mixdog 0.8.1 → 0.9.1

package/src/standalone/memory-runtime-proxy.mjs

@@ -0,0 +1,320 @@
+import { fork } from 'node:child_process';
+import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
+import http from 'node:http';
+import { dirname, join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { pathToFileURL } from 'node:url';
+import { claimSingletonOwner, readSingletonOwner, releaseSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
+
+function logLine(path, line) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, `[${new Date().toISOString()}] ${line}\n`);
+  } catch {}
+}
+
+function runtimeRoot() {
+  return process.env.MIXDOG_RUNTIME_ROOT ? resolve(process.env.MIXDOG_RUNTIME_ROOT) : join(tmpdir(), 'mixdog');
+}
+
+function activeInstancePath() {
+  return join(runtimeRoot(), 'active-instance.json');
+}
+
+function readActiveInstance() {
+  try {
+    return JSON.parse(readFileSync(activeInstancePath(), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function parsePort(value) {
+  const port = Number(value);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+
+function parsePid(value) {
+  const pid = Number(value);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+
+function isPidAlive(pid) {
+  const n = parsePid(pid);
+  if (!n) return false;
+  try {
+    process.kill(n, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+function delay(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function requestJson({ port, method = 'GET', path = '/', body = null, timeoutMs = 10_000, headers = {} }) {
+  return new Promise((resolvePromise, reject) => {
+    const payload = body == null ? null : JSON.stringify(body);
+    const req = http.request({
+      hostname: '127.0.0.1',
+      port,
+      path,
+      method,
+      headers: {
+        ...headers,
+        ...(payload
+          ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }
+          : {}),
+      },
+      timeout: timeoutMs,
+    }, (res) => {
+      let data = '';
+      res.setEncoding('utf8');
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        let parsed = null;
+        try { parsed = data ? JSON.parse(data) : null; } catch {}
+        if (res.statusCode && res.statusCode >= 400) {
+          const message = parsed?.error
+            || parsed?.content?.[0]?.text
+            || data
+            || `HTTP ${res.statusCode}`;
+          const error = new Error(message);
+          error.statusCode = res.statusCode;
+          reject(error);
+          return;
+        }
+        resolvePromise(parsed ?? { raw: data });
+      });
+    });
+    req.on('error', reject);
+    req.on('timeout', () => {
+      req.destroy();
+      reject(new Error(`memory proxy request timed out: ${method} ${path}`));
+    });
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+export function createStandaloneMemoryRuntime({
+  entry,
+  dataDir,
+  cwd = process.cwd(),
+} = {}) {
+  if (!entry) throw new Error('memory runtime entry is required');
+  if (!dataDir) throw new Error('memory runtime dataDir is required');
+
+  const logPath = join(dataDir, 'memory-runtime-proxy.log');
+  const ownerPath = join(dataDir, 'memory-runtime-owner.json');
+  const singletonEnabled = process.env.MIXDOG_MEMORY_SINGLETON !== '0';
+  const idleTtlMs = Math.max(0, Number(process.env.MIXDOG_MEMORY_IDLE_TTL_MS) || 10 * 60_000);
+  let portCache = null;
+  let startPromise = null;
+  let child = null;
+  let nextCallId = 1;
+
+  async function findLivePort({ allowStarting = false } = {}) {
+    const active = readActiveInstance();
+    const port = parsePort(active?.memory_port);
+    if (!port) return null;
+    const ownerPid = parsePid(active?.memory_server_pid);
+    if (ownerPid && !isPidAlive(ownerPid)) return null;
+    try {
+      const health = await requestJson({ port, path: '/health', timeoutMs: allowStarting ? 2000 : 500 });
+      if (health?.status === 'ok' || (allowStarting && health?.status === 'starting')) {
+        portCache = port;
+        return port;
+      }
+    } catch {}
+    return null;
+  }
+
+  async function waitForPort(timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastError = null;
+    while (Date.now() < deadline) {
+      const port = await findLivePort({ allowStarting: true });
+      if (port) {
+        try {
+          const health = await requestJson({ port, path: '/health', timeoutMs: 1500 });
+          if (health?.status === 'ok') return port;
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      await delay(100);
+    }
+    throw lastError || new Error('memory runtime did not become ready');
+  }
+
+  function claimOwner() {
+    if (!singletonEnabled) return { owned: true, owner: { pid: process.pid } };
+    return claimSingletonOwner(ownerPath, {
+      kind: 'memory-runtime-daemon',
+      pid: process.pid,
+      meta: { cwd, clientPid: process.pid },
+    });
+  }
+
+  function releaseOwnerIfSelf() {
+    if (!singletonEnabled) return;
+    releaseSingletonOwner(ownerPath, process.pid);
+  }
+
+  async function start() {
+    if (portCache) {
+      const port = await findLivePort();
+      if (port) return { running: true, port, mode: 'http-proxy' };
+      portCache = null;
+    }
+    const existing = await findLivePort();
+    if (existing) return { running: true, port: existing, mode: 'http-proxy' };
+    if (startPromise) {
+      const port = await startPromise;
+      return { running: true, port, mode: 'http-proxy' };
+    }
+
+    startPromise = (async () => {
+      const claim = claimOwner();
+      if (!claim.owned) {
+        const owner = readSingletonOwner(ownerPath);
+        if (owner.alive) {
+          const live = await waitForPort(30_000);
+          return live;
+        }
+        releaseOwnerIfSelf();
+      }
+
+      child = fork(entry, [], {
+        cwd,
+        stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+        detached: true,
+        env: {
+          ...process.env,
+          MIXDOG_DATA_DIR: dataDir,
+          MIXDOG_WORKER_MODE: '1',
+          MIXDOG_STANDALONE: '1',
+          MIXDOG_SERVER_PID: '',
+          MIXDOG_OWNER_LEAD_PID: String(process.pid),
+          MIXDOG_MEMORY_SECONDARY: '0',
+          MIXDOG_PG_ATTACH_ONLY: '0',
+          MIXDOG_MEMORY_DISABLE_CYCLES: process.env.MIXDOG_MEMORY_DISABLE_CYCLES ?? '0',
+          MIXDOG_MEMORY_DISABLE_LLM_WORKER: process.env.MIXDOG_MEMORY_DISABLE_LLM_WORKER ?? '0',
+          MIXDOG_QUIET_SESSION_LOG: process.env.MIXDOG_QUIET_SESSION_LOG ?? '1',
+          MIXDOG_MEMORY_DAEMON: '1',
+          MIXDOG_MEMORY_IDLE_TTL_MS: String(idleTtlMs),
+        },
+        windowsHide: true,
+      });
+      const childPid = child.pid;
+      if (singletonEnabled && childPid) {
+        releaseSingletonOwner(ownerPath, process.pid);
+        claimSingletonOwner(ownerPath, {
+          kind: 'memory-runtime-daemon',
+          pid: childPid,
+          meta: { cwd, launcherPid: process.pid },
+        });
+      }
+      child.stderr?.on('data', chunk => {
+        const text = String(chunk || '').trimEnd();
+        if (text) logLine(logPath, text);
+      });
+      child.on('exit', () => {
+        if (singletonEnabled && childPid) releaseSingletonOwner(ownerPath, childPid);
+        if (child?.pid === childPid) child = null;
+        portCache = null;
+      });
+
+      const ready = new Promise((resolveReady, rejectReady) => {
+        const timer = setTimeout(() => rejectReady(new Error('memory worker ready timeout')), 60_000);
+        child.once('message', (msg) => {
+          clearTimeout(timer);
+          if (msg?.degraded || msg?.error) rejectReady(new Error(msg.error || 'memory worker degraded'));
+          else resolveReady(msg);
+        });
+        child.once('error', (error) => {
+          clearTimeout(timer);
+          rejectReady(error);
+        });
+        child.once('exit', (code, signal) => {
+          clearTimeout(timer);
+          rejectReady(new Error(`memory worker exited before ready (${signal || code || 'unknown'})`));
+        });
+      });
+
+      await ready;
+      const port = await waitForPort(15_000);
+      try { child.disconnect?.(); } catch {}
+      try { child.unref?.(); } catch {}
+      try { child.stderr?.unref?.(); } catch {}
+      return port;
+    })().finally(() => {
+      startPromise = null;
+    });
+
+    const port = await startPromise;
+    return { running: true, port, mode: 'http-proxy' };
+  }
+
+  async function handleToolCall(name, args = {}) {
+    await start();
+    const port = portCache || await findLivePort({ allowStarting: true });
+    if (!port) throw new Error('memory runtime is not available');
+    const callId = `mem_${process.pid}_${nextCallId++}`;
+    return await requestJson({
+      port,
+      method: 'POST',
+      path: '/api/tool',
+      body: { name, arguments: args || {} },
+      timeoutMs: Math.max(1000, Number(process.env.MIXDOG_MEMORY_TOOL_TIMEOUT_MS) || 180_000),
+      headers: { 'X-Mixdog-Call-Id': callId },
+    });
+  }
+
+  async function buildSessionCoreMemoryPayload(sessionCwd) {
+    await start();
+    const port = portCache || await findLivePort({ allowStarting: true });
+    if (!port) throw new Error('memory runtime is not available');
+    return await requestJson({
+      port,
+      method: 'POST',
+      path: '/session-start/core-memory',
+      body: { cwd: sessionCwd || cwd },
+      timeoutMs: 30_000,
+    });
+  }
+
+  async function stop() {
+    // Detach only. The daemon owns its own idle lifetime; CLI shutdown must not
+    // tear it down out from under another tab.
+    try { child?.disconnect?.(); } catch {}
+    try { child?.unref?.(); } catch {}
+    child = null;
+    return true;
+  }
+
+  async function status() {
+    const port = await findLivePort();
+    const owner = readSingletonOwner(ownerPath);
+    return {
+      running: Boolean(port),
+      port,
+      mode: 'http-proxy',
+      ownerPid: parsePid(owner.owner?.pid),
+      ownerAlive: owner.alive,
+    };
+  }
+
+  return {
+    init: start,
+    start,
+    stop,
+    status,
+    handleToolCall,
+    buildSessionCoreMemoryPayload,
+    moduleUrl: pathToFileURL(entry).href,
+  };
+}

package/src/standalone/projects.mjs

@@ -0,0 +1,226 @@
+/**
+ * standalone/projects.mjs — user-registered project (cwd) store.
+ *
+ * Projects are working directories the user explicitly registers (Codex-style).
+ * There is NO git scanning and NO recent-history auto-import; only entries the
+ * user creates appear here. Persisted as JSON at <MIXDOG_HOME>/projects.json.
+ *
+ * Data shape: { projects: [{ name, path, addedAt, lastSelectedAt? }] }
+ */
+import { homedir } from 'node:os';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+
+const MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
+const PROJECTS_FILE = join(MIXDOG_HOME, 'projects.json');
+
+/** Resolve a raw path to an absolute path against the user's cwd. */
+function toAbsolute(rawPath) {
+  const text = String(rawPath || '').trim();
+  if (!text) return '';
+  return isAbsolute(text) ? resolve(text) : resolve(process.cwd(), text);
+}
+
+/** Normalize a path for dedupe comparison (case-insensitive on Windows). */
+function normalizeKey(absPath) {
+  const text = String(absPath || '');
+  return process.platform === 'win32' ? text.replace(/[\\/]+$/, '').toLowerCase() : text.replace(/\/+$/, '');
+}
+
+function readStore() {
+  try {
+    if (!existsSync(PROJECTS_FILE)) return { projects: [] };
+    const raw = readFileSync(PROJECTS_FILE, 'utf8');
+    const parsed = JSON.parse(raw);
+    const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
+    return {
+      projects: projects
+        .filter((entry) => entry && typeof entry.path === 'string' && entry.path.trim())
+        .map((entry) => ({
+          name: String(entry.name || basename(entry.path) || entry.path),
+          path: String(entry.path),
+          addedAt: Number(entry.addedAt) || 0,
+          ...(Number(entry.lastSelectedAt) > 0
+            ? { lastSelectedAt: Number(entry.lastSelectedAt) }
+            : {}),
+        })),
+    };
+  } catch {
+    return { projects: [] };
+  }
+}
+
+function writeStore(store) {
+  try {
+    mkdirSync(dirname(PROJECTS_FILE), { recursive: true });
+    const tmp = `${PROJECTS_FILE}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
+    renameSync(tmp, PROJECTS_FILE);
+  } catch {
+    /* best-effort persistence */
+  }
+}
+
+/**
+ * Idempotently ensure `<absPath>/.mixdog/project.id` exists so the project
+ * selection store and memory project_id classification (resolveProjectId)
+ * agree. Rules:
+ *   - Never overwrite an existing marker (user may have set 'common' or a
+ *     custom id — respect it).
+ *   - Only act when absPath is a real directory on disk; never create the
+ *     project folder itself (addProject does NOT create the directory).
+ *   - Marker value = provided name, else basename(absPath). Skip when the
+ *     value is empty or 'common' (resolveProjectId would force COMMON).
+ *   - Best-effort: any failure is swallowed so registration/selection never
+ *     breaks.
+ */
+function ensureProjectIdMarker(absPath, name) {
+  try {
+    if (!absPath) return;
+    // Only when the project folder actually exists as a directory on disk.
+    try {
+      if (!statSync(absPath).isDirectory()) return;
+    } catch {
+      return; // missing / unstattable → silently skip
+    }
+    const markerPath = join(absPath, '.mixdog', 'project.id');
+    if (existsSync(markerPath)) return; // preserve existing value
+    const value = String(name || basename(absPath) || '').trim();
+    if (!value || value.toLowerCase() === 'common') return;
+    const markerDir = join(absPath, '.mixdog');
+    mkdirSync(markerDir, { recursive: true });
+    const tmp = `${markerPath}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${value}\n`, 'utf8');
+    renameSync(tmp, markerPath);
+  } catch {
+    /* best-effort marker; never throw */
+  }
+}
+
+function projectRecency(entry) {
+  const last = Number(entry?.lastSelectedAt);
+  if (Number.isFinite(last) && last > 0) return last;
+  return Number(entry?.addedAt) || 0;
+}
+
+function compareProjects(a, b) {
+  const byRecency = projectRecency(b) - projectRecency(a);
+  if (byRecency !== 0) return byRecency;
+  const byName = String(a.name).localeCompare(String(b.name));
+  if (byName !== 0) return byName;
+  return String(a.path).localeCompare(String(b.path));
+}
+
+/** List registered projects (most recently selected first; addedAt fallback). */
+export function listProjects() {
+  const { projects } = readStore();
+  return projects.slice().sort(compareProjects);
+}
+
+/**
+ * Register a project by path. Derives the display name from the last path
+ * segment, dedupes by normalized absolute path, and persists. Does NOT create
+ * the directory on disk.
+ */
+export function addProject(rawPath) {
+  const absPath = toAbsolute(rawPath);
+  if (!absPath) return null;
+  const store = readStore();
+  const key = normalizeKey(absPath);
+  const existing = store.projects.find((entry) => normalizeKey(entry.path) === key);
+  if (existing) {
+    ensureProjectIdMarker(absPath, existing.name);
+    return existing;
+  }
+  const entry = {
+    name: basename(absPath) || absPath,
+    path: absPath,
+    addedAt: Date.now(),
+  };
+  store.projects.push(entry);
+  writeStore(store);
+  ensureProjectIdMarker(absPath, entry.name);
+  return entry;
+}
+
+/**
+ * Mark an existing registered project as selected (updates lastSelectedAt).
+ * Does not register missing paths; use addProject for that. Returns the updated
+ * entry, or null when no matching project exists.
+ */
+export function touchProjectSelected(rawPath) {
+  const absPath = toAbsolute(rawPath);
+  if (!absPath) return null;
+  const store = readStore();
+  const key = normalizeKey(absPath);
+  const entry = store.projects.find((item) => normalizeKey(item.path) === key);
+  if (!entry) return null;
+  entry.lastSelectedAt = Date.now();
+  writeStore(store);
+  ensureProjectIdMarker(absPath, entry.name);
+  return entry;
+}
+
+/** Remove a registered project by path. Does NOT touch the directory on disk. */
+export function removeProject(rawPath) {
+  const absPath = toAbsolute(rawPath);
+  if (!absPath) return false;
+  const store = readStore();
+  const key = normalizeKey(absPath);
+  const next = store.projects.filter((entry) => normalizeKey(entry.path) !== key);
+  if (next.length === store.projects.length) return false;
+  writeStore({ projects: next });
+  return true;
+}
+
+/**
+ * Rename a registered project (display name only; the path is unchanged).
+ * A blank name resets the name back to the path's folder basename. Returns the
+ * updated entry, or null when no matching project exists.
+ */
+export function renameProject(rawPath, nextName) {
+  const absPath = toAbsolute(rawPath);
+  if (!absPath) return null;
+  const store = readStore();
+  const key = normalizeKey(absPath);
+  const entry = store.projects.find((item) => normalizeKey(item.path) === key);
+  if (!entry) return null;
+  const trimmed = String(nextName || '').trim();
+  entry.name = trimmed || basename(absPath) || absPath;
+  writeStore(store);
+  return entry;
+}
+
+/** Whether a path currently exists on disk. */
+export function pathExists(rawPath) {
+  const absPath = toAbsolute(rawPath);
+  return !!absPath && existsSync(absPath);
+}
+
+/** Whether a path exists AND is a directory (tolerant of stat errors). */
+export function isDirectory(rawPath) {
+  const absPath = toAbsolute(rawPath);
+  if (!absPath) return false;
+  try {
+    return statSync(absPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/** Create a directory (recursive). Returns the absolute path, or '' on failure. */
+export function ensureDir(rawPath) {
+  const absPath = toAbsolute(rawPath);
+  if (!absPath) return '';
+  try {
+    mkdirSync(absPath, { recursive: true });
+    return absPath;
+  } catch {
+    return '';
+  }
+}
+
+/** Resolve a raw path to absolute (exported for callers that need it). */
+export function resolveProjectPath(rawPath) {
+  return toAbsolute(rawPath);
+}

package/src/standalone/provider-admin.mjs

@@ -7,12 +7,14 @@ import {
   saveSecret,
 } from '../runtime/shared/config.mjs';
 import {
+  beginOAuthLogin as beginAnthropicOAuthLogin,
   describeAnthropicOAuthCredentials,
   forgetAnthropicOAuthCredentials,
   hasAnthropicOAuthCredentials,
   loginOAuth as loginAnthropicOAuth,
 } from '../runtime/agent/orchestrator/providers/anthropic-oauth.mjs';
 import {
+  beginOAuthLogin as beginOpenAIOAuthLogin,
   describeOpenAIOAuthCredentials,
   forgetOpenAIOAuthCredentials,
   hasOpenAIOAuthCredentials,
@@ -36,9 +38,9 @@ export const API_PROVIDERS = Object.freeze([
 ]);
 
 export const OAUTH_PROVIDERS = Object.freeze([
-  Object.freeze({ id: 'openai-oauth', name: 'Codex', desc: '~/.codex/auth.json', has: hasOpenAIOAuthCredentials, describe: describeOpenAIOAuthCredentials, forget: forgetOpenAIOAuthCredentials, login: loginOpenAIOAuth }),
-  Object.freeze({ id: 'anthropic-oauth', name: 'Claude Code', desc: 'Mixdog OAuth credentials', has: hasAnthropicOAuthCredentials, describe: describeAnthropicOAuthCredentials, forget: forgetAnthropicOAuthCredentials, login: loginAnthropicOAuth }),
-  Object.freeze({ id: 'grok-oauth', name: 'Grok', desc: '~/.grok/auth.json or browser OAuth (Grok Build)', has: hasGrokOAuthCredentials, describe: describeGrokOAuthCredentials, forget: forgetGrokOAuthCredentials, begin: beginGrokOAuthLogin, login: loginGrokOAuth }),
+  Object.freeze({ id: 'openai-oauth', name: 'OpenAI OAuth', desc: 'Mixdog OAuth credentials', has: hasOpenAIOAuthCredentials, describe: describeOpenAIOAuthCredentials, forget: forgetOpenAIOAuthCredentials, begin: beginOpenAIOAuthLogin, login: loginOpenAIOAuth }),
+  Object.freeze({ id: 'anthropic-oauth', name: 'Anthropic OAuth', desc: 'Mixdog OAuth credentials', has: hasAnthropicOAuthCredentials, describe: describeAnthropicOAuthCredentials, forget: forgetAnthropicOAuthCredentials, begin: beginAnthropicOAuthLogin, login: loginAnthropicOAuth }),
+  Object.freeze({ id: 'grok-oauth', name: 'Grok', desc: 'Mixdog OAuth credentials (Grok Build)', has: hasGrokOAuthCredentials, describe: describeGrokOAuthCredentials, forget: forgetGrokOAuthCredentials, begin: beginGrokOAuthLogin, login: loginGrokOAuth }),
 ]);
 
 export const LOCAL_PROVIDERS = Object.freeze([
@@ -72,15 +74,17 @@ function updateConfigProvider(cfgMod, providerId, patch) {
   return cfgMod.loadConfig();
 }
 
-export async function providerSetup(config = {}) {
+export async function providerSetup(config = {}, options = {}) {
   const providers = config.providers || {};
+  const detectLocal = options?.detectLocal !== false;
+  const checkSecrets = options?.checkSecrets !== false;
   const api = API_PROVIDERS.map((p) => {
     const configured = providers[p.id] || {};
     const envName = AGENT_PROVIDER_ENV[p.id] || p.env;
     const env = Boolean(envName && process.env[envName]);
     const configuredEnabled = configured.enabled === true;
-    const authenticated = configuredEnabled || env || Boolean(getAgentApiKey(p.id));
-    const stored = configuredEnabled && !env ? true : authenticated && !env;
+    const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(p.id)) : false;
+    const authenticated = env || stored || (checkSecrets ? Boolean(getAgentApiKey(p.id)) : configuredEnabled);
     return {
       ...p,
       group: 'api',
@@ -90,17 +94,23 @@ export async function providerSetup(config = {}) {
       stored,
       env,
       envName,
-      status: stored ? 'Set' : env ? 'Env' : 'Off',
-      detail: stored ? 'stored in keychain' : env ? envName : p.env,
+      status: stored ? 'Set' : env ? 'Env' : authenticated ? 'Set' : configuredEnabled ? 'No Key' : 'Off',
+      detail: stored ? 'stored in keychain' : env ? envName : authenticated ? 'runtime credential' : envName,
     };
   });
 
   const oauth = OAUTH_PROVIDERS.map((p) => {
-    const auth = typeof p.describe === 'function'
-      ? p.describe()
-      : { authenticated: Boolean(p.has()), status: Boolean(p.has()) ? 'Set' : 'Not Set', detail: p.desc };
-    const authenticated = Boolean(auth.authenticated);
     const configured = providers[p.id] || {};
+    const auth = checkSecrets
+      ? (typeof p.describe === 'function'
+        ? p.describe()
+        : { authenticated: Boolean(p.has()), status: Boolean(p.has()) ? 'Set' : 'Not Set', detail: p.desc })
+      : {
+        authenticated: configured.enabled === true,
+        status: configured.enabled === true ? 'Enabled' : 'Not Set',
+        detail: p.desc,
+      };
+    const authenticated = Boolean(auth.authenticated);
     return {
       id: p.id,
       name: p.name,
@@ -118,7 +128,7 @@ export async function providerSetup(config = {}) {
   const local = await Promise.all(LOCAL_PROVIDERS.map(async (p) => {
     const configured = providers[p.id] || {};
     const baseURL = configured.baseURL || p.url;
-    const detected = await detectLocalProvider(baseURL);
+    const detected = detectLocal ? await detectLocalProvider(baseURL) : false;
     const enabled = configured.enabled === true;
     return {
       id: p.id,
@@ -247,19 +257,23 @@ export async function beginOAuthProviderLogin(cfgMod, provider) {
   if (!oauth) throw new Error(`unknown OAuth provider "${id}"`);
   if (typeof oauth.begin !== 'function') throw new Error(`${id} does not support interactive code login`);
   const started = await oauth.begin();
+  const finish = async (result) => {
+    if (!result) return result;
+    const auth = typeof oauth.describe === 'function'
+      ? oauth.describe()
+      : { authenticated: Boolean(oauth.has()), status: Boolean(oauth.has()) ? 'Set' : 'Not Set' };
+    updateConfigProvider(cfgMod, id, { enabled: Boolean(auth.authenticated) });
+    return { provider: id, type: 'oauth', authenticated: Boolean(auth.authenticated), status: auth.status || null, result };
+  };
   return {
     provider: id,
     type: 'oauth',
     url: started.url,
-    waitForCallback: started.waitForCallback,
+    manualUrl: started.manualUrl || null,
+    waitForCallback: started.waitForCallback?.then(finish),
     cancel: started.cancel,
     completeCode: async (code) => {
-      const result = await started.completeCode(code);
-      const auth = typeof oauth.describe === 'function'
-        ? oauth.describe()
-        : { authenticated: Boolean(oauth.has()), status: Boolean(oauth.has()) ? 'Set' : 'Not Set' };
-      updateConfigProvider(cfgMod, id, { enabled: Boolean(auth.authenticated) });
-      return { provider: id, type: 'oauth', authenticated: Boolean(auth.authenticated), status: auth.status || null, result };
+      return await finish(await started.completeCode(code));
     },
   };
 }
@@ -307,18 +321,21 @@ export function setLocalProvider(cfgMod, provider, { enabled, baseURL } = {}) {
   return { provider: id, type: 'local', enabled: enabled === true, baseURL: nextBaseURL };
 }
 
-export function forgetProviderAuth(provider) {
-  const id = String(provider || '').trim();
+export function forgetProviderAuth(cfgModOrProvider, maybeProvider) {
+  const cfgMod = maybeProvider === undefined ? null : cfgModOrProvider;
+  const id = String(maybeProvider === undefined ? cfgModOrProvider : maybeProvider || '').trim();
   const oauth = OAUTH_BY_ID.get(id);
   if (oauth) {
     if (typeof oauth.forget !== 'function') throw new Error(`forget is not supported for OAuth provider ${id}`);
     const result = oauth.forget();
+    if (cfgMod) updateConfigProvider(cfgMod, id, { enabled: false });
     return { provider: id, type: 'oauth', forgotten: true, removed: Boolean(result?.removed) };
   }
   if (!API_PROVIDER_IDS.has(id)) {
     throw new Error(`unknown provider "${id}"`);
   }
   deleteSecret(SECRET_ACCOUNTS.agentApiKey(id));
+  if (cfgMod) updateConfigProvider(cfgMod, id, { enabled: false });
   return { provider: id, type: 'api-key', forgotten: true };
 }
 
@@ -331,8 +348,8 @@ export const PROVIDER_STATUS_TOOL = {
     destructiveHint: false,
     idempotentHint: true,
     openWorldHint: false,
-    bridgeHidden: true,
+    agentHidden: true,
   },
-  description: 'List mixdog provider authentication/configuration status. This never returns secret values.',
+  description: 'List provider auth/config status. No secrets.',
   inputSchema: { type: 'object', properties: {}, additionalProperties: false },
 };