses, early returns, lookup table, options object, extract by responsibility |
+| Needless abstraction | pass-through wrappers, single-use helpers, speculative indirection | a real seam (tests, multiple implementers, framework boundary) | inline after the behavior boundary check |
+| Boundary violations | wrong-layer imports, cycles, logic in handlers, reading another module's private state | an established pattern | move to the owning layer; flag when unsure |
+| Dead code | unused imports/locals/private functions, unreachable branches, debug leftovers | the never-dead list | follow `dead-code.md` |
+| Duplication | copy-pasted branches, two helpers doing one thing, redeclared types | similarity serving different intents | consolidate only when intents match |
+| Type escapes | `any`, unexplained ignores and suppressions, redundant coercions | an escape whose comment names the upstream bug | narrow with a guard or precise type; fix the warning or record why silenced |
+| Hardcoded config | environment-specific URLs, ids, absolute paths, unnamed thresholds | fixtures, docs, contract-fixed literals | use the project's config accessor; name the literal. A credential in source is a defect: report it |
+| Placeholder naming | `data2`, `tmp`, `handleStuff` on new code | the project's own idioms | rename locals; an exported rename is RISKY |
+| Oversized modules | files past the review threshold mixing responsibilities | a cohesive module | split confirmed independent responsibilities; no `utils`/`common` dumps |
 
 ## Risk tiers
 
-Every finding carries one tier:
-
-| Tier | Meaning | Examples | Handling |
-|---|---|---|---|
-| SAFE | equivalence established, including initialization and parsing | verified unused binding with no initialization effects, nonsemantic comment, redundant type assertion | apply as one batch |
-| CAREFUL | same semantics, structure changes | rename a local, flatten a ternary, guard clause, verified wrapper inlining, extract a helper, split responsibilities while preserving entry points, consolidate duplicates, name a magic number | apply one source unit at a time (including required new modules); verified by the single final check; undo only this run's edits if it cannot be fixed |
-| RISKY | may change behavior or a contract | public API or export rename, route/DB column/config key rename, error-handling change, concurrency change, N+1 restructuring, altitude fix in shared infrastructure | report only, with the test coverage status; never auto-apply |
-
-Conflict resolution when lenses disagree: correctness > the user's stated
-focus > readability and reuse > micro-performance. When two defensible
-rewrites of the same region remain, apply the one that touches less code and
-record the alternative; when the principles cannot separate them, apply
-neither and record both.
-
-## Small tidyings (CAREFUL tier)
-
-Structure-only moves the slop table does not already cover: normalize two
-variants of the same pattern to one form; put coupled functions next to each
-other; declare a variable where it is initialized; blank line between chunks
-that do different things; merge over-fragmented pieces back into one readable
-block before re-splitting. One tidying per change set.
+| Tier | Meaning | Handling |
+|---|---|---|
+| SAFE | equivalence established, including initialization | apply as one batch |
+| CAREFUL | same semantics, structure changes (local rename, guard clause, verified inlining, helper extraction, responsibility split, consolidation) | one source unit at a time, including required new modules |
+| RISKY | may change behavior or a contract (public rename, error-handling or concurrency change, shared-infrastructure fix) | report with test coverage status; apply only the items the user approves |
+
+When lenses disagree: correctness > the user's focus > readability and reuse >
+micro-performance. Between two defensible rewrites, apply the one touching
+less code and record the alternative; if principles cannot separate them,
+apply neither.

package/src/defaults/skills/code-tidy/references/cleanup-report.md

@@ -1,43 +1,27 @@
-# Candidate list and report
+# Report
 
-Findings and risk tiers come from `agent-cleanup.md`; this file owns how they
-are recorded and reported. Keep the list in the conversation, not a file.
+Findings and tiers come from `agent-cleanup.md`. Keep the list in the
+conversation, not a file. Record only findings with a path+symbol, a cost, and
+an action; threshold hits are signals, not findings.
 
-## Candidates
-
-One line per candidate, with a stable ID (`C-01`):
-
-```text
-[ID] path · symbol → problem → cost → action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished
-```
-
-- Register only a lens finding with a path+symbol location, a cost, and an
-  action. A finding that cannot name its cost is a nit: drop it. Threshold
-  hits (long files or functions, deep nesting) are signals, not candidates.
-- Findings sharing a root cause group under one ID, each member keeping its
-  path and symbol. Code moved by an extraction keeps its origin ID.
-- Confidence is `low` when callers, contracts, and tests do not explain why
-  the code exists; medium/low candidates stay unfinished until that question
-  is resolved. Approval to apply does not authorize guessing.
-- `completed` carries evidence of what changed; `kept` carries a concrete
-  reason (keep rule or external contract); `unfinished` carries the blocker
-  (pending, blocked, deferred, unverified).
-
-Overall cleanup is complete only when every partition is done, the final
-check has passed, and every candidate is completed or kept with evidence.
-Otherwise report "overall partial" with the remaining paths and IDs.
+Each entry carries: path · symbol, action or blocker, risk tier, evidence
+(what changed, why kept, or what blocks it). Findings sharing a root cause
+group together. Unresolved intent stays unfinished; approval to apply does not
+authorize guessing.
 
 ## Final report
 
+Include only sections that have content:
+
 ```text
 Scope: <paths | whole project> · Mode: report|apply · Overall: complete|partial
-Deterministic: engines used/missing · files changed · diagnostics remaining · structural applied/skipped
-Completed:  [ID] path · symbol — [Lens/TIER] what changed
-Kept:       [ID] path · symbol — reason
-Unfinished: [ID] path · symbol — remaining work · status · next
-Noticed, not applied (RISKY or out of scope): [ID] path · symbol — why · test coverage
-Bugs found (not fixed here): <issues>
-Verification: tests <result> · typecheck <result> · tidy check <remaining diagnostics> · pre-existing failures <list|none>
-Blocked or unverified: <check> — <reason> → <paths>   (write "none" if none)
-Needs your decision: <RISKY findings, bugs, unresolved intent, unfinished candidates>
+Deterministic: engines used/missing · files changed · diagnostics remaining
+Completed / Kept / Unfinished: entries as above
+Noticed, not applied (RISKY or out of scope): entries · test coverage
+Defects found (not fixed here): <issues>
+Verification: checks run and results · failures and established attribution · blocked or unverified checks with reason
+Needs your decision: <RISKY findings, defects, unresolved intent, unfinished items>
 ```
+
+Complete means every partition was reviewed and the required checks passed or
+are reported blocked; otherwise report partial with the remaining paths.

package/src/defaults/skills/code-tidy/references/dead-code.md

@@ -45,8 +45,6 @@ found" and never settle it by installing the package.
    effectful initializers, and the last unused import binding can still load a
    module for registration or initialization. Preserve required initialization
    rather than deleting it with the binding.
-5. Record the symbol, kind, classified usage and contract evidence, side-effect
-   result, and proposed action in the candidate list.
 
 ## Never dead
 
@@ -79,7 +77,7 @@ evidence. Apply this procedure before classifying an old path as dead:
 4. For a verified obsolete path, inventory its callers, flags/config, tests,
    docs, files, and dependencies. Remove only approved members in the order
    below; request scope expansion before editing related files outside it.
-5. Record the retirement evidence and any remaining items. A still-required path is kept with its contract; an unknown obligation
+5. A still-required path is kept with its contract; an unknown obligation
    leaves the candidate blocked, not assumed obsolete.
 
 ## Remove in order
@@ -94,9 +92,5 @@ evidence. Apply this procedure before classifying an old path as dead:
    project's own package manager.
 
 Group edits by file so one batch never touches a file another batch edits.
-Verification and rollback follow the skill body (section 5).
-
-## Report
-
-Use the shared candidate list and closing report, with usage and side-effect
-evidence per ID.
+Verification and rollback follow the skill body (section 5). Record usage and
+side-effect evidence in the common report format (`cleanup-report.md`).

package/src/defaults/skills/code-tidy/references/test-suite-slop.md

@@ -1,31 +1,20 @@
 # Test-suite slop
 
-Read this when tests are in scope for agent-level cleanup. Tests accumulate
-through repeated agent corrections the same way production code does:
+Read this when tests are in scope. Pruning rules and the test workflow belong
+to the `test-suite` skill (Prune); this file only adds the cleanup gate.
 
-First distinguish redundant coverage from removing a supported behavior.
-Keep distinct observable success, rejection, error, and compatibility cases.
-Before removing a behavior and its tests, require independent evidence from
-current requirements, real callers, or a specification; tests existing only
-for that branch are neither proof of necessity nor permission to delete it.
+First tell redundant coverage from removing a supported behavior. Keep
+distinct observable success, rejection, error, and compatibility cases. Before
+removing a behavior and its tests, require independent evidence from current
+requirements, real callers, or a specification; a test existing only for that
+branch is neither proof of necessity nor permission to delete it. A closed
+loop (a fallback justified by its test, a test justified by the fallback) is
+no evidence either; unresolved intent blocks deletion.
 
-- **Dominated tests** — several tests reach the same branch and the same
-  result; one asserts the observable output, the others only check
-  construction, type, or non-emptiness. Keep the strongest, delete the rest
-  and the fixtures that served only them.
-- **Accumulated regression tests** — a near-identical test appended after each
-  correction, or parameter permutations whose values never cross a new branch,
-  equivalence class, or failure mode. Keep the smallest set that still covers
-  distinct regressions, and a permutation only where it marks a real boundary.
-- **Tautological assertions** — assertions that cannot fail: `assert True`,
-  two equal literals compared, a state the fixture itself guarantees, a mock
-  verifying the setup that fed it. Delete, or rewrite against the observable
-  result.
-- **Verification theater** — checksums, receipts, validators, or
-  recomputation where producer and verifier share the same information and
-  failure domain. They cannot fail independently; delete.
-- **Closed justification loop** — a fallback exists because a test exercises
-  it and the test exists because the fallback was added. Neither is evidence
-  for deleting the pair. Apply the independent-evidence gate above first;
-  unresolved intent blocks deletion. A distinct externally observable
-  rejection, error, or compatibility test is not a loop; preserve its coverage.
+Delete a test only when it is dominated (same branch and result as a stronger
+test), tautological (cannot fail), a permutation crossing no new branch, or
+verification theater (verifier and producer share one failure domain), or it
+asserts a removal, a restated constant or copied production logic, and name
+the test that still owns the contract. Deleting a contract test needs the
+user's approval. Merging into an owner, rewriting source-text assertions, and
+everything else follows `test-suite`.

package/src/defaults/skills/computer-use/SKILL.md

@@ -8,6 +8,8 @@ dependencies:
   tools:
     - type: tool
       value: computer
+    - type: tool
+      value: handoff_user
 ---
 
 # Computer Use
@@ -180,13 +182,21 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
    the turn, like any session exit, releases what the session pressed, and a
    failed release is reported rather than assumed.
    Execution stops at the first failure or when the target transitions
-   (popup, dialog, window change) and returns one fresh observation. An act
+   (a popup, dialog, or window change present at the settle check, about
+   150 ms after the input) and returns one fresh observation. An act
    whose first action uses a `ref` returns accessibility only (`ax`) unless
    that tree is unusable; pass `observe: "state"` when the next step needs
    pixels, a `frame_id`, or visual confirmation.
 4. Read the returned observation, including any successor target. It replaces
    the pre-action state: continue from it without another capture when usable.
    Recapture only when evidence is missing, failed, expired, or invalidated.
+   That observation shows one window, never the others on screen. Windows the
+   settle check saw are in `window_transition.opened_windows`; a window that
+   opened later is named by the next command's
+   `windows_opened_since_last_action` (since, not necessarily caused by, your
+   last action). After a click that may open a popup (sign-in, OAuth,
+   connect, continue, authorize), run `list` (kind windows, `query` with the
+   app or expected title) before concluding nothing opened.
 
 Prefer semantic `ref` > SOM/OCR `element` > coordinates. When pixels are
 reported `pixel_unavailable`, coordinate input fails closed but fresh semantic
@@ -241,9 +251,9 @@ your results and that browser's pixels are withheld until this turn ends
 (`ax` reads still work), but a page that redisplays it can expose it, and other
 programs of the same Windows user are outside this protection. A username is
 an identifier and is not hidden. Continue with keys (`act` key Enter). On a
-refusal, hand the secret to the user (`ask_user` kind `secret`,
+refusal, hand the secret to the user (`handoff_user` kind `secret`,
 surface `computer`); one-time codes, passkeys, security keys and app approvals
-are the user's step (`ask_user` kind `takeover`). Never type a password or
+are the user's step (`handoff_user` kind `takeover`). Never type a password or
 code with `type`/`set_value`, even one shown on screen.
 
 **Keyboard-driven navigation** — `act` with `key` steps such as `ctrl+s`
@@ -251,7 +261,9 @@ and a trailing short `wait`; verify with `verify` rather than another capture.
 `alt+f4` is blocked in every delivery mode. To close a window, obtain the
 user's go-ahead and use `window` with the `close` operation.
 
-**Dialog appears mid-sequence** — `act` halts automatically. Use its successful
+**Dialog appears mid-sequence** — `act` halts when the settle check sees it; a
+dialog that opens later arrives in the next command's
+`windows_opened_since_last_action`. Use its successful
 successor observation to handle the dialog; capture only if it is unusable.
 Returning to the original window also requires a fresh observation, whether
 returned by the action or obtained through `capture`.

package/src/defaults/skills/goal-management/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: goal-management
 description: Manage the task list of approved work carried across turns, its progress, approvals, and completion.
-when_to_use: 'Explicit Goal (`goal` tool) requests, approved multi-turn work in progress (migrations, improvement passes); not single-turn tasks or recurring schedules.'
+when_to_use: 'Goal requests or approved multi-turn work in progress; not one-turn tasks or recurring schedules.'
 dependencies:
   tools:
     - type: tool

package/src/defaults/skills/setup/references/actions.md

@@ -52,7 +52,7 @@ Read this when choosing a `setup` mutation.
 | Permanently delete confirmed, unchanged, unused model files | `delete_local_model` |
 | TUI system shell | `set_system_shell` |
 | Automatic updates | `set_auto_update` |
-| Mixy's heartbeat: a regular check that wakes her only when something needs attention and only after the user had no operation for 30 minutes (no sent turn, no keyboard/mouse/wheel input in the desktop app's windows) (on by default; `status features` reports `heartbeat.enabled` and `heartbeat.intervalMinutes`) | `set_heartbeat_enabled` |
+| Mixy's heartbeat: a regular check that wakes her only when something needs attention and only after the user had no operation for 30 minutes (no sent turn, no keyboard/mouse/wheel input in the desktop app's windows) (off by default; `status features` reports `heartbeat.enabled` and `heartbeat.intervalMinutes`) | `set_heartbeat_enabled` |
 | How often the heartbeat checks: `minutes` 30, 60 (default), 120 or 240; applies from the next tick, counted from the last check | `set_heartbeat_interval` |
 | Bots' emoji reactions on the user's messages (on by default; `status features` reports `reactions.enabled`) | `set_reactions_enabled` |
 | Worktree defaults: new tasks on the current branch or a new worktree, branch prefix, large-repository warning size, automatic cleanup | `set_worktree_settings` |
@@ -103,7 +103,7 @@ Read this when choosing a `setup` mutation.
 | Read a Project's connector switches | `read_project_connectors` |
 | An agent's action permission (block/ask per action kind) | `set_agent_permission` |
 | Switch a connector off for an agent / a Project (switching it back on is done in the desktop app) | `set_agent_connector`, `set_project_connector` |
-| One connector tool of an agent to needs_approval or disabled | `set_agent_connector_tool` |
+| One connector tool of an agent to disabled, needs_approval or auto (a widening asks the user on an approval card) | `set_agent_connector_tool` |
 | Bring back an archived bot or agent (`definitionKind: "agent"`) | `restore_definition` |
 | Bot display order (Bots page, Sessions bot section; `status agents` `botOrder`) | `set_bot_order` |
 
@@ -344,10 +344,16 @@ markers are read with `status desktop`.
   `status mcp` afterwards. `add_mcp_server` with the service URL is not the
   sign-in flow; never use it for a catalog service.
 - Agent permissions and connector switches change only toward less: `block`
-  or `ask`, a connector off, a tool to `needs_approval`/`disabled`. Anything
-  that lets an agent do more without asking (`allow`, a connector back on, a
-  tool to `auto`) is refused ("make it on the desktop"); `open agents` and let
-  the person do it. Payments and permanent deletes always ask regardless.
+  or `ask`, a connector off, a tool to `disabled`. An action permission
+  `allow` or a connector back on is refused ("make it on the desktop");
+  `open agents` and let the person do it. One connector tool's widening
+  (`set_agent_connector_tool` from `disabled` to `needs_approval`/`auto`, or
+  `needs_approval` to `auto`) asks the user instead: the call waits on an
+  approval card (on the desktop or a paired phone) offering "needs approval",
+  "auto" or Deny, whatever level was asked; the result's `permission` and
+  `note` say what was applied. Only a press on that card decides it: never
+  treat a chat reply as approval, and ask again for each change. Payments and
+  permanent deletes always ask regardless.
   Connector ids are MCP server names from `read_agent_settings`; a bot's
   thread changes only its own bot.
 - `enable_plugin_mcp` turns every server the plugin declares back on and

package/src/defaults/skills/setup/references/surfaces.md

@@ -134,8 +134,8 @@ The setup tool does not mutate:
   browser action confirmations (`MIXDOG_BROWSER_CONFIRM_ACTIONS`,
   `MIXDOG_BROWSER_CONFIRM_SUBMIT`; see the browser-use skill);
 - widening an agent's authority: action permission `allow`, a connector
-  switched back on for an agent or Project, a connector tool to `auto`
-  (setup only narrows them);
+  switched back on for an agent or Project (setup only narrows them; a
+  single connector tool's widening asks the user on an approval card);
 - the remote-access switch ("Use this PC from other devices") and this PC's
   name: turning it off from a phone would cut that phone off mid-session;
 - permanently deleting an archived bot (Sessions → Archived → delete);

package/src/defaults/skills/setup-guide/SKILL.md

@@ -106,6 +106,8 @@ done. Take the first open step, explain it in a sentence or two, ask, then act.
    provider. Give the reason in one line: a different model family catches what
    the main one misses. Suggest turning on the Maintainer with
    a cheap model at the lowest effort; it also decides turns in group rooms.
+   Offer Explore the same way, from its own picks: a cheap model that
+   searches code for the Lead in separate parallel sessions.
    A pick may carry `plans`: when the Lead provider's plan (`plan` in
    `status providers`) is listed there, recommend that model instead. A null or
    unlisted plan keeps the pick as is; never fail on an unknown plan.
@@ -152,8 +154,9 @@ step; do not insist.
   does part of a task. Users add their own on the Workflows page with the
   "에이전트 +" button. Bots are people-facing; agents work behind a task.
 - Default agents (기본 에이전트): built-in helpers listed on Workflows, such as
-  Web Search (runs the web search tool) and the Maintainer (memory upkeep and
-  session titles). They need a model route to work.
+  Web Search (runs the web search tool), the Maintainer (memory upkeep and
+  session titles) and Explore (code search for the Lead). They need a model
+  route to work.
 - Agent mode (에이전트 모드): a coding work session run by Lead and agents.
   A session a bot starts for a job is an agent task session (에이전트 작업
   세션); others are just sessions (세션).

package/src/defaults/skills/setup-guide/model-recommendations.json

@@ -328,6 +328,19 @@
           "source": "https://www.benchleader.com/best/llm-for-coding"
         }
       ]
+    },
+    {
+      "roles": ["Explore"],
+      "note": "Measured on Mixdog code searches: Haiku found the key locations; cheaper models tested missed about half on unseen questions. With no qualifying pick, leave Explore off.",
+      "picks": [
+        {
+          "provider": "Anthropic",
+          "model": "Claude Haiku 5.5",
+          "effort": "low",
+          "checkedAt": "2026-10-29",
+          "source": "https://benchlm.ai/anthropic/api-pricing"
+        }
+      ]
     }
   ]
 }