mixdog 1.2.0 → 1.2.2

package/src/session-runtime/services/agent-tool/job-views/agent-list.mjs

@@ -5,6 +5,8 @@ import { ACTIVE_STAGES } from '../tool-def.mjs';
 import { isTerminalWorkerStatus } from '../worker-rows.mjs';
 import { sessionUsageTotals } from '../../../../runtime/shared/session-usage-totals.mjs';
 
+const CANCELLED_WORKER_STATUS = /^(?:cancelled|canceled|killed|cancel[-_\s]?(?:unconfirmed|pending))$/;
+
 // Idle, closed, errored and reaped/unknown rows are history and stay reachable
 // through the task section (status/read keep their terminal result).
 export function isActiveWorkerRow(row = {}) {
@@ -14,8 +16,11 @@ export function isActiveWorkerRow(row = {}) {
   const status = String(row.status ?? '')
     .trim()
     .toLowerCase();
-  if (ACTIVE_STAGES.has(stage) || ACTIVE_STAGES.has(status)) return true;
-  const effective = stage || status;
+  // `status` decides; the stage is the runtime phase and only stands in for a
+  // row with no status. A cancel in either field is not work.
+  if (CANCELLED_WORKER_STATUS.test(stage) || CANCELLED_WORKER_STATUS.test(status)) return false;
+  const effective = status || stage;
+  if (ACTIVE_STAGES.has(effective)) return true;
   if (!effective || effective === 'unknown') return false;
   return !isTerminalWorkerStatus(effective);
 }

package/src/session-runtime/services/agent-tool/send-flow.mjs

@@ -1,12 +1,14 @@
 import {
   resolveAgentWatchdogPolicy,
   resolveHandoffMessageStartIndex,
+  turnPartialHandoff,
   watchdogPartialHandoffFromError,
   watchdogStoppedHandoff,
 } from '../../../runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs';
 import { clean, normalizeAgentName, resolvePrompt } from './helpers.mjs';
 import { abnormalEmptyFinishError, renderResult } from './render.mjs';
 import {
+  reconcileJobCancelled,
   reconcileJobFinally,
   reconcileJobStreamStalled,
   reconcileJobWatchdogPartial,
@@ -93,6 +95,18 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       turnStartedAt: new Date().toISOString(),
     });
     let handoffMsgStart = 0;
+    // A cancelled turn reports the output it produced before it stopped.
+    const settleCancelled = (error, result = null) => {
+      finalStatus = 'cancelled';
+      reconcileJobCancelled(job, {
+        tag,
+        sessionId,
+        agent: session.agent || null,
+        provider: session.provider,
+        model: session.model,
+        content: turnPartialHandoff(error, mgr.getSession(sessionId), handoffMsgStart) || result?.content || '',
+      });
+    };
     try {
       handoffMsgStart = resolveHandoffMessageStartIndex(mgr.getSession(sessionId));
       const turnHooks = buildTurnHooks({ sessionId, notifyContext, job, turnReview, completionValue });
@@ -100,6 +114,10 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       // Early preview no longer suppresses the canonical body notification;
       // notifyTaskCompletion fires once with output via resolve/reconcile.
       const finalValue = completionValue(result);
+      if (job?.status === 'cancelled') {
+        settleCancelled(null, result);
+        return finalValue;
+      }
       if (finalValue.error) {
         finalStatus = 'error';
         if (job) job._terminalResultValue = finalValue;
@@ -107,6 +125,10 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       }
       return finalValue;
     } catch (error) {
+      if (job?.status === 'cancelled') {
+        settleCancelled(error);
+        throw error;
+      }
       const partial = watchdogPartialHandoffFromError(error, mgr.getSession(sessionId), handoffMsgStart);
       if (partial) {
         finalStatus = 'idle';
@@ -123,10 +145,6 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
         reconcileJobWatchdogPartial(job, value);
         return value;
       }
-      if (job?.status === 'cancelled') {
-        finalStatus = 'cancelled';
-        throw error;
-      }
       finalStatus = 'error';
       reconcileJobStreamStalled(job, error);
       throw error;

package/src/session-runtime/services/agent-tool/spawn-flow/job-start.mjs

@@ -44,6 +44,8 @@ export function createJobStarter({ mgr, notifyStatusChange, notifySessionComplet
       meta: jobMeta,
       resultType: 'agent_task_result',
       renderResult: (result) => renderResult(result),
+      // Cancellation reaches the owner once, with the worker's partial output.
+      notifyOnCancel: true,
       cancel: () => {
         try {
           admissionController.abort(new Error('agent task cancelled before resource admission'));

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-run.mjs

@@ -6,6 +6,7 @@
  */
 import { createNotify } from '../notify.mjs';
 import {
+  reconcileJobCancelled,
   reconcileJobFinally,
   reconcileJobStreamStalled,
   reconcileJobWatchdogPartial,
@@ -15,11 +16,13 @@ import { abnormalEmptyFinishError } from '../render.mjs';
 import { createProgressWatchdogRegistry } from '../../agent-watchdog-registry.mjs';
 import {
   resolveHandoffMessageStartIndex,
+  turnPartialHandoff,
   watchdogPartialHandoffFromError,
   watchdogStoppedHandoff,
 } from '../../../../runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs';
 import { saveSessionAsync } from '../../../../runtime/agent/orchestrator/session/store.mjs';
 import { presetDescriptor } from './spawn-prep.mjs';
+import { workerStageForStatus } from '../worker-rows.mjs';
 
 // Mid-turn worker persistence cadence. The watchdog sweep runs every second;
 // a transcript save is far more expensive than a bookkeeping stamp, so the
@@ -68,7 +71,7 @@ export function createSpawnRunner({
       const messages = Number(progress?.messages) || 0;
       upsertWorkerSessionDeferred(session, tag, {
         status: 'running',
-        stage: progress.stage || 'running',
+        stage: workerStageForStatus('running', progress.stage),
         ...(messages > 0 ? { messages } : {}),
       });
       // The canonical runtime owns persistence; this session is only its descriptor.
@@ -135,6 +138,16 @@ export function createSpawnRunner({
     });
     notifyStatusChange();
     let handoffMsgStart = 0;
+    // A cancelled turn reports the output it produced before it stopped.
+    const settleCancelled = (error, result = null) => {
+      finalStatus = 'cancelled';
+      reconcileJobCancelled(job, {
+        tag,
+        sessionId: session.id,
+        ...presetDescriptor(agent, preset, presetName),
+        content: turnPartialHandoff(error, mgr.getSession(session.id), handoffMsgStart) || result?.content || '',
+      });
+    };
     try {
       handoffMsgStart = resolveHandoffMessageStartIndex(mgr.getSession(session.id));
       const turnHooks = {
@@ -157,6 +170,10 @@ export function createSpawnRunner({
       // notifyTaskCompletion is left to fire exactly once with output via the
       // resolve/reconcile/finally path.
       const finalValue = completionValue(result);
+      if (job?.status === 'cancelled') {
+        settleCancelled(null, result);
+        return finalValue;
+      }
       // Non-job return path (or job path where the terminal-result reconcile
       // already ran): if the finish was abnormal-empty, surface it as a thrown
       // error so finalStatus becomes 'error' and the caller's error path (and
@@ -168,6 +185,10 @@ export function createSpawnRunner({
       }
       return finalValue;
     } catch (error) {
+      if (job?.status === 'cancelled') {
+        settleCancelled(error);
+        throw error;
+      }
       const partial = watchdogPartialHandoffFromError(error, mgr.getSession(session.id), handoffMsgStart);
       if (partial) {
         finalStatus = 'idle';
@@ -182,10 +203,6 @@ export function createSpawnRunner({
         reconcileJobWatchdogPartial(job, value);
         return value;
       }
-      if (job?.status === 'cancelled') {
-        finalStatus = 'cancelled';
-        throw error;
-      }
       finalStatus = 'error';
       reconcileJobStreamStalled(job, error);
       throw error;

package/src/session-runtime/services/agent-tool/worker-index/row-liveness.mjs

@@ -11,8 +11,15 @@ const ACTIVE_WORKER_STATUS =
   /^(?:connecting|requesting|streaming|tool[-_\s]?running|running|queued|pending|starting|cancelling)$/i;
 const WORKER_POOL_FRESH_MS = 2 * 60 * 1000;
 
+const CANCELLED_WORKER_STATUS = /^(?:cancelled|canceled|killed|cancel[-_\s]?(?:unconfirmed|pending))$/i;
+
+/** `status` decides; `stage` is the runtime phase copied in by the progress
+ *  sweep and only decides for a row with no status. A cancel in either field
+ *  is not work (bare `cancelling` still is). */
 export const isActiveWorkerRow = (row) =>
-  ACTIVE_WORKER_STATUS.test(clean(row?.status)) || ACTIVE_WORKER_STATUS.test(clean(row?.stage));
+  !CANCELLED_WORKER_STATUS.test(clean(row?.status)) &&
+  !CANCELLED_WORKER_STATUS.test(clean(row?.stage)) &&
+  ACTIVE_WORKER_STATUS.test(clean(row?.status) || clean(row?.stage));
 
 /** A persisted approval wait whose runtime is gone: the in-memory wait died
  *  with that process (daemon restart), so the flag must not stick. */

package/src/session-runtime/services/agent-tool/worker-index/row-shape.mjs

@@ -2,7 +2,7 @@
 // The one row shape of the worker index: coercing whatever a stored file or a
 // caller hands in, and projecting a live session into a row.
 import { agentTagOf, clean, positiveInt } from '../helpers.mjs';
-import { isLeadPoolAgent } from '../worker-rows.mjs';
+import { isLeadPoolAgent, workerStageForStatus } from '../worker-rows.mjs';
 
 /** An explicit boolean wins; otherwise the session's own fast flag (true) or unknown. */
 function fastFlag(explicit, sessionFast) {
@@ -72,7 +72,7 @@ export function workerRowFromSession(session, fallbackTag = '', extra = {}, getS
   if (!tag || !sessionId) return null;
   const runtime = getSessionRuntime(sessionId);
   const status = clean(extra.status) || (session?.closed === true ? 'closed' : clean(session?.status) || 'idle');
-  const stage = clean(extra.stage) || clean(runtime?.stage) || status;
+  const stage = clean(extra.stage) || workerStageForStatus(status, runtime?.stage);
   const nowIso = new Date().toISOString();
   return {
     tag,

package/src/session-runtime/services/agent-tool/worker-rows.mjs

@@ -1,4 +1,5 @@
 import { agentTagOf, clean, positiveInt, stampMs } from './helpers.mjs';
+import { ACTIVE_STAGES } from './tool-def.mjs';
 
 import { TAG_TOMBSTONE_TTL_MS, tagTombstoneKey } from '../../../runtime/shared/agent-reap-state.mjs';
 export { TAG_TOMBSTONE_TTL_MS, tagTombstoneKey };
@@ -27,6 +28,22 @@ export function isTerminalWorkerStatus(status) {
   );
 }
 
+const WORKING_WORKER_STATUS =
+  /^(?:connecting|requesting|streaming|tool[-_\s]?running|running|queued|pending|starting|cancelling)$/i;
+const WORKING_WORKER_STAGES = new Set([...ACTIVE_STAGES, 'resource_wait']);
+
+/** The `stage` to store beside a worker `status`, from a stage read off the
+ *  live runtime. That stage is the runtime's own phase, so mid-work it can say
+ *  `idle`/`done`/`error` (a fresh or just-settled runtime entry) while the
+ *  worker is still running. Stored next to a working status it made a mixed
+ *  row that readers classified as finished, so a working status keeps a
+ *  working stage and falls back to the status itself. */
+export function workerStageForStatus(status, runtimeStage) {
+  const stage = clean(runtimeStage);
+  if (!WORKING_WORKER_STATUS.test(clean(status))) return stage || clean(status);
+  return WORKING_WORKER_STAGES.has(stage.toLowerCase()) ? stage : clean(status);
+}
+
 export function recoverTagTombstoneOwner(row, sessions) {
   if (clean(row.parentSessionId || row.ownerSessionId)) return row;
   const pid = positiveInt(row.clientHostPid);

package/src/session-runtime/services/channel-session-router.mjs

@@ -19,7 +19,10 @@ export function createChannelSessionRouter({ getSessionService, getSessionId, lo
       service.submitSession({
         sessionId,
         prompt: content,
-        options: { source: 'channel' },
+        // A channel notification (webhook event rules carry fenced external
+        // values) is queued as a task notification, never as typed input, so
+        // nothing inside it selects a skill.
+        options: { source: 'channel', mode: 'task-notification' },
       })
     ).catch((error) => {
       log(`channel session delivery failed session=${sessionId}: ${error?.message || error}`);

package/src/session-runtime/services/hook-bus/command-handler.mjs

@@ -3,6 +3,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { MAX_BUFFER_BYTES } from './constants.mjs';
 import { handlerTimeoutS } from './handler-timeout.mjs';
 import { abortReason, throwIfAborted } from '../../../runtime/shared/abort-race.mjs';
+import { scrubRuntimeRootVars } from '../../../runtime/agent/orchestrator/tools/env-scrub.mjs';
 
 function resolvePlaceholders(str, projectDir, pluginData, pluginRoot = null) {
   if (typeof str !== 'string') return str;
@@ -88,8 +89,10 @@ function hookEnv(projectDir, pluginData, payload, pluginRoot = null) {
   const resolvedProject = projectDir || process.cwd();
   const resolvedPluginRoot = pluginRoot || resolvedProject;
   const resolvedPluginData = pluginData || resolvedProject;
+  // Hooks are user commands like model shells: the host's runtime root,
+  // identity and Electron node-mode must not reach them.
   const env = {
-    ...process.env,
+    ...scrubRuntimeRootVars({ ...process.env }),
     MIXDOG_PROJECT_DIR: resolvedProject,
     MIXDOG_PLUGIN_ROOT: resolvedPluginRoot,
     MIXDOG_PLUGIN_DATA: resolvedPluginData,

package/src/session-runtime/services/hook-bus/handlers.mjs

@@ -1,6 +1,7 @@
 import { readResponseBuffer } from '../../../runtime/shared/bounded-download.mjs';
 import { runAbortable, throwIfAborted } from '../../../runtime/shared/abort-race.mjs';
 import { assertPublicUrl, pinnedFetch } from '../../../runtime/web-search/lib/ssrf-guard.mjs';
+import { providerSafeMcpToolName } from '../../../runtime/agent/orchestrator/mcp/client-config.mjs';
 import { handlerTimeoutS } from './handler-timeout.mjs';
 export { handlerTimeoutS } from './handler-timeout.mjs';
 export { defaultShellKind, runCommandHandler } from './command-handler.mjs';
@@ -216,8 +217,9 @@ export async function runMcpToolHandler(handler, payload, eventName, mcpToolRunn
   throwIfAborted(signal);
   const timeoutMs = Math.round(handlerTimeoutS(handler, eventName) * 1000);
   let name = String(handler.tool || '').trim();
-  if (handler.server && !name.startsWith('mcp__')) {
-    name = `mcp__${String(handler.server).trim()}__${name}`;
+  if (handler.server && name && !name.startsWith('mcp__')) {
+    // The same provider-safe name the server's tool was registered under.
+    name = providerSafeMcpToolName(String(handler.server).trim(), name);
   }
   if (!name) {
     return {
@@ -241,7 +243,9 @@ export async function runMcpToolHandler(handler, payload, eventName, mcpToolRunn
         onTimeout: () => {
           try {
             controller.abort(new Error(`mcp_tool hook timed out: ${name}`));
-          } catch {}
+          } catch {
+            // Abort is best-effort; the timeout error below is what callers see.
+          }
           return new Error(`mcp_tool hook timed out: ${name}`);
         },
       }

package/src/session-runtime/services/provider-admin.mjs

@@ -54,6 +54,15 @@ import {
   beginOAuthLogin as beginMuseCodeOAuthLogin,
   loginOAuth as loginMuseCodeOAuth,
 } from '../../runtime/agent/orchestrator/providers/muse-code-oauth-login.mjs';
+import {
+  describeCommandCodeOAuthCredentials,
+  forgetCommandCodeOAuthCredentials,
+  hasCommandCodeOAuthCredentials,
+} from '../../runtime/agent/orchestrator/providers/command-code-oauth-tokens.mjs';
+import {
+  beginOAuthLogin as beginCommandCodeOAuthLogin,
+  loginOAuth as loginCommandCodeOAuth,
+} from '../../runtime/agent/orchestrator/providers/command-code-oauth-login.mjs';
 import {
   beginCursorOAuthLogin,
   describeCursorOAuthCredentials,
@@ -80,6 +89,7 @@ import {
   changeProviderAccounts,
   removeProviderAccount,
   clearProviderAccountQuotaState,
+  providerAccountLimit,
   ACCOUNT_PROVIDERS,
 } from '../../runtime/shared/provider-accounts.mjs';
 import { currentProviderAccountId, withProviderAccount } from '../../runtime/shared/provider-auth-binding.mjs';
@@ -154,6 +164,16 @@ const OAUTH_PROVIDERS = Object.freeze([
     begin: beginMuseCodeOAuthLogin,
     login: loginMuseCodeOAuth,
   }),
+  Object.freeze({
+    id: 'command-code-oauth',
+    name: 'Command Code',
+    desc: 'Sign in with your Command Code account',
+    has: hasCommandCodeOAuthCredentials,
+    describe: describeCommandCodeOAuthCredentials,
+    forget: forgetCommandCodeOAuthCredentials,
+    begin: beginCommandCodeOAuthLogin,
+    login: loginCommandCodeOAuth,
+  }),
   Object.freeze({
     id: 'mimo-oauth',
     name: 'MiMo',
@@ -421,6 +441,12 @@ function customProviderRow(id, entry, checkSecrets = true) {
   const keyless = (config?.auth ?? entry.auth) === 'none';
   const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id)) : false;
   const unstoredStatus = configuredEnabled ? 'No Key' : 'Off';
+  let status = stored ? 'Set' : unstoredStatus;
+  let detail = stored ? 'stored in keychain' : 'custom endpoint';
+  if (keyless) {
+    status = configuredEnabled ? 'Keyless' : 'Off';
+    detail = 'no API key required';
+  }
   const row = {
     id,
     name: entry.name,
@@ -431,12 +457,12 @@ function customProviderRow(id, entry, checkSecrets = true) {
     group: 'api',
     type: 'api-key',
     enabled: configuredEnabled,
-    authenticated: keyless ? true : checkSecrets ? stored : configuredEnabled,
+    authenticated: keyless || (checkSecrets ? stored : configuredEnabled),
     stored,
     env: false,
     envName: null,
-    status: keyless ? (configuredEnabled ? 'Keyless' : 'Off') : stored ? 'Set' : unstoredStatus,
-    detail: keyless ? 'no API key required' : stored ? 'stored in keychain' : 'custom endpoint',
+    status,
+    detail,
   };
   row.schemaVersion = config?.schemaVersion ?? entry.schemaVersion;
   row.auth = keyless ? 'none' : 'key';
@@ -584,7 +610,7 @@ export async function loginOAuthProvider(cfgMod, provider) {
     updateConfigProvider(cfgMod, id, { enabled: true });
     // Same reason as the interactive add-account flow: a fresh credential says
     // nothing about the quota the previous one exhausted.
-    if (ACCOUNT_PROVIDERS.includes(id)) clearProviderAccountQuotaState(id, currentProviderAccountId(id));
+    if (ACCOUNT_PROVIDERS.includes(id)) await clearProviderAccountQuotaState(id, currentProviderAccountId(id));
   }
   return { provider: id, type: 'oauth', authenticated: Boolean(auth.authenticated), status: auth.status || null };
 }
@@ -621,7 +647,7 @@ function rosterAccountForIdentity(id, oauth, newAccountId, auth) {
   return match?.id || null;
 }
 
-function settleOAuthLogin(
+async function settleOAuthLogin(
   { cfgMod, id, accountId: signedInId, addAccount, includeDefault, label, inAccount, oauth },
   result
 ) {
@@ -635,11 +661,11 @@ function settleOAuthLogin(
       renameSync(providerAccountPath(id, signedInId), providerAccountPath(id, existingId));
       accountId = existingId;
     }
-    registerProviderAccount(id, accountId, { includeDefault, label });
+    await registerProviderAccount(id, accountId, { includeDefault, label });
     // A re-connect can follow a re-created subscription under the same
     // account id: start it from no recorded quota rather than from the
     // exhausted window the previous credential earned.
-    clearProviderAccountQuotaState(id, accountId);
+    await clearProviderAccountQuotaState(id, accountId);
     updateConfigProvider(cfgMod, id, { enabled: true });
   }
   return {
@@ -688,12 +714,20 @@ export async function beginOAuthProviderLogin(cfgMod, provider, options = {}) {
   // The callback and a pasted code can both deliver the same sign-in; it must
   // settle once, because settling may move the credential to an existing id.
   let settled = null;
+  let settling = null;
   const finish = async (result) => {
     if (!result || cancelled) return null;
     if (settled) return settled;
-    const outcome = settleOAuthLogin(login, result);
-    if (outcome.authenticated) settled = outcome;
-    return outcome;
+    // Settling is async now: a second delivery arriving mid-write shares it.
+    if (settling) return settling;
+    settling = settleOAuthLogin(login, result);
+    try {
+      const outcome = await settling;
+      if (outcome.authenticated) settled = outcome;
+      return outcome;
+    } finally {
+      settling = null;
+    }
   };
   return {
     provider: id,
@@ -721,9 +755,11 @@ export function listProviderAccounts(provider) {
   if (!oauth) throw new TypeError('Unknown OAuth provider.');
   const pool = readProviderAccountPool(provider);
   const accounts = pool.accounts.length ? pool.accounts : defaultAccountRows(provider, oauth);
+  const now = Date.now();
   return {
     provider,
     auto: pool.auto !== false,
+    policy: pool.policy,
     useCredits: pool.useCredits === true,
     selectedId: pool.selectedId || accounts[0]?.id || null,
     accounts: accounts.map((row) => {
@@ -740,6 +776,9 @@ export function listProviderAccounts(provider) {
         reauthRequired: auth.reauthRequired === true,
         usage: row.usage || null,
         blockedUntil: row.blockedUntil || null,
+        // The limit holding the account now: account-wide, or only for one
+        // model family ("7D Fable") while other models still run.
+        limit: providerAccountLimit(row, now, { useCredits: pool.useCredits === true }),
         ...(identity ? { identity } : {}),
         ...(typeof auth.email === 'string' && auth.email.trim() ? { email: auth.email.trim() } : {}),
       };
@@ -753,17 +792,23 @@ function defaultAccountRows(provider, oauth) {
   return authenticated ? [{ id: 'default', label: 'Account 1' }] : [];
 }
 
-export function updateProviderAccounts(provider, change) {
+// Store the implicit signed-in `default` account in the roster, so a change or
+// a usage measurement has a row to land on. Returns the current roster view.
+export async function materializeProviderAccounts(provider) {
   const current = listProviderAccounts(provider);
-  if (!readProviderAccountPool(provider).accounts.length && current.accounts.length) {
-    registerProviderAccount(provider, 'default', { label: 'Account 1' });
-  }
-  changeProviderAccounts(provider, change);
+  if (readProviderAccountPool(provider).accounts.length || !current.accounts.length) return current;
+  await registerProviderAccount(provider, 'default', { label: 'Account 1' });
+  return listProviderAccounts(provider);
+}
+
+export async function updateProviderAccounts(provider, change) {
+  await materializeProviderAccounts(provider);
+  await changeProviderAccounts(provider, change);
   // Picking an account by hand is a decision to use it NOW, so the refusal
   // window and meter stored against it — both describing the state the user
   // just changed — are dropped here. Never in the pool's own fallback commit,
   // where clearing them would send the request back to a spent account.
-  if (change?.selectedId !== undefined) clearProviderAccountQuotaState(provider, change.selectedId);
+  if (change?.selectedId !== undefined) await clearProviderAccountQuotaState(provider, change.selectedId);
   return listProviderAccounts(provider);
 }
 
@@ -859,7 +904,8 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   const config = normalizeCustomProviderConfig(input, options);
   const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
   const keyless = config.auth === 'none';
-  const apiKey = keyless ? '' : typed || (id ? getAgentApiKey(id) || '' : '');
+  let apiKey = '';
+  if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
   return { id, config, typed: keyless ? '' : typed, apiKey, keyless };
 }
 
@@ -1078,7 +1124,7 @@ export async function forgetProviderAuth(cfgModOrProvider, maybeProvider, reques
       throw new TypeError('Account is no longer connected.');
     }
     const result = withProviderAccount(id, accountId, () => oauth.forget());
-    const pool = removeProviderAccount(id, accountId);
+    const pool = await removeProviderAccount(id, accountId);
     if (cfgMod) updateConfigProvider(cfgMod, id, { enabled: pool.accounts.length > 0 });
     return { provider: id, type: 'oauth', forgotten: true, removed: Boolean(result?.removed) };
   }

package/src/session-runtime/services/usage-dashboard-model.mjs

@@ -236,6 +236,8 @@ function providerDescription(id, group) {
       return 'Grok Build subscription quota';
     case 'muse-code-oauth':
       return 'Muse Code subscription quota';
+    case 'command-code-oauth':
+      return 'Command Code subscription quota';
     case 'mimo-oauth':
       return 'MiMo Token Plan subscription quota';
     case 'antigravity-oauth':
@@ -343,6 +345,7 @@ const PROVIDER_RANKS = {
   'anthropic-oauth': 20,
   'grok-oauth': 30,
   'muse-code-oauth': 33,
+  'command-code-oauth': 33.5,
   'mimo-oauth': 34,
   'cursor-oauth': 35,
   'antigravity-oauth': 36,

package/src/session-runtime/settings-compaction-api.mjs

@@ -82,6 +82,7 @@ export function createCompactionSettings({
       const next = { ...current };
       if (hasOwn(input, 'auto')) next.auto = input.auto !== false;
       if (hasOwn(input, 'enabled')) next.auto = input.enabled !== false;
+      if (hasOwn(input, 'onModelChange')) next.onModelChange = input.onModelChange !== false;
       // Legacy Compact type fields are intentionally ignored. There is one
       // fresh-context Compact contract for every session.
       // A new budget representation replaces the previous one. Otherwise a

package/src/session-runtime/setup-tool/executor.mjs

@@ -146,6 +146,7 @@ function publicAccounts(pool) {
   return {
     selectedId: pool.selectedId,
     auto: pool.auto,
+    ...(pool.policy ? { policy: pool.policy } : {}),
     useCredits: pool.useCredits === true,
     accounts: pool.accounts.map(({ id, label, authenticated, reauthRequired }) => ({
       id,
@@ -166,9 +167,15 @@ function mcpRows(status) {
       transport: server.transport || server.type || '',
       toolCount: Number(server.toolCount || 0),
       source: server.source || '',
+      ...(server.owner?.kind === 'plugin'
+        ? { plugin: server.owner.id, pluginServer: server.owner.key, disabledReason: server.disabledReason || null }
+        : {}),
       error: server.error || null,
+      ...(server.warnings?.length ? { warnings: server.warnings } : {}),
       scope: Array.isArray(server.scope) ? server.scope : null,
     })),
+    ...(status?.warnings?.length ? { warnings: status.warnings } : {}),
+    ...(status?.declarationErrors?.length ? { declarationErrors: status.declarationErrors } : {}),
   };
 }
 
@@ -577,7 +584,11 @@ const SETUP_ACTION_HANDLERS = {
     const plugin = ((await rt.pluginsStatus())?.plugins || []).find((row) => row.name === name || row.id === name);
     if (!plugin) throw new Error(`plugin "${name}" not found`);
     const result = await rt.enablePluginMcp(plugin);
-    return { serverName: result.serverName, mcp: mcpRows(result.status) };
+    return {
+      serverName: result.serverName,
+      ...(result.serverNames ? { serverNames: result.serverNames } : {}),
+      mcp: mcpRows(result.status),
+    };
   },
 };
 

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -34,6 +34,7 @@ function publicMcpConfig(row) {
   return {
     name: row.name,
     source: row.source,
+    ...(row.owner?.kind === 'plugin' ? { plugin: row.owner.id, pluginServer: row.owner.key, readOnly: true } : {}),
     enabled: row.enabled !== false,
     type: config.type || 'stdio',
     cwd: config.cwd || '',

package/src/session-runtime/setup-tool/settings-contract.mjs

@@ -196,6 +196,7 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
     runInBackground: boolean,
     turnNotifications: boolean,
     usagePinned: boolean,
+    usageRailShortLong: boolean,
     computerObserveOnly: boolean,
     notificationVolume: {
       type: 'integer',

package/src/session-runtime/setup-tool/tool-defs.mjs

@@ -227,7 +227,7 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           type: 'string',
           enum: [...INSTRUCTION_FILES_MODES],
           description:
-            'set_instruction_files: which user instruction files new sessions load (global ~/.codex/AGENTS.md, ~/.claude/CLAUDE.md, then the Project root\'s AGENTS.md/CLAUDE.md).',
+            "set_instruction_files: which user instruction files new sessions load (global ~/.codex/AGENTS.md, ~/.claude/CLAUDE.md, then the Project root's AGENTS.md/CLAUDE.md).",
         },
         name: {
           type: 'string',
@@ -244,6 +244,12 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           properties: {
             selectedId: { type: 'string', description: 'Account to use now.' },
             auto: { type: 'boolean', description: 'Automatic switching to another account when one is exhausted.' },
+            policy: {
+              type: 'string',
+              enum: ['manual', 'limit', 'headroom'],
+              description:
+                'Account switching: manual = selected account only; limit = switch when it reaches a limit; headroom = each new session starts on the account with the most headroom.',
+            },
             useCredits: { type: 'boolean', description: 'Allow paid credits once plan limits are reached.' },
             order: {
               type: 'array',

package/src/session-runtime/skills-api.mjs

@@ -24,8 +24,8 @@ const DEFAULT_SKILL_BODY = '# Instructions\n\nDescribe how to use this skill.';
 export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
   const globalSkillsRoot = () => resolve(resolvePluginData(), 'skills');
 
-  function skillsStatus() {
-    const cwd = getCwd();
+  /** `cwd` overrides the session's folder (already validated by the caller). */
+  function skillsStatus({ cwd = getCwd() } = {}) {
     const skills = typeof contextMod.collectSkillsCached === 'function' ? contextMod.collectSkillsCached(cwd) : [];
     const norm = (value) =>
       String(value || '')
@@ -54,7 +54,10 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
         const source = sourceForSkill(skill);
         return {
           name: skill.name,
-          enabled: !(contextMod.isSkillDisabled?.(skill.name) || contextMod.skillMissingFeature?.(skill.name)),
+          enabled: !(
+            contextMod.isSkillDisabled?.(skill.name, null, skills) ||
+            contextMod.skillMissingFeature?.(skill.name, null, skills)
+          ),
           description: skill.description || '',
           whenToUse: skill.whenToUse || '',
           filePath: skill.filePath || null,
@@ -90,6 +93,7 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
     if (typeof contextMod.isSkillDisabled === 'function' && contextMod.isSkillDisabled(skillName)) {
       return `Error: skill "${skillName}" is disabled`;
     }
+    if (contextMod.skillOutsideScope?.(skillName, getCwd())) return contextMod.skillOutsideScopeError(skillName);
     const skill = skillContent(skillName);
     // The general tool envelope keeps the main/Lead session identical to agent
     // loops: the model-visible tool_result is the short stub and the SKILL.md

package/src/session-runtime/turn/turn-run/ask-callbacks.mjs

@@ -91,6 +91,7 @@ export function createAskCallbacks({ transcript, notifyFnForSession, scheduleSea
       onStreamDelta: streamDelta(turn, options),
       drainSteering: options.drainSteering,
       onSteerMessage: options.onSteerMessage,
+      onSkillsApplied: options.onSkillsApplied,
       notifyFn: notifyFnForSession(session0.id),
       signal: turn.signal,
     };