mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/context/role-instructions.mjs

@@ -1,5 +1,6 @@
 // Agent-scoped role markdown and 4-BP system prompt composition.
 
+import { createHash } from 'node:crypto';
 import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { compareCodePoints } from '../../../shared/code-point-order.mjs';
@@ -7,6 +8,7 @@ import { mixdogRoot } from '../../../shared/plugin-paths.mjs';
 import { readMarkdownDocument } from '../../../shared/markdown-frontmatter.mjs';
 import { listHiddenAgentsByKind, getAgentCatalogShareAgents } from '../internal-agents.mjs';
 import { mixdogGlobalDir, mtimeWithTtl, readSafe } from './skill-catalog.mjs';
+import { mixyDisplayName } from '../session/mixy-name.mjs';
 
 // --- Agent-scoped instruction loader ---
 // Emits a BP2 agent/system block scoped to the calling agent:
@@ -45,6 +47,12 @@ const _scopedRoleInstructionsCache = new Map();
 const _scopedRoleInstructionsMtimeCache = new Map();
 const _ROLE_INSTRUCTIONS_MTIME_TTL_MS = 2000;
 
+/** A saved AGENT.md applies to the next composition, even inside the mtime TTL. */
+export function invalidateRoleInstructionsCache() {
+  _scopedRoleInstructionsCache.clear();
+  _scopedRoleInstructionsMtimeCache.clear();
+}
+
 function loadHiddenAgentSnippets(pluginRoot) {
   try {
     const agentRulesDir = join(pluginRoot, 'rules', 'agent');
@@ -106,7 +114,9 @@ function loadAgentSections(pluginRoot) {
         name = entry.name.replace(/\.md$/, '');
         raw = readSafe(join(agentsDir, entry.name));
       }
-      if (!name || !raw) continue;
+      // Mixy's own AGENT.md (agents/lead/) rides only Mixy's agent-mode
+      // prompt (loadMixyRoleSection), never another role catalog.
+      if (!name || !raw || name === 'lead') continue;
       const { body } = readMarkdownDocument(raw);
       if (!body) continue;
       byName.set(name, roleSection(name, body));
@@ -225,6 +235,144 @@ export function loadScopedRoleInstructions(agent, provider = null) {
   }
 }
 
+// --- Agent persona (agents/<id>/PERSONA.md) ---
+// Optional tone/addressing/personality guide, rendered right after the
+// agent's role section. Read from the same directory that supplies the
+// agent's AGENT.md (user data dir first, then shipped); the Lead (`lead`,
+// Mixy) has no AGENT.md, so its persona is the first PERSONA.md found.
+// The text depends only on the file, so the BP3 prefix is stable until the
+// file changes; it is re-read per composition, so an edit applies next turn.
+export const PERSONA_MAX_CHARS = 4000;
+export const PERSONA_TRUNCATION_MARKER = '\n\n[persona truncated]';
+const PERSONA_AGENT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+export function truncatePersona(text, max = PERSONA_MAX_CHARS) {
+  const value = typeof text === 'string' ? text.trim() : '';
+  if (value.length <= max) return value;
+  return value.slice(0, max).trimEnd() + PERSONA_TRUNCATION_MARKER;
+}
+
+export function loadAgentPersonaSection(agent) {
+  if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
+  const isLead = agent === 'lead';
+  const pluginRoot = mixdogRoot();
+  const roots = [];
+  try {
+    const userDir = mixdogGlobalDir('agents');
+    if (userDir) roots.push(userDir);
+  } catch {
+    /* unresolvable data dir — shipped persona still loads */
+  }
+  if (pluginRoot) roots.push(join(pluginRoot, 'agents'));
+  for (const root of roots) {
+    const dir = join(root, agent);
+    if (!isLead && !existsSync(join(dir, 'AGENT.md'))) continue;
+    const persona = truncatePersona(readSafe(join(dir, 'PERSONA.md')) || '');
+    if (!persona) {
+      if (isLead) continue;
+      return '';
+    }
+    return [
+      '## Persona',
+      '',
+      'Tone and style guide for how you speak, address the user and carry yourself. It never overrides tool, safety or role rules; those always win.',
+      '',
+      persona,
+    ].join('\n');
+  }
+  return '';
+}
+
+// --- Mixy's working style (agents/lead/AGENT.md, user data dir) ---
+// The user-editable 일하는 방식 of Mixy, framed like any agent's role section.
+// Agent mode only; empty or missing means no section. Re-read per
+// composition, so an edit applies to the next prompt build.
+export function loadMixyRoleSection() {
+  let raw = '';
+  try {
+    const userDir = mixdogGlobalDir('agents');
+    raw = userDir ? readSafe(join(userDir, 'lead', 'AGENT.md')) || '' : '';
+  } catch {
+    return '';
+  }
+  const { body } = readMarkdownDocument(raw);
+  const text = String(body || '').trim();
+  return text ? `# Agent Role Catalog\n\n${roleSection('lead', text)}` : '';
+}
+
+// --- Agent-mode identity (LEAD.md first line) ---
+// "You are <name>, <what it does>." from the agent's manifest (agent.json, the
+// name/description the editor writes), user copy first, then shipped. Mixy
+// (the Lead configuration, id `lead`) has its own line, under the display name
+// the user gave it (session/mixy-name.mjs), Mixy by default.
+function agentManifest(agent) {
+  const roots = [];
+  try {
+    const userDir = mixdogGlobalDir('agents');
+    if (userDir) roots.push(userDir);
+  } catch {
+    /* unresolvable data dir — shipped manifest still loads */
+  }
+  const pluginRoot = mixdogRoot();
+  if (pluginRoot) roots.push(join(pluginRoot, 'agents'));
+  for (const root of roots) {
+    const dir = join(root, agent);
+    if (!existsSync(join(dir, 'AGENT.md'))) continue;
+    try {
+      const value = JSON.parse(readSafe(join(dir, 'agent.json')) || '{}');
+      return value && typeof value === 'object' ? value : {};
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+
+export function agentModeIdentityLine(agent) {
+  if (agent === 'lead') return `You are ${mixyDisplayName()}, the user's assistant in Mixdog.`;
+  if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
+  const oneLine = (value) => (typeof value === 'string' ? value.replace(/\s+/g, ' ').trim() : '');
+  const manifest = agentManifest(agent);
+  const name = oneLine(manifest.name) || agent;
+  const role = oneLine(manifest.description).replace(/[.。]+$/, '');
+  return role ? `You are ${name}. Your role: ${role}.` : `You are ${name}.`;
+}
+
+// --- Agent profile revision ---
+// The files an agent's prompt sections (identity line, role, persona) are
+// read from — its agent.json, AGENT.md and PERSONA.md in the user data dir and
+// the shipped tree — as one hash. A session stamps it when its prompt is
+// composed; another value means the profile was edited since
+// (session-runtime/tool-policy-refresh.mjs refreshAgentProfile). '' for an
+// invalid id.
+export function agentProfileRevision(agent) {
+  if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
+  const roots = [mixdogGlobalDir('agents')];
+  const pluginRoot = mixdogRoot();
+  if (pluginRoot) roots.push(join(pluginRoot, 'agents'));
+  const hash = createHash('sha256');
+  for (const root of roots) {
+    for (const file of ['agent.json', 'AGENT.md', 'PERSONA.md']) {
+      hash.update(`${root}\0${file}\0${readSafe(join(root, agent, file)) ?? '\u0001'}\0`);
+    }
+  }
+  return hash.digest('hex').slice(0, 24);
+}
+
+// --- Lead roster revision ---
+// The bot roster a Lead's prompt lists (workflow/context.mjs leadPromptParts:
+// the agent catalog and Mixy's contact catalog — never the orchestration
+// mode, a setting that applies to new sessions), as one hash, stamped beside
+// agentProfileRevision. A bot created, renamed, archived or restored changes
+// it for every Lead whose prompt lists that bot.
+export function leadRosterRevision(parts) {
+  const hash = createHash('sha256');
+  for (const slice of [parts?.agentCatalogContext, parts?.contactCatalogContext]) {
+    hash.update(`${slice || ''}\0`);
+  }
+  return hash.digest('hex').slice(0, 24);
+}
+
 // --- Compose system prompt — 4-BP cache layout ---
 // Returns the three stable system blocks and the BP3 core used for refreshes.
 // They map directly to the breakpoint plan:
@@ -262,32 +410,53 @@ export function composeSystemPrompt(opts) {
   ]);
 
   // ── BP3: workflow/role + session environment layer ─────────────────
-  const roleInstructionContext = opts.skipRoleCatalog
-    ? ''
-    : loadScopedRoleInstructions(opts.agent || null, opts.provider || null);
-  // Keep the active workflow first within BP3 so it leads the role and
-  // environment material that varies with the session.
+  let roleInstructionContext = '';
+  if (!opts.skipRoleCatalog) {
+    roleInstructionContext =
+      opts.agent === 'lead'
+        ? loadMixyRoleSection()
+        : loadScopedRoleInstructions(opts.agent || null, opts.provider || null);
+  }
+  // Persona follows the role; the Lead has no role section but may own a
+  // persona through agents/lead/PERSONA.md.
+  const personaContext = opts.agent && !opts.skipPersona ? loadAgentPersonaSection(opts.agent) : '';
   const coreMemory = skip.memory ? '' : trimmedPromptSlice(opts.coreMemoryContext);
   // User AGENTS.md / CLAUDE.md block (context/instruction-files.mjs), already
-  // headed `# Instruction Files`; rides right after core memory.
+  // headed `# Instruction Files`; rides right before core memory.
   const instructionFiles = skip.claudemd ? '' : trimmedPromptSlice(opts.instructionFilesContext);
+  // Ordered for the longest shared prefix (session-prompt-composition.mjs):
+  // 1. shared by every Lead — the workflow pack and LEAD.md's common lines;
+  // 2. the mode block — coding: orchestration mode, LEAD.md's two passages,
+  //    the full agent catalog; agent mode: the delegation block, their
+  //    variants, AGENT_MODE.md, the sub-agent catalog (the same for every
+  //    agent other than Mixy);
+  // 3. Mixy only — MIXY.md and its contact-agent catalog;
+  // 4. per session or agent, last — routine line, identity, caller prompt,
+  //    role, persona, instruction files and core memory (changes most).
   const sessionMarkerCore = joinPromptSlices([
     trimmedPromptSlice(opts.workflowContext),
     opts.roleRules || '',
+    trimmedPromptSlice(opts.orchestrationContext),
+    opts.leadModeRules || '',
+    opts.agentModeRules || '',
+    trimmedPromptSlice(opts.agentCatalogContext),
+    opts.mixyRules || '',
+    trimmedPromptSlice(opts.contactCatalogContext),
+    opts.routineRules || '',
+    opts.identityContext || '',
     opts.userPrompt || '',
     roleInstructionContext,
-    coreMemory ? `# Core Memory\n${coreMemory}` : '',
+    personaContext,
     instructionFiles,
+    coreMemory ? `# Core Memory\n${coreMemory}` : '',
   ]);
   // Response language is the LAST system text before the conversation. It
   // rides the environment block (not the tier3 core) because the `# Session`
   // / shell / git lines are English and would otherwise trail it, pulling the
   // pre-tool preamble toward English.
-  const environmentParts = [
-    opts.sessionStartContext,
-    opts.environmentContext,
-    opts.languageContext,
-  ].map(trimmedPromptSlice);
+  const environmentParts = [opts.sessionStartContext, opts.environmentContext, opts.languageContext].map(
+    trimmedPromptSlice
+  );
   // Volatile session/project environment. Kept OUT of sessionMarkerCore so
   // Anthropic providers can leave it as an UNMARKED system block (covered by
   // the messages-tail breakpoint) while prefix-order providers still see it

package/src/runtime/agent/orchestrator/context/skill-catalog.mjs

@@ -174,8 +174,10 @@ export function collectSkills(cwd) {
         } catch {
           continue;
         }
-        // Agent Skills requires the manifest name to match its folder.
-        if (basename(dirname(filePath)) !== skill.name) continue;
+        // Agent Skills requires the manifest name to match its folder. Plugins
+        // are exempt: they ship nested layouts (skills/<plugin>/<topic>/) and
+        // load by their declared name; `seen` still settles collisions.
+        if (source !== 'plugin' && basename(dirname(filePath)) !== skill.name) continue;
         if (seen.has(skill.name)) continue;
         seen.add(skill.name);
         skills.push({
@@ -495,7 +497,7 @@ export function buildSkillResultEnvelope(name, content, skillDir) {
   body = body.replace(/\$\{MIXDOG_SKILL_NODE\}/g, SKILL_LAUNCHER_COMMAND);
   if (skillDir) {
     const normDir = String(skillDir).replace(/\\/g, '/');
-    body = body.replace(/\$\{MIXDOG_SKILL_DIR\}/g, normDir);
+    body = body.replace(/\$\{MIXDOG_SKILL_DIR\}/g, () => normDir);
     const escapedDir = escapeSkillXmlText(normDir);
     dirLine = `<base-dir>${escapedDir}</base-dir>\n`;
   }

package/src/runtime/agent/orchestrator/internal-agents.mjs

@@ -121,16 +121,26 @@ function _loadHiddenAgents() {
  * by an agents.json modification (tracked via maxMtimeRecursive in
  * collect.mjs) consume fresh metadata in the same process.
  */
+// The agent-status pulse resolves a watchdog policy per worker row, and each
+// lookup re-stat'ed every dependency file synchronously. The mtime probe runs
+// at most once per interval; an edit is picked up by the next probe.
+const HIDDEN_AGENTS_RECHECK_MS = 1000;
+let _hiddenAgentsCheckedAt = 0;
+
 function _getHiddenAgents() {
+  const now = Date.now();
+  if (_hiddenAgentsCache && now - _hiddenAgentsCheckedAt < HIDDEN_AGENTS_RECHECK_MS) return _hiddenAgentsCache.map;
   // The mtime probe never throws; a load failure surfaces with the message
   // _loadHiddenAgents already gave it, and the stale cache is not reused.
   if (_hiddenAgentsCache && _maxMtime(_hiddenAgentsCache.files) <= _hiddenAgentsCache.mtime) {
+    _hiddenAgentsCheckedAt = now;
     return _hiddenAgentsCache.map;
   }
   const files = _hiddenAgentsDependencyFiles();
   const mtime = _maxMtime(files);
   const map = _loadHiddenAgents();
   _hiddenAgentsCache = { mtime, files, map };
+  _hiddenAgentsCheckedAt = now;
   return map;
 }
 

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -0,0 +1,215 @@
+// Connector policy: which globally installed MCP servers (connectors) an agent
+// or a project may use. Every installed connector is on by default for every
+// agent and project, existing and future ones; a policy only switches some off:
+//   agents/<id>/agent.json   connectors: { off: [serverId…], tools?: { [serverId]: { [tool]: permission } } }
+//   <data>/project-connectors.json   { projects: { [projectRoot]: { off: [serverId…] } } }
+// `tools` keeps per-tool overrides (auto | needs_approval | disabled); a tool
+// without one is auto, except a catalog connector's high-risk tools, which
+// ask (connectorToolDefault). A legacy agent list (an array: only its enabled
+// entries were mounted) is enforced as written until the host converts it
+// (migrateLegacyConnectorPolicy). A policy that cannot be read, or has neither
+// shape, mounts nothing. Enforced at dispatch only: every session lists every
+// connected tool, so the schema and the BP2 manifest stay shared.
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { cwdWithinProjects } from '../../../shared/extension-scopes.mjs';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { isSelfMcpToolName, parseMcpToolName } from '../../../shared/tool-primitives.mjs';
+import { connectorToolDefault } from '../../../shared/connector-catalog.mjs';
+import { serverConnector } from './server-connectors.mjs';
+
+export const CONNECTOR_PERMISSIONS = Object.freeze(['auto', 'needs_approval', 'disabled']);
+export const PROJECT_CONNECTORS_FILE = 'project-connectors.json';
+
+/** What an unreadable or malformed policy means: no connector is on. */
+export const DENY_ALL_CONNECTORS = Object.freeze({
+  allow: Object.freeze([]),
+  off: Object.freeze([]),
+  tools: Object.freeze({}),
+});
+
+const AGENT_DIR_ID = /^[a-z0-9][a-z0-9._-]*$/i;
+const POLICY_KEYS = new Set(['off', 'tools']);
+
+const isPlainObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+const clean = (value) => (typeof value === 'string' ? value.trim() : '');
+const uniqueIds = (list) => [...new Set((Array.isArray(list) ? list : []).map(clean).filter(Boolean))].sort();
+
+function toolOverrides(value) {
+  const out = {};
+  for (const [server, tools] of Object.entries(isPlainObject(value) ? value : {})) {
+    const own = {};
+    for (const [tool, permission] of Object.entries(isPlainObject(tools) ? tools : {})) {
+      if (clean(tool) && CONNECTOR_PERMISSIONS.includes(permission)) own[clean(tool)] = permission;
+    }
+    if (clean(server) && Object.keys(own).length) out[clean(server)] = own;
+  }
+  return out;
+}
+
+/** A stored `connectors` field → `{ off, tools }`, or `{ allow, off, tools }`
+ *  for a legacy list; null when absent. Throws on any other shape. */
+export function parseConnectorPolicy(value) {
+  if (value == null) return null;
+  if (Array.isArray(value)) {
+    const allow = [];
+    const tools = {};
+    for (const item of value) {
+      const id = clean(item?.id);
+      if (!id) continue;
+      if (item.enabled === true) allow.push(id);
+      const own = toolOverrides({ [id]: item.tools })[id];
+      if (own) tools[id] = { ...tools[id], ...own };
+    }
+    return { allow: uniqueIds(allow), off: [], tools };
+  }
+  if (!isPlainObject(value) || Object.keys(value).some((key) => !POLICY_KEYS.has(key))) {
+    throw new Error('connectors must be { off: [connector id…], tools? }');
+  }
+  if (value.off != null && !Array.isArray(value.off)) throw new Error('connectors.off must be a list');
+  if (value.tools != null && !isPlainObject(value.tools)) throw new Error('connectors.tools must be an object');
+  return { off: uniqueIds(value.off), tools: toolOverrides(value.tools) };
+}
+
+/** The form a deny-list policy is saved in; null when it switches nothing off
+ *  (the same as no policy). A legacy list must be migrated first. */
+export function storedConnectorPolicy(policy) {
+  if (!policy) return null;
+  if (policy.allow) throw new Error('a legacy connector list must be migrated before it is saved');
+  const off = uniqueIds(policy.off);
+  const tools = toolOverrides(policy.tools);
+  if (!off.length && !Object.keys(tools).length) return null;
+  return { off, ...(Object.keys(tools).length ? { tools } : {}) };
+}
+
+/** A legacy list (or an unreadable policy) as the equivalent deny list over
+ *  the installed connectors `installedIds`: each one it did not enable is off.
+ *  A deny-list policy (or none) passes through. */
+export function migrateLegacyConnectorPolicy(policy, installedIds) {
+  if (!policy?.allow) return policy;
+  const allow = new Set(policy.allow);
+  const missing = uniqueIds(installedIds).filter((id) => !allow.has(id));
+  return { off: uniqueIds([...policy.off, ...missing]), tools: toolOverrides(policy.tools) };
+}
+
+/** Whether connector `serverId` is on under `policy` (null: every one is). */
+export function connectorEnabled(policy, serverId) {
+  if (!policy) return true;
+  if (policy.allow && !policy.allow.includes(serverId)) return false;
+  return !policy.off.includes(serverId);
+}
+
+// Policy files are stat-checked on every read (tiny files), so a save from
+// any process applies to the next dispatch without an explicit flush.
+const fileCache = new Map();
+
+function cachedRead(path, read) {
+  let stat;
+  try {
+    stat = statSync(path);
+  } catch (error) {
+    // No file is the "no policy" state; any other fault means it cannot be read.
+    return error?.code === 'ENOENT' || error?.code === 'ENOTDIR' ? null : unreadable(path, error);
+  }
+  const cached = fileCache.get(path);
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return cached.value;
+  const value = read(path);
+  fileCache.set(path, { mtimeMs: stat.mtimeMs, size: stat.size, value });
+  return value;
+}
+
+function readJson(path, parse) {
+  let text;
+  try {
+    text = readFileSync(path, 'utf8');
+  } catch (error) {
+    return error?.code === 'ENOENT' || error?.code === 'ENOTDIR' ? null : unreadable(path, error);
+  }
+  try {
+    return parse(JSON.parse(text));
+  } catch (error) {
+    return unreadable(path, error);
+  }
+}
+
+// A policy that exists but cannot be trusted mounts nothing.
+function unreadable(path, error) {
+  process.stderr.write(`[connectors] ${path} is unreadable (${error?.message || error}); denying all connectors\n`);
+  return DENY_ALL_CONNECTORS;
+}
+
+/** Uncached: the policy in the agent.json at `path` (see parseConnectorPolicy);
+ *  null without a file or field, DENY_ALL_CONNECTORS when it cannot be
+ *  trusted. The agent editor reads the policy through this too. */
+export function readConnectorsFile(path) {
+  return readJson(path, (manifest) => parseConnectorPolicy(manifest?.connectors));
+}
+
+/** The agent's saved policy under `dataDir`, or null when it has none. */
+export function agentConnectors(agentId, dataDir = resolvePluginData()) {
+  const id = clean(agentId);
+  if (!id || !AGENT_DIR_ID.test(id)) return null;
+  return cachedRead(join(dataDir, 'agents', id, 'agent.json'), readConnectorsFile);
+}
+
+/** Uncached: the project policy file → `[{ root, off }]`, null without one,
+ *  DENY_ALL_CONNECTORS when it cannot be trusted. */
+export function readProjectConnectorsFile(path) {
+  return readJson(path, (raw) => {
+    if (!isPlainObject(raw) || (raw.projects != null && !isPlainObject(raw.projects))) {
+      throw new Error('projects must be an object');
+    }
+    return Object.entries(raw.projects || {}).flatMap(([root, entry]) => {
+      if (!isPlainObject(entry) || (entry.off != null && !Array.isArray(entry.off))) {
+        throw new Error(`project "${root}" must be { off: [connector id…] }`);
+      }
+      const off = uniqueIds(entry.off);
+      return clean(root) && off.length ? [{ root: clean(root), off }] : [];
+    });
+  });
+}
+
+export function projectConnectorPolicies(dataDir = resolvePluginData()) {
+  return cachedRead(join(dataDir, PROJECT_CONNECTORS_FILE), readProjectConnectorsFile);
+}
+
+/** 'auto' | 'needs_approval' | 'disabled' for an MCP tool (definition or name)
+ *  under an agent's policy. Non-MCP tools and Mixdog's own self server are
+ *  not connectors: always 'auto'. */
+export function connectorToolPermission(policy, toolOrName) {
+  const mcp = parseMcpToolName(toolOrName);
+  if (!mcp || isSelfMcpToolName(toolOrName)) return 'auto';
+  if (policy && !connectorEnabled(policy, mcp.server)) return 'disabled';
+  // An explicit per-tool entry decides; otherwise a catalog connector's
+  // high-risk tools ask (connectorToolDefault) and any other tool is auto.
+  return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
+}
+
+/** The permission `agentId` has for the MCP tool `toolOrName`. */
+export function agentMcpToolPermission(agentId, toolOrName) {
+  if (!parseMcpToolName(toolOrName)) return 'auto';
+  return connectorToolPermission(agentConnectors(agentId), toolOrName);
+}
+
+/** Where a session runs: its registered Project (a worktree Lead's too), and
+ *  its cwd (a delegated worker inside the project). */
+function sessionProjectPaths(session) {
+  return [session?.desktopSession?.projectPath, session?.workspace?.projectPath, session?.cwd]
+    .map(clean)
+    .filter(Boolean);
+}
+
+/** True when the project `session` runs in switched the tool's connector off
+ *  (or its policy file cannot be read). */
+export function projectMcpToolDisabled(session, toolOrName, dataDir = resolvePluginData()) {
+  const mcp = parseMcpToolName(toolOrName);
+  if (!mcp || isSelfMcpToolName(toolOrName)) return false;
+  const paths = sessionProjectPaths(session);
+  if (!paths.length) return false;
+  const policies = projectConnectorPolicies(dataDir);
+  if (!policies) return false;
+  if (policies === DENY_ALL_CONNECTORS) return true;
+  return policies.some(
+    ({ root, off }) => off.includes(mcp.server) && paths.some((path) => cwdWithinProjects(path, [root]))
+  );
+}