mixdog 1.4.2 → 1.4.3

package/src/runtime/attachments/attachment-reference.mjs

@@ -33,7 +33,7 @@ function quotedName(name, fallback) {
 }
 
 /** How much of a PDF reads as text, in words the model can act on. */
-export function textLayerLabel(pageCount, textPages) {
+function textLayerLabel(pageCount, textPages) {
   const pages = Number(pageCount);
   const withText = Number(textPages);
   if (!(pages > 0) || !Number.isFinite(withText) || withText < 0) return 'text layer not checked';

package/src/runtime/attachments/pdf-extract.mjs

@@ -81,7 +81,7 @@ export const PDF_INTAKE_TIMEOUT_MS = 60_000;
 // least this many non-whitespace characters. A scan often keeps a stamped page
 // number or a few stray glyphs; those alone do not make its content readable
 // as text, so such a page still needs its image (or OCR).
-export const PDF_TEXT_LAYER_MIN_CHARS = 16;
+const PDF_TEXT_LAYER_MIN_CHARS = 16;
 
 /** Whether one page's extracted text is a real text layer (see above). */
 export function pageHasTextLayer(text) {

package/src/runtime/attachments/store.d.mts

@@ -1,4 +1,5 @@
 export function readAttachmentBuffer(value: string | { attachmentRef?: string }): Buffer;
+export function attachmentBlobSize(value: string | { attachmentRef?: string }, claimed?: number): number;
 export function isPermanentAttachmentError(error: unknown): boolean;
 export function isAttachmentReference(value: unknown): boolean;
 export interface MessageAttachment {

package/src/runtime/attachments/store.mjs

@@ -298,7 +298,7 @@ const ATTACHMENT_INTEGRITY = 'ATTACHMENT_INTEGRITY';
 
 // A referenced blob that is gone from disk (retention, manual cleanup, a
 // copied session) surfaces from readAttachmentBuffer as the stat ENOENT.
-export function isMissingAttachmentError(error) {
+function isMissingAttachmentError(error) {
   return error?.code === 'ENOENT';
 }
 
@@ -316,7 +316,7 @@ export function readAttachmentBase64(value) {
 // Real on-disk size of a referenced blob. Caps must never trust the client's
 // claimed sizeBytes; a blob that is not on disk cannot be read later either, so
 // only then does the claimed size stand.
-function attachmentBlobSize(value, claimed = 0) {
+export function attachmentBlobSize(value, claimed = 0) {
   try {
     return statSync(attachmentPath(typeof value === 'string' ? value : value?.attachmentRef)).size;
   } catch (error) {

package/src/runtime/channels/lib/config-reload-watch.mjs

@@ -0,0 +1,42 @@
+// The channels worker's config hot reload (schedules, webhooks, events, voice).
+// It rides the shared config-change subscription: that watches the data
+// directory, so the atomic rename of every write never orphans it, it recovers
+// from watcher errors, and it carries in-process writes and keychain changes.
+// A reload restarts the webhook server and hook tunnel, so only a change of
+// the sections the worker reads (channels: webhook, events, …; voice) reloads;
+// schedules arrive through the reload_config IPC, never through this watch.
+import { readSection, subscribeConfigChange } from '../../shared/config.mjs';
+
+function channelsConfigSnapshot() {
+  return JSON.stringify([readSection('channels') ?? null, readSection('voice') ?? null]);
+}
+
+export function createConfigReloadWatch(reload, { snapshot = channelsConfigSnapshot } = {}) {
+  let unsubscribe = null;
+  let applied = null;
+  const read = () => {
+    try {
+      return snapshot();
+    } catch {
+      return null;
+    }
+  };
+  return {
+    start() {
+      if (unsubscribe) return;
+      applied = read();
+      unsubscribe = subscribeConfigChange(() => {
+        const next = read();
+        if (next !== null && next === applied) return;
+        applied = next;
+        Promise.resolve()
+          .then(reload)
+          .catch(() => {});
+      });
+    },
+    stop() {
+      unsubscribe?.();
+      unsubscribe = null;
+    },
+  };
+}

package/src/runtime/channels/lib/owned-runtime/config-reload.mjs

@@ -1,6 +1,19 @@
 import { loadConfig } from '../config.mjs';
 
-export function createConfigReloader({ state, getConfig, setConfig, getBridgeRuntimeConnected, scheduler, services }) {
+export function createConfigReloader({
+  state,
+  getConfig,
+  setConfig,
+  getBridgeRuntimeConnected,
+  scheduler,
+  services,
+  load = loadConfig,
+}) {
+  // Reloads overlap (no debounce), so a slower load of an older config must not
+  // be applied over a newer one: only the newest started reload applies, and an
+  // older caller waits for it instead.
+  let latestStarted = 0;
+  let latestReload = null;
   function reloadScheduler() {
     // The scheduler must be RE-ARMED by the reload whenever it is supposed to
     // be running: `restart: false` only destroys the cron/one-shot bindings and
@@ -12,13 +25,20 @@ export function createConfigReloader({ state, getConfig, setConfig, getBridgeRun
       restart: state.automationRunning || getBridgeRuntimeConnected(),
     });
   }
-  return async function reloadRuntimeConfig() {
-    setConfig(await loadConfig());
-    reloadScheduler();
-    if (getBridgeRuntimeConnected() || state.automationRunning) {
-      services.syncWebhookAndEventRuntime({ reload: true });
-    } else {
-      await services.stopWebhookAndEventRuntime();
-    }
+  return function reloadRuntimeConfig() {
+    const ticket = ++latestStarted;
+    const run = (async () => {
+      const loaded = await load();
+      if (ticket !== latestStarted) return latestReload;
+      setConfig(loaded);
+      reloadScheduler();
+      if (getBridgeRuntimeConnected() || state.automationRunning) {
+        services.syncWebhookAndEventRuntime({ reload: true });
+      } else {
+        await services.stopWebhookAndEventRuntime();
+      }
+    })();
+    latestReload = run;
+    return run;
   };
 }

package/src/runtime/channels/lib/scheduler.mjs

@@ -9,6 +9,7 @@ import { isPidAlive } from '../../shared/pid-liveness.mjs';
 import {
   advanceScheduleCursor,
   claimScheduleRun,
+  getSchedule,
   markFired,
   markDone,
   markScheduleFailure,
@@ -76,6 +77,14 @@ function isCronExpression(time) {
     return false;
   }
 }
+// Two one-shot times name the same instant. The database hands back a new
+// Date on every read, so identity would call an unchanged schedule changed.
+function sameInstant(left, right) {
+  if (left == null || right == null) return (left ?? null) === (right ?? null);
+  const at = (value) => (value instanceof Date ? value.getTime() : Date.parse(value));
+  const [a, b] = [at(left), at(right)];
+  return Number.isNaN(a) || Number.isNaN(b) ? String(left) === String(right) : a === b;
+}
 // True when this fire (started at `since`) ended in an overlap skip.
 function skippedSince(schedule, since) {
   const at = schedule.lastSkippedAt ? new Date(schedule.lastSkippedAt).getTime() : 0;
@@ -616,6 +625,30 @@ class Scheduler {
   }
   // ── Fire timed schedule ─────────────────────────────────────────────
   async fireTimed(schedule, opts = {}) {
+    // The armed copy may be stale (a reload that failed or has not arrived):
+    // the stored row decides whether, and with what prompt, it still fires.
+    let row;
+    try {
+      row = await getSchedule(schedule.name);
+    } catch (err) {
+      logSchedule(`${schedule.name}: not fired — schedule unreadable: ${err?.message || err}\n`);
+      this.notifyFailure(schedule, 'schedule unreadable — fire skipped');
+      return false;
+    }
+    const sameCron = (row?.whenCron ?? null) === (schedule.whenCron ?? null);
+    if (
+      !row ||
+      row.enabled === false ||
+      row.status === 'done' ||
+      !sameInstant(row.whenAt, schedule.whenAt) ||
+      !sameCron
+    ) {
+      logSchedule(`${schedule.name}: not fired — deleted or changed since it was armed\n`);
+      // A skip, not a failed run: the callers record no failure on its row.
+      schedule.lastSkippedAt = new Date().toISOString();
+      return false;
+    }
+    schedule.prompt = row.prompt;
     const prompt = this.resolvePrompt(schedule);
     if (!prompt) {
       process.stderr.write(`mixdog scheduler: prompt not found for "${schedule.name}"

package/src/runtime/channels/lib/schedules-db.mjs

@@ -60,6 +60,9 @@ ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS last_skipped_at timesta
 ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS owner_agent_id text NOT NULL DEFAULT 'lead';
 -- Legacy columns model, workflow and run_as_agent are no longer read or written (kept, not dropped, to avoid a risky migration).
 ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS run_as_agent boolean NOT NULL DEFAULT false;
+-- The workflow sub-agent that carries out each fire first (its final report is
+-- what the owner bot relays); NULL = the owner bot does the work itself.
+ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS executor_agent_id text;
 -- Failed runs in a row: a success or switching it back on resets it; at
 -- ROUTINE_LIMITS.pauseAfterFailures the schedule switches itself off.
 ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS consecutive_failures integer NOT NULL DEFAULT 0;
@@ -101,6 +104,7 @@ function rowToDef(row) {
     lastFailedAt: row.last_failed_at,
     lastSkippedAt: row.last_skipped_at,
     ownerAgentId: row.owner_agent_id || 'lead',
+    executorAgentId: row.executor_agent_id || null,
     consecutiveFailures: Number(row.consecutive_failures) || 0,
     resultDelivery: row.result_delivery || null,
     nextFireAt: row.next_fire_at,
@@ -136,7 +140,7 @@ function hasRequiredTargetColumn(db) {
 }
 
 const COLS =
-  'name, description, when_at, when_cron, timezone, cwd, attachments, delivery, prompt, enabled, status, last_fired_at, last_scheduled_at, last_started_at, last_success_at, last_failed_at, last_skipped_at, owner_agent_id, consecutive_failures, result_delivery, next_fire_at, deferred_until, skipped_until, created_at, updated_at';
+  'name, description, when_at, when_cron, timezone, cwd, attachments, delivery, prompt, enabled, status, last_fired_at, last_scheduled_at, last_started_at, last_success_at, last_failed_at, last_skipped_at, owner_agent_id, executor_agent_id, consecutive_failures, result_delivery, next_fire_at, deferred_until, skipped_until, created_at, updated_at';
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -176,6 +180,7 @@ export async function upsertSchedule(def, { dataDir } = {}) {
     def.status ?? 'active',
     def.nextFireAt ?? null,
     def.ownerAgentId || 'lead',
+    def.executorAgentId || null,
   ];
   let legacyTarget = '';
   let legacyTargetValue = '';
@@ -186,10 +191,11 @@ export async function upsertSchedule(def, { dataDir } = {}) {
   }
   const { rows } = await db.query(
     `INSERT INTO scheduler.schedules
-       (name, description, when_at, when_cron, timezone, cwd, attachments, delivery, prompt, enabled, status, next_fire_at, owner_agent_id${legacyTarget})
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13${legacyTargetValue})
+       (name, description, when_at, when_cron, timezone, cwd, attachments, delivery, prompt, enabled, status, next_fire_at, owner_agent_id, executor_agent_id${legacyTarget})
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14${legacyTargetValue})
      ON CONFLICT (name) DO UPDATE SET
        owner_agent_id = EXCLUDED.owner_agent_id,
+       executor_agent_id = EXCLUDED.executor_agent_id,
        description  = EXCLUDED.description,
        when_at      = EXCLUDED.when_at,
        when_cron    = EXCLUDED.when_cron,
@@ -235,7 +241,7 @@ export async function renameSchedule(oldName, def, { timingChanged = false, data
     const { rows } = await db.query(
       `UPDATE scheduler.schedules SET
          name = $2, description = $3, when_at = $4, when_cron = $5, timezone = $6, cwd = $7,
-         attachments = $8, prompt = $9, enabled = $10, owner_agent_id = $11,
+         attachments = $8, prompt = $9, enabled = $10, owner_agent_id = $11, executor_agent_id = $13,
          next_fire_at = CASE WHEN $12::boolean THEN $4::timestamptz ELSE next_fire_at END,
          status = CASE WHEN $12::boolean THEN 'active' ELSE status END,
          deferred_until = CASE WHEN $12::boolean THEN NULL ELSE deferred_until END,
@@ -258,6 +264,7 @@ export async function renameSchedule(oldName, def, { timingChanged = false, data
         def.enabled ?? true,
         def.ownerAgentId || 'lead',
         timingChanged === true,
+        def.executorAgentId || null,
       ]
     );
     return rowToDef(rows[0]);

package/src/runtime/channels/lib/webhook/session-dispatch.mjs

@@ -96,6 +96,8 @@ function createWebhookSessionDispatcher({ getBridgeDispatch, store = { recordEnd
           endpoint: name,
           // The bot whose chat the run is a turn in.
           owner: extra.owner || null,
+          // The sub-agent that carries the run out first, if the endpoint names one.
+          executor: extra.executor || null,
           deliveryId,
           event: extra.event || null,
         },
@@ -108,7 +110,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch, store = { recordEnd
 
   async function dispatchEndpoint({ name, body, headers, res, deliveryId, endpoint }) {
     try {
-      const { instructions, cwd, attachments, delivery, ownerAgentId } = endpoint;
+      const { instructions, cwd, attachments, delivery, ownerAgentId, executorAgentId } = endpoint;
       const run = webhookRunPrompt(instructions, body, headers);
       if (!getBridgeDispatch()) throw new Error(`[webhook] session dispatch requires bridgeDispatch`);
       // Kept for the app's "Run now", which re-runs the latest event. Losing
@@ -118,6 +120,7 @@ function createWebhookSessionDispatcher({ getBridgeDispatch, store = { recordEnd
       );
       await dispatchSessionRun(name, run.prompt, deliveryId, res, {
         owner: ownerAgentId || null,
+        executor: executorAgentId || null,
         cwd: cwd || null,
         event: webhookEventSummary(headers, body),
         attachments: attachments || null,

package/src/runtime/channels/lib/webhooks-db.mjs

@@ -45,6 +45,9 @@ ALTER TABLE webhooks.endpoints ALTER COLUMN role SET DEFAULT '';
 ALTER TABLE webhooks.endpoints ADD COLUMN IF NOT EXISTS owner_agent_id text NOT NULL DEFAULT 'lead';
 -- Legacy columns model, workflow and run_as_agent are no longer read or written (kept, not dropped, to avoid a risky migration).
 ALTER TABLE webhooks.endpoints ADD COLUMN IF NOT EXISTS run_as_agent boolean NOT NULL DEFAULT false;
+-- The workflow sub-agent that carries out each run first (its final report is
+-- what the owner bot relays); NULL = the owner bot does the work itself.
+ALTER TABLE webhooks.endpoints ADD COLUMN IF NOT EXISTS executor_agent_id text;
 -- The latest received event (its payload kept for a manual re-run) and the
 -- outcome stamps of the runs it started.
 ALTER TABLE webhooks.endpoints ADD COLUMN IF NOT EXISTS last_event_at timestamptz;
@@ -86,7 +89,7 @@ const getDb = createPgSchemaDb({
 // The stored payload itself is never projected here (readEndpointLastPayload
 // is its only read path); rows carry a presence flag.
 const ENDPOINT_COLS =
-  'name, description, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id, last_event_at, last_success_at, last_failed_at, last_skipped_at, consecutive_failures, result_delivery, (last_payload IS NOT NULL) AS has_last_payload, created_at, updated_at';
+  'name, description, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id, executor_agent_id, last_event_at, last_success_at, last_failed_at, last_skipped_at, consecutive_failures, result_delivery, (last_payload IS NOT NULL) AS has_last_payload, created_at, updated_at';
 
 function rowToEndpoint(row) {
   if (!row) return null;
@@ -104,6 +107,7 @@ function rowToEndpoint(row) {
     instructions: row.instructions,
     enabled: row.enabled,
     ownerAgentId: row.owner_agent_id || 'lead',
+    executorAgentId: row.executor_agent_id || null,
     lastEventAt: row.last_event_at || null,
     lastSuccessAt: row.last_success_at || null,
     lastFailedAt: row.last_failed_at || null,
@@ -187,15 +191,17 @@ export async function upsertEndpoint(def, { dataDir } = {}) {
     def.instructions ?? '',
     def.enabled ?? true,
     def.ownerAgentId || 'lead',
+    def.executorAgentId || null,
   ];
   // The last event and run stamps survive an edit: they describe deliveries,
   // not the definition.
   const { rows } = await db.query(
     `INSERT INTO webhooks.endpoints
-       (name, description, role, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id)
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)
+       (name, description, role, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id, executor_agent_id)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)
      ON CONFLICT (name) DO UPDATE SET
        owner_agent_id = EXCLUDED.owner_agent_id,
+       executor_agent_id = EXCLUDED.executor_agent_id,
        description  = EXCLUDED.description,
        role        = EXCLUDED.role,
        parser       = EXCLUDED.parser,

package/src/runtime/channels/lib/whisper-server.mjs

@@ -40,6 +40,7 @@ import fs from 'node:fs';
 import { spawn, spawnSync } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
 import { windowsSystemRoot } from '../../agent/orchestrator/tools/builtin/windows-roots.mjs';
+import { killProcessTrees } from '../../agent/orchestrator/mcp/child-tree.mjs';
 import { selectWhisperPort, whisperListenerOwned } from './whisper-port.mjs';
 
 // ── Tunables (deterministic; no ranges) ──────────────────────────────────────
@@ -217,16 +218,13 @@ function isOwnedWhisperServer(pid, { modelPath, port } = {}) {
   return modelMatch || portMatch;
 }
 
-function killPid(pid, force) {
+// `aliveAt`: when `pid` was last known to be the process meant (a live child
+// handle: now; a proven stale child: before its proof). Windows has no graceful
+// stop for a console server, so both steps run the shared tree kill.
+async function killPid(pid, force, aliveAt = Date.now()) {
   if (!pid) return;
   if (IS_WIN) {
-    const args = ['/PID', String(pid), '/T'];
-    if (force) args.push('/F');
-    try {
-      spawnSync('taskkill', args, { windowsHide: true });
-    } catch {
-      /* best-effort */
-    }
+    await killProcessTrees([pid], { aliveAt });
     return;
   }
   try {
@@ -325,10 +323,10 @@ async function teardown(reason) {
         resolve();
       }
     });
-    killPid(pid, false);
+    void killPid(pid, false);
     const raced = await Promise.race([exited, delay(STOP_GRACE_MS, 'timeout')]);
     if (raced === 'timeout') {
-      killPid(pid, true); // escalate
+      void killPid(pid, true); // escalate
       await Promise.race([exited, delay(STOP_GRACE_MS, 'timeout')]);
     }
   }
@@ -384,11 +382,13 @@ async function startServer(contract) {
   // Prefer the recorded meta's own contract fields; fall back to the contract we
   // are about to start. A non-positive match → never kill (fail closed).
   const ownArgs = { modelPath: meta?.modelPath ?? modelPath, port: meta?.port ?? FIXED_PORT };
+  const provenAt = Date.now();
   if (meta && isOwnedWhisperServer(meta.pid, ownArgs)) {
-    killPid(meta.pid, false);
+    await killPid(meta.pid, false, provenAt);
     await delay(500);
+    const reprovenAt = Date.now();
     if (isOwnedWhisperServer(meta.pid, ownArgs)) {
-      killPid(meta.pid, true);
+      await killPid(meta.pid, true, reprovenAt);
       await delay(500);
     }
     clearPidMeta();

package/src/runtime/channels/lib/worker-main.mjs

@@ -18,7 +18,7 @@ import {
   cleanupInstanceRuntimeFiles,
   clearServerPid,
 } from './runtime-paths.mjs';
-import { invalidateConfigReadCache } from '../../shared/config.mjs';
+import { createConfigReloadWatch } from './config-reload-watch.mjs';
 import { bootProfile, utcTimestamp } from './boot-profile.mjs';
 import {
   isChannelsDegraded,
@@ -121,9 +121,6 @@ function writeBridgeState(active) {
 function isChannelBridgeActive() {
   return channelBridgeActive;
 }
-// Config hot-reload watcher (installed by start(); torn down by stop()).
-let _configWatcher = null;
-let _reloadDebounce = null;
 const STATUS_FILE = getStatusPath(INSTANCE_ID);
 const statusState = new JsonStateFile(STATUS_FILE, {});
 statusState.ensure();
@@ -201,6 +198,7 @@ function wireWebhookHandlers() {
     const run = await runWebhookSession({
       name: context?.endpoint || 'webhook',
       ownerAgentId: context?.owner || null,
+      executorAgentId: context?.executor || null,
       cwd: cwd || null,
       attachments: attachments || null,
       event: context?.event || '',
@@ -252,24 +250,14 @@ const { handleToolCall } = createToolDispatch({
       }),
   },
 });
-function ensureConfigWatcher() {
-  if (_configWatcher) return;
-  try {
-    _configWatcher = fs.watch(path.join(DATA_DIR, 'mixdog-config.json'), () => {
-      invalidateConfigReadCache();
-      if (_reloadDebounce) clearTimeout(_reloadDebounce);
-      _reloadDebounce = setTimeout(() => {
-        reloadRuntimeConfig().catch(() => {});
-      }, 500);
-    });
-  } catch {}
-}
+// Config hot reload (started by start(); stopped by stop()).
+const configReloadWatch = createConfigReloadWatch(reloadRuntimeConfig);
 async function start(options = {}) {
   if (options?.bridge === false) {
     channelBridgeActive = false;
     writeBridgeState(false);
     await startAutomationRuntime();
-    ensureConfigWatcher();
+    configReloadWatch.start();
     return;
   }
   channelBridgeActive = true;
@@ -283,10 +271,9 @@ async function start(options = {}) {
   } catch {
     // Non-fatal: owned-runtime start errors degrade to automation-only mode.
   }
-  // Hot-reload config on file change (schedules/webhooks/events).
-  // Cross-process edits invalidate the raw config cache before the debounced
-  // reload so both bridge and automation-only daemon modes stay current.
-  ensureConfigWatcher();
+  // Hot-reload config on change (schedules/webhooks/events), in both bridge
+  // and automation-only daemon modes.
+  configReloadWatch.start();
   // Pre-warm the whisper-server manager once at owner startup so the first
   // voice transcription does not pay cold-start cost. Non-blocking: failures
   // (e.g. runtime not installed) are swallowed; per-request ensureReady retries.
@@ -314,16 +301,7 @@ async function stop() {
   } catch {}
   await stopOwnedRuntime('unified server stop');
   cleanupInstanceRuntimeFiles(INSTANCE_ID);
-  if (_reloadDebounce) {
-    clearTimeout(_reloadDebounce);
-    _reloadDebounce = null;
-  }
-  if (_configWatcher) {
-    try {
-      _configWatcher.close();
-    } catch {}
-    _configWatcher = null;
-  }
+  configReloadWatch.stop();
 }
 // ── IPC worker mode ──────────────────────────────────────────────
 // Skipped under the machine-global host (MIXDOG_DAEMON_HOST=1): the daemon

package/src/runtime/computer-bridge/linux-readiness.mjs

@@ -10,25 +10,25 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { isForegroundWindowCapture, requiredCapabilities } from './linux-action-capabilities.mjs';
 
-export const UINPUT_HINT =
+const UINPUT_HINT =
   'input_unavailable: Wayland input needs write access to /dev/uinput; add the udev rule `KERNEL=="uinput", GROUP="input", MODE="0660", OPTIONS+="static_node=uinput"`, add your user to the input group, then sign in again';
 export const INPUT_GROUP_SECURITY_NOTE =
   'Security note: membership of the input group lets every program you run read and inject keyboard and mouse input system-wide. Grant it only on a machine and account you trust.';
 export const GNOME_EXTENSION_UUID = 'mixdog-windows@mixdog.io';
 /** The oldest helper interface this app can use (2 added Screenshot and StopRequested, 3 the in-shell indicator). */
 export const MIN_WINDOW_HELPER_VERSION = 3;
-export const WINDOW_HELPER_RELOGIN_HINT =
+const WINDOW_HELPER_RELOGIN_HINT =
   'wayland_window_control_unavailable: the Mixdog Windows GNOME extension is installed and enabled but GNOME Shell has not loaded it yet; the user must sign out and sign in again once';
-export const WINDOW_HELPER_ENABLE_HINT =
+const WINDOW_HELPER_ENABLE_HINT =
   'wayland_window_control_unavailable: the Mixdog Windows GNOME extension is not enabled; it could not be enabled automatically (run gnome-extensions enable mixdog-windows@mixdog.io)';
-export const WINDOW_CONTROL_UNSUPPORTED_HINT =
+const WINDOW_CONTROL_UNSUPPORTED_HINT =
   'wayland_window_control_unavailable: this desktop offers no window control to other programs (supported: GNOME with the Mixdog Windows extension, sway, Hyprland, or an X11 session); screen, pointer, keyboard and clipboard still work';
-export const ACCESSIBILITY_HINT = 'accessibility_unavailable: the AT-SPI bus is not running; install at-spi2-core';
+const ACCESSIBILITY_HINT = 'accessibility_unavailable: the AT-SPI bus is not running; install at-spi2-core';
 export const TESSERACT_HINT =
   'ocr_unavailable: install Tesseract (for example `sudo apt install tesseract-ocr tesseract-ocr-kor`) to read text from pixels';
 export const CLIPBOARD_HINT =
   'clipboard_unavailable: install wl-clipboard (`wl-copy`/`wl-paste`) for clipboard access on Wayland';
-export const DISPLAY_HINT =
+const DISPLAY_HINT =
   'display_unavailable: no graphical session to drive; run inside a desktop session with DISPLAY (X11) or WAYLAND_DISPLAY set';
 
 /** Stable code of the whole refusal; the per-capability codes are the native ones. */
@@ -301,14 +301,10 @@ function capabilityIssue(name, readiness) {
     return { code: 'display_unavailable', message: DISPLAY_HINT };
   // Semantic actions fail on whichever of their two prerequisites is missing.
   const gnomeWayland = readiness.session === 'wayland' && readiness.desktop === 'gnome';
-  const target =
-    name === 'semanticActions'
-      ? readiness.capabilities.windows.state === 'ready'
-        ? 'accessibility'
-        : 'windows'
-      : name === 'capture' && gnomeWayland
-        ? 'windows'
-        : name;
+  let target = name;
+  if (name === 'semanticActions')
+    target = readiness.capabilities.windows.state === 'ready' ? 'accessibility' : 'windows';
+  else if (name === 'capture' && gnomeWayland) target = 'windows';
   const capability = readiness.capabilities[target];
   switch (target) {
     case 'windows':