mixdog 1.4.1 → 1.4.2

package/src/runtime/explore/tool-defs.mjs

@@ -0,0 +1,35 @@
+import { TOOL_SYNC_EXECUTION_CONTRACT } from '../shared/tool-execution-contract.mjs';
+
+export const EXPLORE_MAX_QUERIES = 8;
+
+export const TOOL_DEFS = [
+  {
+    name: 'explore',
+    title: 'Explore',
+    annotations: {
+      title: 'Explore',
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+    },
+    description:
+      'Read-only code search in parallel explorers outside your context; returns one merged answer with path:line evidence. ' +
+      'Use when locating needs 3+ searches, spans 2+ files or areas, or covers independent questions; a known file or one lookup: read/grep. ' +
+      TOOL_SYNC_EXECUTION_CONTRACT,
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: {
+          anyOf: [
+            { type: 'string', minLength: 1 },
+            { type: 'array', items: { type: 'string', minLength: 1 }, minItems: 1, maxItems: EXPLORE_MAX_QUERIES },
+          ],
+          description: 'One self-contained question, or an array of independent ones (one explorer each).',
+        },
+      },
+      required: ['query'],
+      additionalProperties: false,
+    },
+  },
+];

package/src/runtime/explore/tool.mjs

@@ -0,0 +1,123 @@
+// The explore tool: one read-only explorer loop per query (explorer.mjs), all
+// in parallel, merged into one bounded answer within the same tool call.
+import { resolveMaintenanceRoute } from '../agent/orchestrator/agent-runtime/maintenance-route.mjs';
+import { loadConfig } from '../agent/orchestrator/config.mjs';
+import { getProvider, initProviders } from '../agent/orchestrator/providers/registry.mjs';
+import { EXPLORE_MAX_QUERIES } from './tool-defs.mjs';
+import { runExplorer } from './explorer.mjs';
+
+// Hidden ids are reserved from user agents, so this one keeps the `-agent`
+// suffix: a plain `explorer` would hide a user's own Explorer agent.
+export const EXPLORER_AGENT = 'explore-agent';
+export const EXPLORE_TIMEOUT_MS = 120_000;
+export const EXPLORE_OUTPUT_CAP = 24_000;
+const TRUNCATED = '\n[explore: answer truncated]';
+
+function result(text, isError = false) {
+  return { content: [{ type: 'text', text }], ...(isError ? { isError: true } : {}) };
+}
+
+export function normalizeExploreQueries(raw) {
+  const list = Array.isArray(raw) ? raw : [raw];
+  return list.map((q) => (typeof q === 'string' ? q.trim() : '')).filter(Boolean);
+}
+
+function capped(text, budget) {
+  return text.length <= budget ? text : text.slice(0, Math.max(0, budget - TRUNCATED.length)) + TRUNCATED;
+}
+
+// Headings and error lines are labels, not answers: the truncation marker
+// would tell the caller that evidence was lost when none was.
+function shortened(text, max) {
+  return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+
+/**
+ * @param {{ query: string|string[] }} args
+ * @param {{ cwd?: string, signal?: AbortSignal, callerSessionId?: string }} ctx
+ * @param {object} [deps] injectable for tests
+ */
+export async function runExplore(args = {}, ctx = {}, deps = {}) {
+  const {
+    load = () => loadConfig({ secrets: false }),
+    initialize = initProviders,
+    providerFor = getProvider,
+    timeoutMs = EXPLORE_TIMEOUT_MS,
+  } = deps;
+  const queries = normalizeExploreQueries(args.query);
+  if (!queries.length) return result('[explore error] query is required', true);
+  if (queries.length > EXPLORE_MAX_QUERIES) {
+    return result(`[explore error] at most ${EXPLORE_MAX_QUERIES} queries per call`, true);
+  }
+  const config = load();
+  const route = resolveMaintenanceRoute({ agent: EXPLORER_AGENT, config, includeDefault: false });
+  if (!route || typeof route !== 'object') {
+    return result('[explore error] Explore has no model; pick one under Workflows → Built-in agents → Explore', true);
+  }
+
+  // One controller per call: caller cancellation and the deadline both abort
+  // every explorer, and the call waits for each loop to settle.
+  const controller = new AbortController();
+  const parent = ctx.signal;
+  const onParentAbort = () => controller.abort(parent.reason);
+  if (parent?.aborted) return result('[explore error] cancelled', true);
+  parent?.addEventListener('abort', onParentAbort, { once: true });
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    const reason = new Error(`explore timed out after ${Math.round(timeoutMs / 1000)}s`);
+    // Lets an explorer return the answer text it already wrote.
+    reason.salvagePartial = true;
+    controller.abort(reason);
+  }, timeoutMs);
+
+  try {
+    await initialize(config.providers || {}, { signal: controller.signal });
+    const provider = providerFor(route.provider);
+    if (!provider || typeof provider.send !== 'function') {
+      return result(`[explore error] provider "${route.provider}" is not ready`, true);
+    }
+    const settled = await Promise.all(
+      queries.map((query) =>
+        runExplorer({
+          query,
+          route,
+          provider,
+          cwd: ctx.cwd || null,
+          signal: controller.signal,
+          ownerSessionId: ctx.callerSessionId || null,
+        }).then(
+          (text) => {
+            const answer = String(text || '').trim();
+            return { ok: Boolean(answer), text: answer, late: timedOut };
+          },
+          (error) => ({ ok: false, error, late: timedOut })
+        )
+      )
+    );
+    if (parent?.aborted) return result('[explore error] cancelled', true);
+    const budget = Math.floor(EXPLORE_OUTPUT_CAP / queries.length);
+    const bodies = settled.map((entry) => {
+      if (entry.ok) return capped(entry.late ? `${entry.text}\n[explore: partial, timed out]` : entry.text, budget);
+      if (entry.late) return `[explore error] timed out after ${Math.round(timeoutMs / 1000)}s with no answer`;
+      if (entry.error) return `[explore error] ${shortened(String(entry.error?.message || entry.error), 500)}`;
+      return '[explore error] explorer returned no answer';
+    });
+    const text =
+      queries.length === 1
+        ? bodies[0]
+        : bodies
+            .map((body, i) => `## Q${i + 1}: ${shortened(queries[i].replace(/\s+/g, ' '), 100)}\n${body}`)
+            .join('\n\n');
+    return result(
+      text,
+      settled.every((entry) => !entry.ok)
+    );
+  } catch (error) {
+    if (parent?.aborted) return result('[explore error] cancelled', true);
+    return result(`[explore error] ${error?.message || error}`, true);
+  } finally {
+    clearTimeout(timer);
+    parent?.removeEventListener('abort', onParentAbort);
+  }
+}

package/src/runtime/memory/index.mjs

@@ -71,6 +71,7 @@ import {
 } from './lib/trace-store.mjs';
 import { writeJsonAtomicSync } from '../shared/atomic-file.mjs';
 import { safeIpcSend } from '../shared/safe-ipc-send.mjs';
+import { adoptSystemProxy } from '../shared/llm/system-proxy.mjs';
 import { resolvePluginData, mixdogHome } from '../shared/plugin-paths.mjs';
 import { scheduledCycle1Signature } from './lib/cycle-signatures.mjs';
 import { createTranscriptIngest } from './lib/transcript-ingest.mjs';
@@ -96,6 +97,9 @@ import {
 } from './lib/memory-config-flags.mjs';
 const IS_MEMORY_ENTRY = !!process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
 if (IS_MEMORY_ENTRY) {
+  // Runtime and model downloads follow the system proxy the launching daemon
+  // handed over (removed from this env so child processes never see it).
+  adoptSystemProxy();
   // Node's own warning printer stays off in this runtime, but a listener leak
   // is still logged, with the stack that names its source.
   process.removeAllListeners('warning');

package/src/runtime/memory/lib/embedding-provider.mjs

@@ -12,6 +12,7 @@ import { writeProfilePoint } from './model-profile.mjs';
 import { createCompactVectorCache } from './compact-vector-cache.mjs';
 import { EMBED_KEEP_WARM_MS } from './embedding-idle-lease.mjs';
 import { workerExecArgv } from '../../shared/worker-exec-argv.mjs';
+import { systemProxyHandoffEnv } from '../../shared/llm/system-proxy.mjs';
 import {
   getConfiguredEmbeddingModelId,
   getDefaultEmbeddingDtype,
@@ -69,7 +70,9 @@ function ensureWorker() {
   _lastRestartMs = now;
   const execArgv = embeddingWorkerExecArgv();
   const created = new Worker(WORKER_PATH, {
-    env: { ...process.env },
+    // The model download runs in this worker: it gets the system proxy
+    // decision explicitly (and removes it from its own env on start).
+    env: { ...process.env, ...systemProxyHandoffEnv() },
     execArgv,
     workerData: { dtype: _configuredDtype },
   });

package/src/runtime/memory/lib/embedding-worker.mjs

@@ -8,6 +8,7 @@ import os from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { resolvePluginData } from '../../shared/plugin-paths.mjs';
+import { adoptSystemProxy } from '../../shared/llm/system-proxy.mjs';
 import { compressEmbeddingModelCache } from './embedding-model-cache-compression.mjs';
 import { createIdleLease } from './embedding-idle-lease.mjs';
 import { ensureModelFile, ensureModelGraph } from './embedding-model-files.mjs';
@@ -24,6 +25,9 @@ import {
   prepareEmbeddingInput,
 } from './embedding-model-config.mjs';
 
+// The model download goes through the system proxy the parent handed over.
+adoptSystemProxy();
+
 const MODEL_ID = getConfiguredEmbeddingModelId();
 
 // Reroute ALL worker-thread stdio through parentPort. Without stdout:true/

package/src/runtime/office/quality/assurance-structure-docx.mjs

@@ -235,7 +235,7 @@ function shortTableSplitIssues(tables, issues) {
 }
 
 // A total row is a total by its label; it reads as one only when it is set apart from the rows it sums.
-export const TOTAL_LABEL = /^(?:(?:grand\s+total|sub\s*total|total)\b|(?:합계|총계|소계|계)(?:\s|$))/i;
+const TOTAL_LABEL = /^(?:(?:grand\s+total|sub\s*total|total)\b|(?:합계|총계|소계|계)(?:\s|$))/i;
 const FIGURE_TEXT = /^[\s+\-−₩$€¥]*[\d,.]+\s*(?:%|%p|[가-힣A-Za-z]{0,3})?\s*$/;
 const DISPLAY_SIZE = 18;
 

package/src/runtime/shared/agent-route-config.mjs

@@ -12,9 +12,16 @@ export const DEFAULT_DISABLED_AGENT_IDS = Object.freeze([
   'writer',
 ]);
 
+export const EXPLORE_AGENT_ID = 'explore';
+
 // The Maintainer also starts off: background upkeep spends model calls, so it
-// runs only once the user turns it on and picks its model.
-export const DEFAULT_DISABLED_AGENT_ROSTER = Object.freeze([...DEFAULT_DISABLED_AGENT_IDS, 'maintainer']);
+// runs only once the user turns it on and picks its model. Explore likewise:
+// its tool reaches the model only once the user picks its model.
+export const DEFAULT_DISABLED_AGENT_ROSTER = Object.freeze([
+  ...DEFAULT_DISABLED_AGENT_IDS,
+  'maintainer',
+  EXPLORE_AGENT_ID,
+]);
 
 /** The AGENT.md frontmatter `kind` the Workflows page writes when it creates
  *  an agent: a workflow delegation role, never a contact (봇). */
@@ -149,6 +156,14 @@ export function configuredAgentRouteCandidates(config, agentId) {
   return route ? [route] : [];
 }
 
+/** The explore tool runs only on Explore's own model (never Main) while it is on. */
+export function exploreRouteConfigured(config) {
+  return (
+    !isAgentDisabled(config, EXPLORE_AGENT_ID) &&
+    configuredAgentRouteCandidates(config, EXPLORE_AGENT_ID).some(isCompleteAgentRoute)
+  );
+}
+
 function canonicalizeAgentRoutes(config = {}) {
   const agents = Object.fromEntries(
     Object.entries(record(config.agents)).filter(([, route]) => isCompleteAgentRoute(route))

package/src/runtime/shared/atomic-file.mjs

@@ -128,12 +128,113 @@ export function renameWithRetrySync(src, dst, opts = {}) {
   }
 }
 
+// Windows refuses to rename over a file while any handle on it is open, so
+// this process's own reads of a busy state file (a delivery loop polling it)
+// could fail every attempt of its writer's rename until the retries ran out.
+// Here a rename attempt waits for the reads of its target in flight and holds
+// new ones off only while it runs; other processes are what the retries cover.
+// A read still open after RENAME_READ_WAIT_MS is left behind with its path's
+// entry (a stuck read must not hold the writer, its lock, or later readers),
+// and the attempt goes ahead under those same retries. Likewise a rename not
+// returned by then: readers held off read anyway, as without it. A reader's
+// bound counts from the rename call, not from the attempt's own (bounded)
+// wait for reads, so a rename that just started is never read across.
+export const RENAME_READ_WAIT_MS = 1_000;
+const targetUse = new Map();
+const targetKey = (path) => {
+  const full = resolve(path);
+  return process.platform === 'win32' ? full.toLowerCase() : full;
+};
+function useOf(key) {
+  let use = targetUse.get(key);
+  if (!use) targetUse.set(key, (use = { reads: 0, renaming: null, draining: null, drained: [] }));
+  return use;
+}
+function forgetIfIdle(key, use) {
+  if (use.reads === 0 && !use.renaming && targetUse.get(key) === use) targetUse.delete(key);
+}
+
+// Waits for the rename `use` runs; one that has not returned within the bound
+// is left behind with the entry, and the caller goes on as without it.
+async function outwaitRename(key, use) {
+  await use.draining;
+  if (use.renaming && !(await settlesWithin(use.renaming, RENAME_READ_WAIT_MS)) && targetUse.get(key) === use) {
+    targetUse.delete(key);
+  }
+  return useOf(key);
+}
+
+function settlesWithin(promise, ms) {
+  let timer;
+  const bound = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(false), ms);
+  });
+  return Promise.race([promise.then(() => true), bound]).finally(() => clearTimeout(timer));
+}
+
+async function readTarget(path, read) {
+  const key = targetKey(path);
+  let use = useOf(key);
+  while (use.renaming) use = await outwaitRename(key, use);
+  use.reads += 1;
+  try {
+    return await read();
+  } finally {
+    use.reads -= 1;
+    if (use.reads === 0) for (const done of use.drained.splice(0)) done();
+    forgetIfIdle(key, use);
+  }
+}
+
+async function renameOver(src, dst) {
+  const key = targetKey(dst);
+  let use = useOf(key);
+  while (use.renaming) use = await outwaitRename(key, use);
+  let finish;
+  use.renaming = new Promise((resolve) => {
+    finish = resolve;
+  });
+  use.draining = use.reads > 0 ? readsDrained(use, RENAME_READ_WAIT_MS) : null;
+  try {
+    if (use.draining && !(await use.draining) && targetUse.get(key) === use) targetUse.delete(key);
+    await renameAsync(src, dst);
+  } finally {
+    use.renaming = null;
+    use.draining = null;
+    finish();
+    forgetIfIdle(key, use);
+  }
+}
+
+// True once `use` has no read in flight, false after `ms` (its waiter removed).
+function readsDrained(use, ms) {
+  return new Promise((resolve) => {
+    const done = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    const timer = setTimeout(() => {
+      const at = use.drained.indexOf(done);
+      if (at >= 0) use.drained.splice(at, 1);
+      resolve(false);
+    }, ms);
+    use.drained.push(done);
+  });
+}
+
+/** Test seam: the per-path coordination left (entries, drain waiters). */
+export function _renameCoordinationForTest() {
+  let waiters = 0;
+  for (const use of targetUse.values()) waiters += use.drained.length;
+  return { entries: targetUse.size, waiters };
+}
+
 async function renameWithRetry(src, dst, opts = {}) {
   const backoffs = renameBackoffs(opts);
   let lastErr = null;
   for (let attempt = 0; attempt <= backoffs.length; attempt++) {
     try {
-      await renameAsync(src, dst);
+      await renameOver(src, dst);
       return true;
     } catch (err) {
       lastErr = err;
@@ -433,7 +534,7 @@ function readContentOrNullSync(filePath) {
 
 async function readContentOrNullAsync(filePath) {
   try {
-    return await readFileAsync(filePath);
+    return await readTarget(filePath, () => readFileAsync(filePath));
   } catch (err) {
     if (err?.code === 'ENOENT') return null;
     throw err;

package/src/runtime/shared/background-tasks.mjs

@@ -310,7 +310,9 @@ export function cleanupBackgroundTasks(options = {}) {
 function cancelRunningTask(task, reason, notify, terminalReason = null) {
   try {
     task.cancel?.();
-  } catch {}
+  } catch {
+    // A failing cancel hook must not stop the task from being marked cancelled.
+  }
   completeBackgroundTask(task.taskId, { status: 'cancelled', error: reason, notify: notify === true, terminalReason });
   if (task.notifyOnCancel !== true || notify === true || task.status !== 'cancelled' || task.cancelNotify) return;
   if (notify === false) {
@@ -370,9 +372,12 @@ export function cancelBackgroundTasks(options = {}) {
   const wanted = clean(options.surface);
   const executionSessionId = clean(options.executionSessionId);
   const scope = normalizeTaskScope(options);
-  let cancelled = 0;
+  // Optional: only tasks started at/after this time (a turn's own work).
+  const startedSinceMs = Number(options.startedSinceMs) || 0;
+  const taskIds = [];
   for (const task of [...tasks.values()]) {
     if (wanted && task.surface !== wanted) continue;
+    if (startedSinceMs > 0 && !(task.startedAtMs >= startedSinceMs)) continue;
     // Scoped teardown must be exact. Legacy tasks without ownership stay
     // visible/recoverable, but may not be claimed by whichever session happens
     // to close first.
@@ -386,9 +391,9 @@ export function cancelBackgroundTasks(options = {}) {
       continue;
     }
     cancelRunningTask(task, reason, options.notify, terminalReason);
-    cancelled += 1;
+    taskIds.push(task.taskId);
   }
-  return { cancelled };
+  return { cancelled: taskIds.length, taskIds };
 }
 
 export function acknowledgeBackgroundTaskCompletion(taskId, options = {}) {
@@ -415,13 +420,17 @@ function resultTextForTask(task) {
         // fallback below so the completion notification still carries a body.
         try {
           process.stderr.write(`[background-${task.surface}] renderResult failed: ${err?.message || err}\n`);
-        } catch {}
+        } catch {
+          // A closed stderr must not lose the completion body.
+        }
       }
     }
     if (typeof task.result === 'string') return task.result;
     try {
       return JSON.stringify(task.result, null, 2);
-    } catch {}
+    } catch {
+      // Unserializable result (circular, BigInt): fall back to the empty body.
+    }
   }
   return '';
 }

package/src/runtime/shared/connector-accounts.mjs

@@ -1,7 +1,7 @@
-// What a multi-account connector server tells the model about itself (MCP
+// What a connector server tells the model about its accounts (MCP
 // `instructions`), in one line: the connected accounts, and that each tool
-// takes `account` (asked of the user when several are connected and none was
-// named). An account that cannot be used right now is listed with why.
+// takes `account` (left out, the account used last). An account that cannot
+// be used right now is listed with why.
 
 /** The MCP instructions naming `accounts` (`{ email, note? }`, `note` a short
  *  reason it is unusable such as "needs sign-in"; one without an address is
@@ -12,12 +12,12 @@ export function connectorAccountsInstructions(accounts) {
   const list = named.map(({ email, note }) => (note ? `${email} (${note})` : email)).join(', ');
   return named.length === 1
     ? `Accounts: ${list}. \`account\` may be left out.`
-    : `Accounts: ${list}. Pass \`account\`; if the user named none and there are several, ask which.`;
+    : `Accounts: ${list}. \`account\` picks one; left out, a call uses the account used last, and its result names it.`;
 }
 
 /** The account addresses instructions from connectorAccountsInstructions name. */
 export function accountsOfInstructions(instructions) {
-  const list = /^Accounts: (.+?)\. (?:`account`|Pass `account`)/.exec(String(instructions || ''))?.[1] || '';
+  const list = /^Accounts: (.+?)\. `account`/.exec(String(instructions || ''))?.[1] || '';
   return list
     .split(', ')
     .map((part) => part.replace(/ \(.*\)$/, '').trim())

package/src/runtime/shared/connector-catalog.d.mts

@@ -40,8 +40,7 @@ export function connectorToolDefault(connectorId: string, tool: string): 'auto'
 export function connectorServerInput(
   entry: ConnectorCatalogEntry,
   name: string,
-  key?: string,
-  options?: { extraAccount?: boolean }
+  key?: string
 ): Record<string, unknown>;
 export function connectorAppPasswordOnly(entry: ConnectorCatalogEntry | null | undefined): boolean;
 export function connectorUsesGoogleClient(entry: ConnectorCatalogEntry | null | undefined): boolean;
@@ -52,12 +51,19 @@ export function gmailAppPasswordValue(value: unknown): string;
 export function gmailAppPasswordAccount(cfg: unknown): string;
 export function gmailAppPasswordServerInput(name: string, email: string, password: string): Record<string, unknown>;
 
-/** One stored account of a multi-account connector server. */
+/** One stored account of a connector server. */
 export interface ConnectorAccountEntry {
   name: string;
-  url: string;
+  /** Absent: http. */
+  type?: string;
+  url?: string;
   headers?: Record<string, string>;
   oauthClientId?: string;
+  /** The account's own sign-in key, when another account signs in at its URL. */
+  oauthKey?: string;
+  command?: string;
+  args?: string[];
+  env?: Record<string, string>;
   /** `false`: the account is kept but neither connected nor called. */
   enabled?: boolean;
 }
@@ -76,6 +82,7 @@ export function withConnectorAccountEnabled(
   enabled: boolean
 ): Record<string, unknown>;
 export function connectorAccountEntry(name: string, cfg: Record<string, unknown>): ConnectorAccountEntry;
+export function connectorServerSettings(cfg: Record<string, unknown>): Record<string, unknown>;
 export function mergeConnectorAccountServers(servers: Record<string, unknown>): {
   servers: Record<string, unknown>;
   merged: { connector: string; name: string; from: string[] }[];