mixdog 1.4.1 → 1.4.3

package/src/runtime/channels/lib/whisper-server.mjs

@@ -40,6 +40,7 @@ import fs from 'node:fs';
 import { spawn, spawnSync } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
 import { windowsSystemRoot } from '../../agent/orchestrator/tools/builtin/windows-roots.mjs';
+import { killProcessTrees } from '../../agent/orchestrator/mcp/child-tree.mjs';
 import { selectWhisperPort, whisperListenerOwned } from './whisper-port.mjs';
 
 // ── Tunables (deterministic; no ranges) ──────────────────────────────────────
@@ -80,6 +81,9 @@ const mgr = {
   child: null, // ChildProcess handle (non-detached)
   port: null, // selected port; must belong to the current child
   host: null,
+  // Ownership proven for this child+port. A live child keeps its bound port, so
+  // no other process can take it; cleared whenever the child goes away.
+  proof: null, // { child, port }
   runtimeKey: null, // exact contract fingerprint
   contract: null, // { serverCmd, modelPath, threadCount, host }
   startPromise: null, // in-flight ensureReady() start
@@ -214,16 +218,13 @@ function isOwnedWhisperServer(pid, { modelPath, port } = {}) {
   return modelMatch || portMatch;
 }
 
-function killPid(pid, force) {
+// `aliveAt`: when `pid` was last known to be the process meant (a live child
+// handle: now; a proven stale child: before its proof). Windows has no graceful
+// stop for a console server, so both steps run the shared tree kill.
+async function killPid(pid, force, aliveAt = Date.now()) {
   if (!pid) return;
   if (IS_WIN) {
-    const args = ['/PID', String(pid), '/T'];
-    if (force) args.push('/F');
-    try {
-      spawnSync('taskkill', args, { windowsHide: true });
-    } catch {
-      /* best-effort */
-    }
+    await killProcessTrees([pid], { aliveAt });
     return;
   }
   try {
@@ -322,14 +323,15 @@ async function teardown(reason) {
         resolve();
       }
     });
-    killPid(pid, false);
+    void killPid(pid, false);
     const raced = await Promise.race([exited, delay(STOP_GRACE_MS, 'timeout')]);
     if (raced === 'timeout') {
-      killPid(pid, true); // escalate
+      void killPid(pid, true); // escalate
       await Promise.race([exited, delay(STOP_GRACE_MS, 'timeout')]);
     }
   }
   mgr.child = null;
+  mgr.proof = null;
   mgr.port = null;
   mgr.host = null;
   mgr.runtimeKey = null;
@@ -357,6 +359,7 @@ function wireChildExit() {
     detachChildHandlers();
     clearPidMeta();
     mgr.child = null;
+    mgr.proof = null;
     mgr.port = null;
     mgr.runtimeKey = null;
     mgr.contract = null;
@@ -379,11 +382,13 @@ async function startServer(contract) {
   // Prefer the recorded meta's own contract fields; fall back to the contract we
   // are about to start. A non-positive match → never kill (fail closed).
   const ownArgs = { modelPath: meta?.modelPath ?? modelPath, port: meta?.port ?? FIXED_PORT };
+  const provenAt = Date.now();
   if (meta && isOwnedWhisperServer(meta.pid, ownArgs)) {
-    killPid(meta.pid, false);
+    await killPid(meta.pid, false, provenAt);
     await delay(500);
+    const reprovenAt = Date.now();
     if (isOwnedWhisperServer(meta.pid, ownArgs)) {
-      killPid(meta.pid, true);
+      await killPid(meta.pid, true, reprovenAt);
       await delay(500);
     }
     clearPidMeta();
@@ -435,6 +440,7 @@ async function startServer(contract) {
       mgr.state === STATE.STARTING
     ) {
       mgr.port = port;
+      mgr.proof = { child, port };
       mgr.state = STATE.READY;
       return;
     }
@@ -509,7 +515,10 @@ export async function transcribe(wavPath, { language } = {}) {
   try {
     const [data, owned] = await Promise.all([
       fs.promises.readFile(wavPath),
-      whisperListenerOwned(host, port, child.pid),
+      // Proven at readiness for this live child; re-prove only without that proof.
+      mgr.proof?.child === child && mgr.proof.port === port && child.exitCode === null
+        ? true
+        : whisperListenerOwned(host, port, child.pid),
     ]);
     // Re-check after the awaits: a replacement listener (or child) must never
     // receive audio. Nothing awaits between this check and the request.

package/src/runtime/channels/lib/worker-main.mjs

@@ -18,7 +18,7 @@ import {
   cleanupInstanceRuntimeFiles,
   clearServerPid,
 } from './runtime-paths.mjs';
-import { invalidateConfigReadCache } from '../../shared/config.mjs';
+import { createConfigReloadWatch } from './config-reload-watch.mjs';
 import { bootProfile, utcTimestamp } from './boot-profile.mjs';
 import {
   isChannelsDegraded,
@@ -121,9 +121,6 @@ function writeBridgeState(active) {
 function isChannelBridgeActive() {
   return channelBridgeActive;
 }
-// Config hot-reload watcher (installed by start(); torn down by stop()).
-let _configWatcher = null;
-let _reloadDebounce = null;
 const STATUS_FILE = getStatusPath(INSTANCE_ID);
 const statusState = new JsonStateFile(STATUS_FILE, {});
 statusState.ensure();
@@ -201,6 +198,7 @@ function wireWebhookHandlers() {
     const run = await runWebhookSession({
       name: context?.endpoint || 'webhook',
       ownerAgentId: context?.owner || null,
+      executorAgentId: context?.executor || null,
       cwd: cwd || null,
       attachments: attachments || null,
       event: context?.event || '',
@@ -252,24 +250,14 @@ const { handleToolCall } = createToolDispatch({
       }),
   },
 });
-function ensureConfigWatcher() {
-  if (_configWatcher) return;
-  try {
-    _configWatcher = fs.watch(path.join(DATA_DIR, 'mixdog-config.json'), () => {
-      invalidateConfigReadCache();
-      if (_reloadDebounce) clearTimeout(_reloadDebounce);
-      _reloadDebounce = setTimeout(() => {
-        reloadRuntimeConfig().catch(() => {});
-      }, 500);
-    });
-  } catch {}
-}
+// Config hot reload (started by start(); stopped by stop()).
+const configReloadWatch = createConfigReloadWatch(reloadRuntimeConfig);
 async function start(options = {}) {
   if (options?.bridge === false) {
     channelBridgeActive = false;
     writeBridgeState(false);
     await startAutomationRuntime();
-    ensureConfigWatcher();
+    configReloadWatch.start();
     return;
   }
   channelBridgeActive = true;
@@ -283,10 +271,9 @@ async function start(options = {}) {
   } catch {
     // Non-fatal: owned-runtime start errors degrade to automation-only mode.
   }
-  // Hot-reload config on file change (schedules/webhooks/events).
-  // Cross-process edits invalidate the raw config cache before the debounced
-  // reload so both bridge and automation-only daemon modes stay current.
-  ensureConfigWatcher();
+  // Hot-reload config on change (schedules/webhooks/events), in both bridge
+  // and automation-only daemon modes.
+  configReloadWatch.start();
   // Pre-warm the whisper-server manager once at owner startup so the first
   // voice transcription does not pay cold-start cost. Non-blocking: failures
   // (e.g. runtime not installed) are swallowed; per-request ensureReady retries.
@@ -314,16 +301,7 @@ async function stop() {
   } catch {}
   await stopOwnedRuntime('unified server stop');
   cleanupInstanceRuntimeFiles(INSTANCE_ID);
-  if (_reloadDebounce) {
-    clearTimeout(_reloadDebounce);
-    _reloadDebounce = null;
-  }
-  if (_configWatcher) {
-    try {
-      _configWatcher.close();
-    } catch {}
-    _configWatcher = null;
-  }
+  configReloadWatch.stop();
 }
 // ── IPC worker mode ──────────────────────────────────────────────
 // Skipped under the machine-global host (MIXDOG_DAEMON_HOST=1): the daemon

package/src/runtime/computer-bridge/linux-readiness.mjs

@@ -10,25 +10,25 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { isForegroundWindowCapture, requiredCapabilities } from './linux-action-capabilities.mjs';
 
-export const UINPUT_HINT =
+const UINPUT_HINT =
   'input_unavailable: Wayland input needs write access to /dev/uinput; add the udev rule `KERNEL=="uinput", GROUP="input", MODE="0660", OPTIONS+="static_node=uinput"`, add your user to the input group, then sign in again';
 export const INPUT_GROUP_SECURITY_NOTE =
   'Security note: membership of the input group lets every program you run read and inject keyboard and mouse input system-wide. Grant it only on a machine and account you trust.';
 export const GNOME_EXTENSION_UUID = 'mixdog-windows@mixdog.io';
 /** The oldest helper interface this app can use (2 added Screenshot and StopRequested, 3 the in-shell indicator). */
 export const MIN_WINDOW_HELPER_VERSION = 3;
-export const WINDOW_HELPER_RELOGIN_HINT =
+const WINDOW_HELPER_RELOGIN_HINT =
   'wayland_window_control_unavailable: the Mixdog Windows GNOME extension is installed and enabled but GNOME Shell has not loaded it yet; the user must sign out and sign in again once';
-export const WINDOW_HELPER_ENABLE_HINT =
+const WINDOW_HELPER_ENABLE_HINT =
   'wayland_window_control_unavailable: the Mixdog Windows GNOME extension is not enabled; it could not be enabled automatically (run gnome-extensions enable mixdog-windows@mixdog.io)';
-export const WINDOW_CONTROL_UNSUPPORTED_HINT =
+const WINDOW_CONTROL_UNSUPPORTED_HINT =
   'wayland_window_control_unavailable: this desktop offers no window control to other programs (supported: GNOME with the Mixdog Windows extension, sway, Hyprland, or an X11 session); screen, pointer, keyboard and clipboard still work';
-export const ACCESSIBILITY_HINT = 'accessibility_unavailable: the AT-SPI bus is not running; install at-spi2-core';
+const ACCESSIBILITY_HINT = 'accessibility_unavailable: the AT-SPI bus is not running; install at-spi2-core';
 export const TESSERACT_HINT =
   'ocr_unavailable: install Tesseract (for example `sudo apt install tesseract-ocr tesseract-ocr-kor`) to read text from pixels';
 export const CLIPBOARD_HINT =
   'clipboard_unavailable: install wl-clipboard (`wl-copy`/`wl-paste`) for clipboard access on Wayland';
-export const DISPLAY_HINT =
+const DISPLAY_HINT =
   'display_unavailable: no graphical session to drive; run inside a desktop session with DISPLAY (X11) or WAYLAND_DISPLAY set';
 
 /** Stable code of the whole refusal; the per-capability codes are the native ones. */
@@ -301,14 +301,10 @@ function capabilityIssue(name, readiness) {
     return { code: 'display_unavailable', message: DISPLAY_HINT };
   // Semantic actions fail on whichever of their two prerequisites is missing.
   const gnomeWayland = readiness.session === 'wayland' && readiness.desktop === 'gnome';
-  const target =
-    name === 'semanticActions'
-      ? readiness.capabilities.windows.state === 'ready'
-        ? 'accessibility'
-        : 'windows'
-      : name === 'capture' && gnomeWayland
-        ? 'windows'
-        : name;
+  let target = name;
+  if (name === 'semanticActions')
+    target = readiness.capabilities.windows.state === 'ready' ? 'accessibility' : 'windows';
+  else if (name === 'capture' && gnomeWayland) target = 'windows';
   const capability = readiness.capabilities[target];
   switch (target) {
     case 'windows':