@xingular/harness 0.1.0 → 0.1.2

package/src/mcp/connections.ts

@@ -10,7 +10,9 @@ import { newId, readJson, safeId, writeJson } from '../core/fs'
 import { findBinary, searchPath } from '../core/path'
 import { isDir } from '../memory/store'
 import type { RunEvent } from '../sessions/contracts'
-import { connectionInputSchema, connectionSchema, type Connection, type ConnectionInput, type LaunchConfig, type Scope } from './types'
+import * as attachments from '../plugins/attachments'
+import { connectionScopeMigrationComplete } from './scopeMigration'
+import { connectionCapabilityId, connectionInputSchema, connectionSchema, type Connection, type ConnectionInput, type LaunchConfig, type Scope } from './types'
 
 const OAUTH_STATE = 'oauth'
 const OAUTH_CLIENT_ID = 'oauth_client_id'
@@ -144,6 +146,24 @@ export function revisionOf(all: readonly Connection[]): unknown[] {
   return all.map((item) => ({ id: item.id, enabled: item.enabled, global: item.global, agents: item.agentIds, projects: item.projectIds, excludedAgents: item.excludedAgentIds, excludedProjects: item.excludedProjectIds, checkedAt: item.checkedAt, error: item.error }))
 }
 
+function sameScope(left: Connection, right: Connection): boolean {
+  const ids = (values: string[]): string[] => [...values].sort()
+  return left.global === right.global
+    && JSON.stringify(ids(left.agentIds)) === JSON.stringify(ids(right.agentIds))
+    && JSON.stringify(ids(left.projectIds)) === JSON.stringify(ids(right.projectIds))
+    && JSON.stringify(ids(left.excludedAgentIds)) === JSON.stringify(ids(right.excludedAgentIds))
+    && JSON.stringify(ids(left.excludedProjectIds)) === JSON.stringify(ids(right.excludedProjectIds))
+}
+
+function hasScope(connection: Connection): boolean {
+  return connection.global || connection.agentIds.length > 0 || connection.projectIds.length > 0
+    || connection.excludedAgentIds.length > 0 || connection.excludedProjectIds.length > 0
+}
+
+function scopeMigrationError(): HarnessError {
+  return new HarnessError('connection_scope_migration_pending', 'Connector access settings cannot be changed until their scope migration succeeds. Reopen the data root to retry it.')
+}
+
 // ---- The store --------------------------------------------------------------------------------
 
 export class Connections {
@@ -154,13 +174,16 @@ export class Connections {
   constructor(
     stateDir: string,
     private readonly secrets: SecretStore,
-    private readonly bus: Bus
+    private readonly bus: Bus,
+    private readonly attachmentRoot: () => string | null = () => null
   ) {
     this.path = join(stateDir, 'connections.json')
   }
 
   list(): Connection[] {
     const stored = readJson<unknown[]>(this.path) ?? []
+    const root = this.attachmentRoot()
+    const choices = root ? attachments.load(root) : null
     return stored.flatMap((item) => {
       const parsed = connectionSchema.safeParse(item)
       if (!parsed.success) return []
@@ -169,6 +192,22 @@ export class Connections {
       if (!connection.auth) connection.auth = 'none'
       // The preset was saved as "X Workspace" before the product was renamed.
       if (connection.kind === 'workspace' && connection.name === 'X Workspace') connection.name = 'Xingular Workspace'
+      if (choices) {
+        const id = connectionCapabilityId(connection.id)
+        const hasChoice = choices.global.on.includes(id) || choices.global.off.includes(id)
+          || Object.values(choices.agents).some((entry) => entry.on.includes(id) || entry.off.includes(id))
+          || Object.values(choices.projects).some((entry) => entry.on.includes(id) || entry.off.includes(id))
+        // Before the first successful root open, keep old records readable. After migration the
+        // returned fields are a view over attachments; they are never written back to connections.json.
+        if (hasChoice || !(connection.global || connection.agentIds.length || connection.projectIds.length || connection.excludedAgentIds.length || connection.excludedProjectIds.length)) {
+          const attachment = attachments.describe(choices, id, connection.global)
+          connection.global = attachment.global
+          connection.agentIds = attachment.on.agentIds
+          connection.projectIds = attachment.on.projectIds
+          connection.excludedAgentIds = attachment.off.agentIds
+          connection.excludedProjectIds = attachment.off.projectIds
+        }
+      }
       return [connection]
     })
   }
@@ -188,7 +227,31 @@ export class Connections {
   }
 
   private write(all: Connection[]): void {
-    writeJson(this.path, all)
+    const root = this.attachmentRoot()
+    let stored: Connection[] | Omit<Connection, 'global' | 'agentIds' | 'projectIds' | 'excludedAgentIds' | 'excludedProjectIds'>[] = all
+    if (root && connectionScopeMigrationComplete(root)) {
+      stored = all.map(({ global: _global, agentIds: _agentIds, projectIds: _projectIds, excludedAgentIds: _excludedAgentIds, excludedProjectIds: _excludedProjectIds, ...connection }) => connection)
+    } else if (root) {
+      // A non-scope edit is allowed while migration is pending, but its legacy scopes must stay
+      // in connections.json until the attachment store has been verified.
+      const previous = new Map<string, Connection>()
+      for (const item of readJson<unknown[]>(this.path) ?? []) {
+        const parsed = connectionSchema.safeParse(item)
+        if (parsed.success) previous.set(parsed.data.id, parsed.data)
+      }
+      stored = all.map((connection) => {
+        const legacy = previous.get(connection.id)
+        return legacy ? {
+          ...connection,
+          global: legacy.global,
+          agentIds: legacy.agentIds,
+          projectIds: legacy.projectIds,
+          excludedAgentIds: legacy.excludedAgentIds,
+          excludedProjectIds: legacy.excludedProjectIds
+        } : connection
+      })
+    }
+    writeJson(this.path, stored)
     try {
       chmodSync(this.path, 0o600)
     } catch {
@@ -196,6 +259,22 @@ export class Connections {
     }
   }
 
+  private writeScope(root: string, connection: Connection): void {
+    const choices = attachments.load(root)
+    const id = connectionCapabilityId(connection.id)
+    attachments.forgetId(choices, id)
+    attachments.set(choices, [id], {}, connection.global, false)
+    for (const agentId of new Set([...connection.agentIds, ...connection.excludedAgentIds])) {
+      const on = connection.agentIds.includes(agentId) && !connection.excludedAgentIds.includes(agentId)
+      attachments.set(choices, [id], { agentId }, on, connection.global)
+    }
+    for (const projectId of new Set([...connection.projectIds, ...connection.excludedProjectIds])) {
+      const on = connection.projectIds.includes(projectId) && !connection.excludedProjectIds.includes(projectId)
+      attachments.set(choices, [id], { projectId }, on, connection.global)
+    }
+    attachments.save(root, choices)
+  }
+
   changed(): void {
     this.bus.emit({ type: 'connections.changed' })
   }
@@ -205,7 +284,10 @@ export class Connections {
     const all = this.list()
     const connection = all.find((item) => item.id === id)
     if (!connection) throw notFound('Connection')
+    const before = { ...connection, agentIds: [...connection.agentIds], projectIds: [...connection.projectIds], excludedAgentIds: [...connection.excludedAgentIds], excludedProjectIds: [...connection.excludedProjectIds] }
     change(connection)
+    const root = this.attachmentRoot()
+    if (root && !connectionScopeMigrationComplete(root) && !sameScope(before, connection)) throw scopeMigrationError()
     this.write(all)
     return connection
   }
@@ -213,11 +295,91 @@ export class Connections {
   /** Read-modify-write of every connection. */
   updateAll(change: (all: Connection[]) => void): void {
     const all = this.list()
+    const before = new Map<string, Connection>(all.map((connection): [string, Connection] => [connection.id, {
+      ...connection,
+      agentIds: [...connection.agentIds],
+      projectIds: [...connection.projectIds],
+      excludedAgentIds: [...connection.excludedAgentIds],
+      excludedProjectIds: [...connection.excludedProjectIds]
+    }]))
     change(all)
+    const root = this.attachmentRoot()
+    if (root && !connectionScopeMigrationComplete(root)) {
+      const remainingIds = new Set(all.map((connection) => connection.id))
+      const scopeChanged = all.some((connection) => {
+        const previous = before.get(connection.id)
+        return previous ? !sameScope(previous, connection) : hasScope(connection)
+      }) || [...before].some(([id, connection]) => !remainingIds.has(id) && hasScope(connection))
+      if (scopeChanged) throw scopeMigrationError()
+    }
     this.write(all)
     this.changed()
   }
 
+  /** Switches one connector in the shared attachment store, preserving all other scopes. */
+  setScope(connectionId: string, scope: Scope, on: boolean): Connection[] {
+    const connection = this.find(connectionId)
+    const root = this.attachmentRoot()
+    if (root && !connectionScopeMigrationComplete(root)) throw scopeMigrationError()
+    if (!root) {
+      this.update(connectionId, (item) => setScope(item, scope, on))
+      this.changed()
+      return this.forScope(scope)
+    }
+    const choices = attachments.load(root)
+    const fallback = connection.global
+    attachments.set(choices, [connectionCapabilityId(connectionId)], scope, on, fallback)
+    attachments.save(root, choices)
+    this.changed()
+    return this.forScope(scope)
+  }
+
+  /** Gives one agent an exact connector set without changing project or global choices. */
+  setAgentScope(agentId: string, ids: readonly string[]): Connection[] {
+    const all = this.list()
+    const root = this.attachmentRoot()
+    if (root && !connectionScopeMigrationComplete(root)) throw scopeMigrationError()
+    if (!root) {
+      setAgentScope(all, agentId, ids)
+      this.write(all)
+      this.changed()
+      return this.forScope({ agentId })
+    }
+    const choices = attachments.load(root)
+    for (const connection of all) {
+      attachments.set(choices, [connectionCapabilityId(connection.id)], { agentId }, ids.includes(connection.id), connection.global)
+    }
+    attachments.save(root, choices)
+    this.changed()
+    return this.forScope({ agentId })
+  }
+
+  /** Removes only connector choices when an agent is deleted; other capability choices are separate. */
+  removeAgentScope(agentId: string): void {
+    const root = this.attachmentRoot()
+    // This is cleanup for a deleted caller. Leave stale ids inert until migration can safely
+    // move the remaining scopes; failing helper cleanup must not leave an orphan agent behind.
+    if (root && !connectionScopeMigrationComplete(root)) return
+    if (!root) {
+      this.updateAll((all) => {
+        for (const connection of all) {
+          connection.agentIds = connection.agentIds.filter((id) => id !== agentId)
+          connection.excludedAgentIds = connection.excludedAgentIds.filter((id) => id !== agentId)
+        }
+      })
+      return
+    }
+    const choices = attachments.load(root)
+    const entry = choices.agents[agentId]
+    if (!entry) return
+    const isConnector = (id: string): boolean => id.startsWith('connected-apps/connection/')
+    entry.on = entry.on.filter((id) => !isConnector(id))
+    entry.off = entry.off.filter((id) => !isConnector(id))
+    if (!entry.on.length && !entry.off.length) delete choices.agents[agentId]
+    attachments.save(root, choices)
+    this.changed()
+  }
+
   private secret(connectionId: string, name: string): Promise<string | null> {
     return this.secrets.get(secretKey(`mcp--${connectionId}`, name))
   }
@@ -364,6 +526,10 @@ export class Connections {
 
     const all = this.list()
     const existing = all.find((item) => item.id === connection.id)
+    const root = this.attachmentRoot()
+    if (root && !connectionScopeMigrationComplete(root) && (existing ? !sameScope(existing, connection) : hasScope(connection))) {
+      throw scopeMigrationError()
+    }
     connection.envKeys = [...(existing?.envKeys ?? [])]
     connection.headerKeys = [...(existing?.headerKeys ?? [])]
     // A sign-in belongs to one server and one client; never carry it to another.
@@ -395,6 +561,7 @@ export class Connections {
       connection.envKeys = connection.envKeys.filter((value) => value !== key)
     }
     Object.assign(connection, { checkedAt: null, tools: [], serverName: null, error: null })
+    if (root && connectionScopeMigrationComplete(root)) this.writeScope(root, connection as Connection)
     this.write([...all.filter((item) => item.id !== connection.id), connection])
     await this.refreshSecrets()
     this.changed()
@@ -424,6 +591,12 @@ export class Connections {
       for (const name of [OAUTH_STATE, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET]) await this.deleteSecret(connection.id, name)
     }
     this.write(all.filter((item) => item.id !== connectionId))
+    const root = this.attachmentRoot()
+    if (root) {
+      const choices = attachments.load(root)
+      attachments.forgetId(choices, connectionCapabilityId(connectionId))
+      attachments.save(root, choices)
+    }
     this.known.delete(connectionId)
     this.changed()
   }

package/src/mcp/scopeMigration.ts

@@ -0,0 +1,204 @@
+// Moves who can reach each connected app out of the device-local connection records and into
+// the data root's shared capability attachment store. The originals remain as owner-only backups.
+import { chmodSync, existsSync, readFileSync, unlinkSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { atomicWrite, readJson, writeJson } from '../core/fs'
+import * as attachments from '../plugins/attachments'
+import { connectionCapabilityId, connectionSchema, type Connection } from './types'
+
+interface MigrationRecord {
+  version: 1
+  status: 'attachments-written' | 'complete'
+  connectionCount: number
+  scopeAssignmentCount: number
+  connectionsBackup: string | null
+  attachmentsBackup: string | null
+  hadAttachments: boolean
+}
+
+const recordPath = (root: string): string => join(root, 'config/capability-scope-migration.json')
+const attachmentsPath = (root: string): string => join(root, 'config/plugin-attachments.json')
+const connectionPath = (stateDir: string): string => join(stateDir, 'connections.json')
+const connectionsBackupPath = (stateDir: string): string => join(stateDir, 'connections.pre-capability-scope.json')
+const attachmentsBackupPath = (root: string): string => join(root, 'config/plugin-attachments.pre-capability-scope.json')
+
+/** Scope writes are safe only after the legacy records have been copied and stripped. */
+export function connectionScopeMigrationComplete(root: string): boolean {
+  try {
+    const marker = readJson<MigrationRecord>(recordPath(root))
+    return marker?.version === 1 && marker.status === 'complete'
+  } catch {
+    return false
+  }
+}
+
+interface ScopeRows {
+  global: boolean
+  agents: Map<string, boolean>
+  projects: Map<string, boolean>
+}
+
+function unique(values: readonly string[]): string[] {
+  return [...new Set(values)]
+}
+
+function scopeRows(connection: Connection): ScopeRows {
+  const agents = new Map<string, boolean>()
+  const projects = new Map<string, boolean>()
+  for (const id of unique([...connection.agentIds, ...connection.excludedAgentIds])) {
+    agents.set(id, !connection.excludedAgentIds.includes(id))
+  }
+  for (const id of unique([...connection.projectIds, ...connection.excludedProjectIds])) {
+    projects.set(id, !connection.excludedProjectIds.includes(id))
+  }
+  return { global: connection.global, agents, projects }
+}
+
+function assignmentCount(rows: ScopeRows): number {
+  return 1 + rows.agents.size + rows.projects.size
+}
+
+function removeId(choices: attachments.Attachments, id: string): void {
+  attachments.forgetId(choices, id)
+}
+
+function put(map: { on: string[]; off: string[] }, id: string, value: boolean): void {
+  map.on = map.on.filter((item) => item !== id)
+  map.off = map.off.filter((item) => item !== id)
+  map[value ? 'on' : 'off'].push(id)
+}
+
+function writeRows(choices: attachments.Attachments, id: string, rows: ScopeRows): void {
+  removeId(choices, id)
+  put(choices.global, id, rows.global)
+  for (const [scopeId, on] of rows.agents) {
+    const target = (choices.agents[scopeId] ??= { on: [], off: [] })
+    put(target, id, on)
+  }
+  for (const [scopeId, on] of rows.projects) {
+    const target = (choices.projects[scopeId] ??= { on: [], off: [] })
+    put(target, id, on)
+  }
+}
+
+function readValue(item: { on: string[]; off: string[] } | undefined, id: string): boolean | null {
+  if (item?.off.includes(id)) return false
+  if (item?.on.includes(id)) return true
+  return null
+}
+
+function verifyRows(choices: attachments.Attachments, id: string, expected: ScopeRows): boolean {
+  if (readValue(choices.global, id) !== expected.global) return false
+  for (const [scopeId, on] of expected.agents) {
+    if (readValue(choices.agents[scopeId], id) !== on) return false
+  }
+  for (const [scopeId, on] of expected.projects) {
+    if (readValue(choices.projects[scopeId], id) !== on) return false
+  }
+  return true
+}
+
+function backup(source: string, target: string): boolean {
+  if (!existsSync(source)) return false
+  if (!existsSync(target)) atomicWrite(target, readFileSync(source))
+  chmodSync(target, 0o600)
+  return true
+}
+
+function setPrivate(path: string): void {
+  try { chmodSync(path, 0o600) } catch { /* The atomic write remains usable if chmod is unavailable. */ }
+}
+
+function stripScopes(stateDir: string): void {
+  const path = connectionPath(stateDir)
+  if (!existsSync(path)) return
+  const stored = readJson<unknown>(path)
+  if (!Array.isArray(stored)) throw new Error('Stored connector data must be a list before its scopes can be migrated.')
+  const records = stored.map((item) => {
+    if (!item || typeof item !== 'object' || Array.isArray(item)) throw new Error('A stored connector record is invalid; no scope data was removed.')
+    const { global: _global, agentIds: _agentIds, projectIds: _projectIds, excludedAgentIds: _excludedAgentIds, excludedProjectIds: _excludedProjectIds, ...connection } = item as Record<string, unknown>
+    return connection
+  })
+  writeJson(path, records)
+  setPrivate(path)
+}
+
+/**
+ * Runs once when a data root opens. Both source files are backed up before either is changed;
+ * a stage marker makes an interrupted migration safe to finish on the next open.
+ */
+export function migrateConnectionScopes(root: string, stateDir: string): MigrationRecord {
+  const marker = readJson<MigrationRecord>(recordPath(root))
+  if (marker?.version === 1 && marker.status === 'complete') return marker
+
+  if (marker?.version === 1 && marker.status === 'attachments-written') {
+    stripScopes(stateDir)
+    const complete = { ...marker, status: 'complete' as const }
+    writeJson(recordPath(root), complete)
+    return complete
+  }
+
+  const connectionsFile = connectionPath(stateDir)
+  const hadConnections = existsSync(connectionsFile)
+  const raw = hadConnections ? readJson<unknown>(connectionsFile) : []
+  if (!Array.isArray(raw)) throw new Error('Stored connector data must be a list before its scopes can be migrated.')
+  const parsed = raw.map((item) => {
+    const result = connectionSchema.safeParse(item)
+    if (!result.success) throw new Error('A stored connector record is invalid; no scope data was removed.')
+    return result.data
+  })
+  const connectionBackup = hadConnections ? connectionsBackupPath(stateDir) : null
+  const hadAttachments = existsSync(attachmentsPath(root))
+  const attachmentBackup = hadAttachments ? attachmentsBackupPath(root) : null
+  const migration: MigrationRecord = {
+    version: 1,
+    status: 'attachments-written',
+    connectionCount: parsed.length,
+    scopeAssignmentCount: parsed.reduce((count, connection) => count + assignmentCount(scopeRows(connection)), 0),
+    connectionsBackup: connectionBackup,
+    attachmentsBackup: attachmentBackup,
+    hadAttachments
+  }
+  backup(connectionsFile, connectionBackup ?? '')
+  backup(attachmentsPath(root), attachmentBackup ?? '')
+
+  try {
+    const choices = attachments.load(root)
+    const expected = new Map<string, ScopeRows>()
+    for (const connection of parsed) {
+      const id = connectionCapabilityId(connection.id)
+      const rows = scopeRows(connection)
+      expected.set(id, rows)
+      writeRows(choices, id, rows)
+    }
+    const migratedAssignments = [...expected.values()].reduce((count, rows) => count + assignmentCount(rows), 0)
+    if (migratedAssignments !== migration.scopeAssignmentCount || [...expected].some(([id, rows]) => !verifyRows(choices, id, rows))) {
+      throw new Error('Connector scope count check failed; the original files were restored.')
+    }
+    attachments.save(root, choices)
+    const saved = attachments.load(root)
+    if ([...expected].some(([id, rows]) => !verifyRows(saved, id, rows))) throw new Error('Connector scope count check failed after saving; the original files were restored.')
+    writeJson(recordPath(root), migration)
+    stripScopes(stateDir)
+    const complete = { ...migration, status: 'complete' as const }
+    writeJson(recordPath(root), complete)
+    return complete
+  } catch (error) {
+    if (attachmentBackup && existsSync(attachmentBackup)) atomicWrite(attachmentsPath(root), readFileSync(attachmentBackup))
+    else if (!hadAttachments && existsSync(attachmentsPath(root))) unlinkSync(attachmentsPath(root))
+    if (connectionBackup && existsSync(connectionBackup)) atomicWrite(connectionsFile, readFileSync(connectionBackup))
+    try { unlinkSync(recordPath(root)) } catch { /* No marker is also a valid retry state. */ }
+    throw error
+  }
+}
+
+/** Restores the byte-identical pre-migration files from the backups if an operator rolls back. */
+export function rollbackConnectionScopeMigration(root: string, stateDir: string): void {
+  const marker = readJson<MigrationRecord>(recordPath(root))
+  if (!marker || marker.version !== 1) return
+  if (marker.attachmentsBackup && existsSync(marker.attachmentsBackup)) atomicWrite(attachmentsPath(root), readFileSync(marker.attachmentsBackup))
+  else if (!marker.hadAttachments && existsSync(attachmentsPath(root))) unlinkSync(attachmentsPath(root))
+  if (marker.connectionsBackup && existsSync(marker.connectionsBackup)) atomicWrite(connectionPath(stateDir), readFileSync(marker.connectionsBackup))
+  unlinkSync(recordPath(root))
+}

package/src/mcp/service.ts

@@ -17,7 +17,7 @@ import type { ActiveRun, RunRegistry } from '../sessions/registry'
 import { findRun, runDir } from '../sessions/runStore'
 import type { SessionBroker } from '../sessions/sessions'
 import type { ToolSession, ToolSpec } from '../tools/types'
-import { allowed, Connections, setScope, webUrl } from './connections'
+import { allowed, Connections, webUrl } from './connections'
 import { isSignInRequired, McpManager, signInRequired } from './manager'
 import { signIn, type OAuthHost } from './oauth'
 import type { Connection, HttpConfig, LaunchConfig, McpSource, McpTrace } from './types'
@@ -134,7 +134,7 @@ export class ConnectedApps implements SessionBroker {
   private brokered: BrokeredTools | null = null
 
   constructor(private readonly options: ConnectedAppsOptions) {
-    this.connections = new Connections(options.stateDir, options.secrets, options.bus)
+    this.connections = new Connections(options.stateDir, options.secrets, options.bus, () => options.env.dataRoot)
     this.oauth = {
       clientName: options.env.productName,
       load: (id) => this.connections.oauthLoad(id),
@@ -235,7 +235,7 @@ export class ConnectedApps implements SessionBroker {
           return { tools, errors: [] }
         } catch (error) {
           const unauthorized = isSignInRequired(error)
-          const message = unauthorized ? signInRequired(connection).message : `${connection.name} could not load its tools. Check the connection in Settings → Connections.`
+          const message = unauthorized ? signInRequired(connection).message : `${connection.name} could not load its tools. Check its scope in Capability → Connectors.`
           if (unauthorized) await this.manager.close(connection.id, session.sessionId)
           this.connectionFailed(connection.id, unauthorized)
           return { tools: [], errors: [{ connection: connection.name, message }] }
@@ -393,8 +393,8 @@ export class ConnectedApps implements SessionBroker {
     return [
       {
         name: 'mcp_list_tools',
-        label: 'App and connected tools',
-        description: `Discover enabled ${this.options.env.productName} app operations and connected-app tools by name. Pass tool to get one tool with its input schema.${this.brokered?.discoveryNote ? ` ${this.brokered.discoveryNote}` : ''}`,
+        label: 'App and connector tools',
+        description: `Discover enabled ${this.options.env.productName} app operations and connector tools by name. Pass tool to get one tool with its input schema.${this.brokered?.discoveryNote ? ` ${this.brokered.discoveryNote}` : ''}`,
         parameters: (Type) =>
           Type.Object({
             tool: Type.Optional(Type.String({ description: 'One tool name, to get its input schema.' })),
@@ -411,8 +411,8 @@ export class ConnectedApps implements SessionBroker {
       },
       {
         name: 'mcp_call_tool',
-        label: 'Use connected app',
-        description: 'Invoke an enabled app or connected-app tool returned by mcp_list_tools. Current settings are checked on every call. Changes require approval.',
+        label: 'Use connector',
+        description: 'Invoke an enabled app or connector tool returned by mcp_list_tools. Current settings are checked on every call. Changes require approval.',
         parameters: (Type) => Type.Object({ name: Type.String(), arguments: Type.Record(Type.String(), Type.Unknown()) }),
         execute: async (input) => JSON.stringify(await this.invoke(session, String(input.name), (input.arguments ?? {}) as Record<string, unknown>))
       }
@@ -506,23 +506,13 @@ export class ConnectedApps implements SessionBroker {
 
   /** Gives one agent exactly these connections, if its creator may reach each of them. */
   setAgentScope(creator: { agentId?: string | null; projectId?: string | null }, agentId: string, ids: readonly string[]): Connection[] {
-    this.connections.updateAll((all) => {
-      for (const id of ids) {
-        const connection = all.find((item) => item.id === id)
-        if (!connection) throw notFound('Connection')
-        if (!allowed(connection, creator)) throw new HarnessError('required_connections_unavailable', `${connection.name} is disabled or outside your connection scope.`)
-      }
-      for (const connection of all) {
-        connection.agentIds = connection.agentIds.filter((id) => id !== agentId)
-        connection.excludedAgentIds = connection.excludedAgentIds.filter((id) => id !== agentId)
-        if (ids.includes(connection.id)) {
-          if (!connection.global) connection.agentIds.push(agentId)
-        } else if (connection.global) {
-          connection.excludedAgentIds.push(agentId)
-        }
-      }
-    })
-    return this.connections.forScope({ agentId })
+    const all = this.connections.list()
+    for (const id of ids) {
+      const connection = all.find((item) => item.id === id)
+      if (!connection) throw notFound('Connection')
+      if (!allowed(connection, creator)) throw new HarnessError('required_connections_unavailable', `${connection.name} is disabled or outside your connection scope.`)
+    }
+    return this.connections.setAgentScope(agentId, ids)
   }
 
   /**
@@ -542,22 +532,14 @@ export class ConnectedApps implements SessionBroker {
 
   /** Switches one saved connection on or off for everyone, one agent, or one project. */
   attach(connectionId: string, scope: { agentId?: string | null; projectId?: string | null }, on: boolean): void {
-    this.connections.updateAll((all) => {
-      const connection = all.find((item) => item.id === connectionId)
-      if (!connection) throw notFound('Connection')
-      if (!connection.enabled) throw invalid(`${connection.name} is switched off. Switch it on in its own settings first.`)
-      setScope(connection, scope, on)
-    })
+    const connection = this.connections.find(connectionId)
+    if (!connection.enabled) throw invalid(`${connection.name} is switched off. Switch it on in its own settings first.`)
+    this.connections.setScope(connectionId, scope, on)
   }
 
   /** Forgets an agent that no longer exists. */
   removeAgentScope(agentId: string): void {
-    this.connections.updateAll((all) => {
-      for (const connection of all) {
-        connection.agentIds = connection.agentIds.filter((id) => id !== agentId)
-        connection.excludedAgentIds = connection.excludedAgentIds.filter((id) => id !== agentId)
-      }
-    })
+    this.connections.removeAgentScope(agentId)
   }
 
   async close(): Promise<void> {

package/src/mcp/types.ts

@@ -7,6 +7,9 @@ import { z } from 'zod'
 export const MCP_OAUTH_PORT = 47823
 export const MCP_OAUTH_REDIRECT_URL = `http://127.0.0.1:${MCP_OAUTH_PORT}/oauth/callback`
 
+/** Stable attachment key for a connected app's capability switch. */
+export const connectionCapabilityId = (id: string): string => `connected-apps/connection/${id}`
+
 export const connectionSchema = z.object({
   id: z.string().default(''),
   name: z.string().default(''),

package/src/memory/api.ts

@@ -183,13 +183,15 @@ export function list(env: HarnessEnv, params: Params): string {
 }
 
 /** One skill's instructions by name or id, or the skills index when no name is given. */
-export function skill(env: HarnessEnv, context: CallerContext, params: Params): string {
+export function skill(env: HarnessEnv, context: CallerContext, params: Params, contributions?: readonly string[]): string {
   const { root } = env
   const name = textParam(params, 'name').toLowerCase()
-  const items = registry.list(root).filter((item) => item.kind === 'skills')
+  const items = registry.limitToContributions(registry.list(root).filter((item) => item.kind === 'skills'), contributions)
   if (!name) {
     if (!items.length) return 'No skills yet.'
-    const active = registry.enabledFor(root, context.projectId ?? null, context.agentId ?? null).map((item) => item.id)
+    const active = (contributions === undefined
+      ? registry.enabledFor(root, context.projectId ?? null, context.agentId ?? null)
+      : items).map((item) => item.id)
     return items.map((item) => `- ${item.name} (${item.id})${active.includes(item.id) ? ' · active' : ''} — ${item.description}`).join('\n')
   }
   const found = items.find((item) => item.id.toLowerCase() === name || item.id.replace(/^skills\//, '').toLowerCase() === name || item.name.toLowerCase() === name)

package/src/memory/dispatch.ts

@@ -12,7 +12,7 @@ import { reindexQuietly } from './wikiIndex'
 export type DispatchEnv = HarnessEnv & { bus?: Bus }
 
 /** Runs one call and returns its reply as text for a model. */
-export function dispatch(env: DispatchEnv, context: CallerContext, call: string, params: api.Params): string {
+export function dispatch(env: DispatchEnv, context: CallerContext, call: string, params: api.Params, contributions?: readonly string[]): string {
   switch (call) {
     case 'wiki.entrypoint': {
       const recorded = context.runId ? safely(() => load(env.root, context.runId!)) : null
@@ -36,7 +36,7 @@ export function dispatch(env: DispatchEnv, context: CallerContext, call: string,
     case 'wiki.list':
       return api.list(env, params)
     case 'wiki.skill':
-      return api.skill(env, context, params)
+      return api.skill(env, context, params, contributions)
     case 'wiki.memory':
       return api.memories(env, context, params)
     case 'wiki.propose': {

package/src/memory/maintenance.test.ts

@@ -16,7 +16,7 @@ import { listInbox } from './operations'
 import { wikiDir } from './store'
 
 const request: MaintenanceRequest = { jobId: 'job-1', namespace: '/library', trigger: { kind: 'ingest', sourceId: 'src-1', sourceName: 'notes.md', text: 'We chose Tauri.' }, pages: [], index: '# Index' }
-const input = { cwd: '/tmp', product: 'Xingular Agent', account: { id: 'a', provider: 'pi' as const, label: 'A', env: {}, configDir: '/tmp' }, runtime: async () => ({}) as never }
+const input = { cwd: '/tmp', product: 'Xingular Agent', account: { id: 'a', provider: 'pi' as const, label: 'A', env: {}, configDir: '/tmp', sharing: [] }, runtime: async () => ({}) as never }
 
 describe('the maintainer session', () => {
   it('collects proposals and flags without writing anything itself', async () => {

package/src/plugins/attachments.ts

@@ -126,3 +126,16 @@ export function forget(attachments: Attachments, scope: AttachScope): void {
   if (scope.agentId) delete attachments.agents[scope.agentId]
   if (scope.projectId) delete attachments.projects[scope.projectId]
 }
+
+/** Removes one capability's choices without disturbing the other items in each scope. */
+export function forgetId(attachments: Attachments, id: string): void {
+  const forgetFrom = (item: Entries): void => {
+    item.on = item.on.filter((entry) => entry !== id)
+    item.off = item.off.filter((entry) => entry !== id)
+  }
+  forgetFrom(attachments.global)
+  for (const item of Object.values(attachments.agents)) forgetFrom(item)
+  for (const item of Object.values(attachments.projects)) forgetFrom(item)
+  attachments.agents = Object.fromEntries(Object.entries(attachments.agents).filter(([, item]) => item.on.length || item.off.length))
+  attachments.projects = Object.fromEntries(Object.entries(attachments.projects).filter(([, item]) => item.on.length || item.off.length))
+}