mixdog 1.2.5 → 1.3.0

package/src/runtime/shared/config.mjs

@@ -328,7 +328,14 @@ function readAll() {
   // marker yet) is a recovery case too; without a verifiable backup reads stay
   // empty and RMW writes refuse (see readAllForRmW).
   if (isUserDataRecoveryExpected(resolvePluginData())) {
-    const restored = loadLatestMixdogConfigFromBackup(resolvePluginData());
+    let restored = null;
+    try {
+      restored = loadLatestMixdogConfigFromBackup(resolvePluginData());
+    } catch (err) {
+      // A transient backup read failure: this read stays empty and the next
+      // one retries (an RMW write refuses instead).
+      process.stderr.write(`[config] backup restore lookup failed: ${err.message}\n`);
+    }
     if (restored && isPlainObject(restored)) {
       const config = canonicalizeUnifiedConfig(restored);
       persistRestoredConfig(config);
@@ -608,7 +615,6 @@ export function updateSectionAsync(section, updater) {
 export const SECRET_ACCOUNTS = Object.freeze({
   agentApiKey: (provider) => `agent.${provider}.apiKey`,
   openaiUsageSessionKey: 'agent.openai.usageSessionKey',
-  opencodeGoConsoleKey: 'agent.opencode-go.consoleKey',
 });
 
 // ── Secret-aware getters ─────────────────────────────────────────────────────
@@ -639,15 +645,6 @@ export function getOpenAIUsageSessionKey() {
   );
 }
 
-export function getOpenCodeGoConsoleKey() {
-  return (
-    process.env.OPENCODE_CONSOLE_API_KEY ||
-    process.env.OPENCODE_GO_CONSOLE_API_KEY ||
-    process.env.MIXDOG_OPENCODE_CONSOLE_API_KEY ||
-    _readSecret(SECRET_ACCOUNTS.opencodeGoConsoleKey)
-  );
-}
-
 /**
  * Persist a secret to the OS keychain. Throws on failure.
  * Never writes to mixdog-config.json.

package/src/runtime/shared/connector-accounts.mjs

@@ -0,0 +1,15 @@
+// What a multi-account connector server tells the model about itself (MCP
+// `instructions`): the account it acts for, and to ask which one when the
+// user did not say and several are connected. The deferred-tool manifest
+// (context/deferred-tools.mjs) reads the leading "Account: <address>" back.
+
+/** The MCP instructions of a `service` server acting for `account` ('' when unknown). */
+export function accountInstructions(service, account) {
+  if (!account) return undefined;
+  return `Account: ${account}. This server acts only for this ${service} account; other ${service} accounts are separate servers. If several are connected and the user did not name one, ask which account before acting.`;
+}
+
+/** The account a server's instructions name, or ''. */
+export function accountOfInstructions(instructions) {
+  return /^Account: (\S+?)\. /.exec(String(instructions || ''))?.[1] || '';
+}

package/src/runtime/shared/connector-catalog.d.mts

@@ -0,0 +1,52 @@
+export type ConnectorBackend =
+  | {
+      kind: 'oauth';
+      url: string;
+      /** A pre-registered client the runtime supplies instead of registration. */
+      oauthClient?: 'google';
+      scopes?: readonly string[];
+      askTools?: readonly string[];
+    }
+  | {
+      kind: 'apiKey';
+      url?: string;
+      header?: string;
+      prefix?: string;
+      command?: string;
+      args?: readonly string[];
+      env?: string;
+      keyUrl: string;
+      placeholder?: string;
+      /** Tools that ask before they run unless the agent set them. */
+      askTools?: readonly string[];
+    }
+  | { kind: 'builtin'; feature: string };
+
+export interface ConnectorCatalogEntry {
+  id: string;
+  name: string;
+  backend: ConnectorBackend;
+  /** Offered only after the user enters their own Google OAuth client. */
+  ownKey?: boolean;
+  /** Curated deferred-tool manifest line (connector-triggers.mjs). */
+  trigger: string;
+}
+
+export const CONNECTOR_CATALOG: readonly ConnectorCatalogEntry[];
+export const GOOGLE_SCOPES: Readonly<Record<'gmail' | 'calendar' | 'drive', readonly string[]>>;
+export const CONNECTOR_IDS: readonly string[];
+export function connectorById(id: unknown): ConnectorCatalogEntry | null;
+export function connectorOfServer(cfg: unknown): string;
+export function connectorToolDefault(connectorId: string, tool: string): 'auto' | 'needs_approval';
+export function connectorServerInput(
+  entry: ConnectorCatalogEntry,
+  name: string,
+  key?: string,
+  options?: { extraAccount?: boolean }
+): Record<string, unknown>;
+export function connectorMultiAccount(entry: ConnectorCatalogEntry | null | undefined): boolean;
+export const GMAIL_APP_PASSWORD: Readonly<{ url: string; accountHeader: string; helpUrl: string }>;
+export function gmailAddress(value: unknown): string;
+export function gmailAppPasswordValue(value: unknown): string;
+export function gmailAppPasswordAccount(cfg: unknown): string;
+export function gmailAppPasswordServerInput(name: string, email: string, password: string): Record<string, unknown>;

package/src/runtime/shared/connector-catalog.mjs

@@ -0,0 +1,230 @@
+// The built-in connector catalog: services a user connects with one click
+// from Desktop (Extensions → 커넥터) or from a chat card the setup tool's
+// `connect_connector` action surfaces. Each entry declares its backend
+// explicitly:
+//   oauth   — a remote MCP server that signs in with MCP OAuth;
+//   apiKey  — an MCP server that takes one key (an HTTP header or a stdio
+//             environment variable);
+//   builtin — a Mixdog built-in feature (GitHub is the GitHub CLI of the
+//             Git & GitHub built-in, never a GitHub MCP);
+// A connected catalog service is an ordinary user MCP server whose config
+// carries `connector: <id>`. An existing custom server is never adopted into
+// the catalog row.
+
+import { connectorTrigger } from './connector-triggers.mjs';
+
+// `oauthClient` names a pre-registered client the runtime supplies
+// (mcp/oauth-client.mjs: 'google') in place of dynamic client registration;
+// `scopes` are then the ones requested.
+const oauth = (url, client = {}) => Object.freeze({ kind: 'oauth', url, ...client });
+
+const GOOGLE_SCOPE = 'https://www.googleapis.com/auth';
+// The Google access each built-in connector asks for: the one place to widen
+// it (e.g. gmail.readonly). openid + email name the signed-in account.
+export const GOOGLE_SCOPES = Object.freeze({
+  gmail: Object.freeze(['openid', 'email', `${GOOGLE_SCOPE}/gmail.send`]),
+  calendar: Object.freeze(['openid', 'email', `${GOOGLE_SCOPE}/calendar.events`]),
+  drive: Object.freeze(['openid', 'email', `${GOOGLE_SCOPE}/drive.file`]),
+});
+// Gmail / Calendar / Drive are Mixdog's built-in Google connectors
+// (runtime/connectors/google-mcp.mjs), answered in-process at a reserved
+// address and signed in with Mixdog's Google client. `askTools` ask before
+// they run unless the agent set them.
+const google = (service, scopes, askTools) =>
+  oauth(`https://${service}.mixdog.invalid/mcp`, { oauthClient: 'google', scopes, askTools });
+// Gmail can also connect with a Google app password instead of the sign-in:
+// IMAP and SMTP over TLS (runtime/connectors/gmail-app-password.mjs), answered
+// in-process at its own reserved address. Its server is still the Gmail
+// connector (`connector: 'gmail'`, so Gmail's askTools apply to its tools of
+// the same names); the account rides in a header, the app password lives only
+// in the keychain.
+export const GMAIL_APP_PASSWORD = Object.freeze({
+  url: 'https://gmail-imap.mixdog.invalid/mcp',
+  accountHeader: 'X-Mixdog-Gmail-Account',
+  helpUrl: 'https://myaccount.google.com/apppasswords',
+});
+const apiKey = (spec) => Object.freeze({ kind: 'apiKey', ...spec });
+
+export const CONNECTOR_CATALOG = Object.freeze(
+  [
+    { id: 'airtable', name: 'Airtable', backend: oauth('https://mcp.airtable.com/mcp') },
+    { id: 'confluence', name: 'Confluence', backend: oauth('https://mcp.atlassian.com/v1/mcp/authv2') },
+    { id: 'dropbox', name: 'Dropbox', backend: oauth('https://mcp.dropbox.com/mcp') },
+    { id: 'github', name: 'GitHub', backend: Object.freeze({ kind: 'builtin', feature: 'git' }) },
+    {
+      id: 'gmail',
+      name: 'Gmail',
+      backend: google('gmail', GOOGLE_SCOPES.gmail, ['send_email']),
+    },
+    // Calendar and Drive are offered only to a user who entered their own
+    // Google OAuth client (Connectors → add custom → 내 Google 키): `ownKey`.
+    // Existing connections keep working; Mixy and the chat cards never offer them.
+    {
+      id: 'google-calendar',
+      name: 'Google Calendar',
+      ownKey: true,
+      backend: google('calendar', GOOGLE_SCOPES.calendar, ['delete_event']),
+    },
+    {
+      id: 'google-drive',
+      name: 'Google Drive',
+      ownKey: true,
+      backend: google('drive', GOOGLE_SCOPES.drive, []),
+    },
+    {
+      id: 'hugging-face',
+      name: 'Hugging Face',
+      backend: apiKey({
+        url: 'https://huggingface.co/mcp',
+        header: 'Authorization',
+        prefix: 'Bearer ',
+        keyUrl: 'https://huggingface.co/settings/tokens',
+      }),
+    },
+    { id: 'jira', name: 'Jira', backend: oauth('https://mcp.atlassian.com/v1/mcp/authv2') },
+    { id: 'linear', name: 'Linear', backend: oauth('https://mcp.linear.app/mcp') },
+    { id: 'notion', name: 'Notion', backend: oauth('https://mcp.notion.com/mcp') },
+    {
+      id: 'postgres',
+      name: 'Postgres',
+      backend: apiKey({
+        command: 'npx',
+        args: ['-y', '@microsoft/postgres-mcp@0.2.0', 'run'],
+        env: 'POSTGRES_MCP_CONNECTION_STRING',
+        keyUrl: 'https://github.com/microsoft/postgres-mcp/blob/main/USAGE.md',
+        placeholder: 'postgresql://user:password@host:5432/db',
+      }),
+    },
+    { id: 'sentry', name: 'Sentry', backend: oauth('https://mcp.sentry.dev/mcp') },
+    {
+      id: 'stripe',
+      name: 'Stripe',
+      backend: apiKey({
+        url: 'https://mcp.stripe.com',
+        header: 'Authorization',
+        prefix: 'Bearer ',
+        keyUrl: 'https://dashboard.stripe.com/apikeys',
+        placeholder: 'rk_live_…',
+      }),
+    },
+    { id: 'supabase', name: 'Supabase', backend: oauth('https://mcp.supabase.com/mcp') },
+    { id: 'trello', name: 'Trello', backend: oauth('https://mcp.trello.com/v1') },
+    { id: 'vercel', name: 'Vercel', backend: oauth('https://mcp.vercel.com') },
+    // The ids are the deferred-tool manifest's curated keys: a server named by
+    // its id gets that one-line trigger (connector-triggers.mjs).
+  ].map((entry) => Object.freeze({ ...entry, trigger: connectorTrigger(entry.id) }))
+);
+
+/** The ids offered to everyone (the setup tool's `connect_connector`): the
+ *  catalog minus the own-key-only Google services. */
+export const CONNECTOR_IDS = Object.freeze(CONNECTOR_CATALOG.filter((entry) => !entry.ownKey).map((entry) => entry.id));
+
+/** The catalog entry for `id`, or null. */
+export function connectorById(id) {
+  return CONNECTOR_CATALOG.find((entry) => entry.id === id) || null;
+}
+
+const urlKey = (url) =>
+  String(url || '')
+    .trim()
+    .replace(/\/+$/, '')
+    .toLowerCase();
+
+/** The catalog id a configured MCP server connects: its `connector` marker,
+ *  '' for none (or a marker the catalog no longer knows). */
+export function connectorOfServer(cfg) {
+  const marker = typeof cfg?.connector === 'string' ? cfg.connector : '';
+  return connectorById(marker) ? marker : '';
+}
+
+/** The permission a catalog connector's tool has when nothing set its own:
+ *  `needs_approval` for the high-risk tools it names, else `auto`. */
+export function connectorToolDefault(connectorId, tool) {
+  const backend = connectorById(connectorId)?.backend;
+  return backend?.askTools?.includes(tool) ? 'needs_approval' : 'auto';
+}
+
+const EMAIL = /^[^\s@<>(),;:"]+@[^\s@<>(),;:"]+\.[^\s@<>(),;:".]+$/;
+
+/** A Gmail address as typed (trimmed, lowercased), or '' when it is none. */
+export function gmailAddress(value) {
+  const address = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  return EMAIL.test(address) ? address : '';
+}
+
+/** A Google app password as typed, its spaces removed; '' unless it then
+ *  has the 16 characters Google issues. */
+export function gmailAppPasswordValue(value) {
+  const password = String(value ?? '').replace(/\s+/g, '');
+  return password.length === 16 ? password : '';
+}
+
+/** The account of a Gmail app-password server config, '' for any other. */
+export function gmailAppPasswordAccount(cfg) {
+  if (urlKey(cfg?.url) !== urlKey(GMAIL_APP_PASSWORD.url)) return '';
+  const headers = cfg?.headers && typeof cfg.headers === 'object' ? cfg.headers : {};
+  const header = GMAIL_APP_PASSWORD.accountHeader.toLowerCase();
+  const key = Object.keys(headers).find((name) => name.toLowerCase() === header);
+  return key ? gmailAddress(headers[key]) : '';
+}
+
+/** The MCP server input that connects Gmail under `name` as `email` with an
+ *  app password. `appPassword` only travels to the host, which checks it
+ *  with Gmail and keeps it in the keychain; it never reaches the config. */
+export function gmailAppPasswordServerInput(name, email, password) {
+  const address = gmailAddress(email);
+  if (!address) throw new Error('GMAIL_APP_PASSWORD_ADDRESS: Enter a Gmail address.');
+  const appPassword = gmailAppPasswordValue(password);
+  if (!appPassword) throw new Error('GMAIL_APP_PASSWORD_FORMAT: An app password has 16 characters.');
+  return {
+    name,
+    type: 'http',
+    url: GMAIL_APP_PASSWORD.url,
+    headers: { [GMAIL_APP_PASSWORD.accountHeader]: address },
+    connector: 'gmail',
+    appPassword,
+  };
+}
+
+/** Whether several accounts of catalog connector `entry` can be connected at
+ *  once: Gmail (also by app password), Calendar and Drive with the Google
+ *  sign-in. Other remote servers keep one (their tokens and URL are shared). */
+export function connectorMultiAccount(entry) {
+  return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
+}
+
+/** The MCP server input that connects catalog entry `entry` under `name`
+ *  (oauth / apiKey); `key` fills an apiKey backend; `extraAccount`
+ *  makes it one more account of a multi-account connector. */
+export function connectorServerInput(entry, name, key = '', { extraAccount = false } = {}) {
+  const { backend } = entry;
+  if (backend.kind === 'oauth') {
+    // Tokens are stored per exact server URL, so another account of the same
+    // connector needs its own URL; the in-process Google servers ignore the query.
+    const url =
+      extraAccount && connectorMultiAccount(entry) ? `${backend.url}?account=${encodeURIComponent(name)}` : backend.url;
+    return { name, type: 'http', url, connector: entry.id };
+  }
+  if (backend.kind !== 'apiKey') throw new Error(`${entry.name} is not an MCP connector`);
+  const value = String(key || '').trim();
+  if (!value) throw new Error(`${entry.name} needs a key`);
+  if (backend.url) {
+    return {
+      name,
+      type: 'http',
+      url: backend.url,
+      headers: { [backend.header]: `${backend.prefix || ''}${value}` },
+      connector: entry.id,
+    };
+  }
+  return {
+    name,
+    type: 'stdio',
+    command: backend.command,
+    args: [...backend.args],
+    env: { [backend.env]: value },
+    connector: entry.id,
+  };
+}

package/src/runtime/shared/connector-triggers.d.mts

@@ -0,0 +1,3 @@
+export declare const CONNECTOR_TRIGGER_MAX_CHARS: number;
+export declare const CONNECTOR_TRIGGERS: Readonly<Record<string, string>>;
+export declare function connectorTrigger(serverId: string): string;

package/src/runtime/shared/connector-triggers.mjs

@@ -0,0 +1,43 @@
+// Curated selection triggers for catalog connectors (MCP servers). A catalog
+// entry carries its line as `trigger`; the deferred-tool manifest lists each
+// connected server once as `- mcp__<server id>: <trigger>`, so one line must
+// say what the connector is for (plus a close negative where useful), in
+// English, at most CONNECTOR_TRIGGER_MAX_CHARS characters.
+export const CONNECTOR_TRIGGER_MAX_CHARS = 100;
+
+export const CONNECTOR_TRIGGERS = Object.freeze({
+  github: 'GitHub repos, issues, pull requests, Actions and code search; not local Git history or diffs.',
+  notion: 'Notion pages, databases and workspace search; create or update team docs and notes.',
+  linear: 'Linear issues, projects, cycles and comments; create, triage or update tickets.',
+  sentry: 'Sentry issues, events, stack traces and releases; triage production errors.',
+  gmail: 'Gmail: send email; with an app password also search, read, archive, label, star, trash.',
+  'google-calendar': 'Google Calendar events on the primary calendar; list, search, create, update or delete.',
+  'google-drive': 'Google Drive files Mixdog created or was given; search, read or create; not local files.',
+  jira: 'Jira issues, projects, sprints and comments; JQL search, create or transition tickets.',
+  confluence: 'Confluence spaces and pages; search, read or edit the team wiki; not Jira tickets.',
+  dropbox: 'Dropbox files and folders; search, read, upload or share cloud files; not local files.',
+  trello: 'Trello boards, lists and cards; create, move or update cards.',
+  airtable: 'Airtable bases, tables and records; query, create or update rows.',
+  stripe: 'Stripe customers, payments, invoices, subscriptions and refunds; billing data and actions.',
+  vercel: 'Vercel projects, deployments, domains and logs; deploy status and build errors.',
+  supabase: 'Supabase projects: Postgres tables and SQL, auth, storage and edge functions.',
+  postgres: 'PostgreSQL schemas, tables and SQL queries on a connected database; not local files.',
+  'hugging-face': 'Hugging Face Hub models, datasets, Spaces and papers; not local GGUF model setup.',
+});
+
+// Server ids differ only in separators and case (google_calendar, huggingface).
+const triggerKey = (id) =>
+  String(id || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, '');
+const TRIGGERS_BY_KEY = new Map(Object.entries(CONNECTOR_TRIGGERS).map(([id, line]) => [triggerKey(id), line]));
+
+/** The curated trigger of the catalog connector `serverId`, or ''. */
+export function connectorTrigger(serverId) {
+  // Another account of a connector is named `<id>-2`, `<id>-3`…
+  return (
+    TRIGGERS_BY_KEY.get(triggerKey(serverId)) ||
+    TRIGGERS_BY_KEY.get(triggerKey(String(serverId || '').replace(/[-_]\d+$/, ''))) ||
+    ''
+  );
+}

package/src/runtime/shared/file-lock.mjs

@@ -24,7 +24,13 @@ import { createKeyedSerialQueue } from './keyed-serial-queue.mjs';
 import { sleep, sleepSync } from './sleep.mjs';
 
 const LOCK_WAIT_CODES = new Set(['EEXIST', 'EPERM', 'EACCES', 'EBUSY']);
-export const DEFAULT_BACKOFFS_MS = Object.freeze([25, 50, 100, 200, 400, 800, 1200, 1600]);
+// Cross-process waits must poll (in-process waiters already queue on
+// lockQueue and wake on release). Each sleep is capped at 200 ms: longer
+// sleeps overshoot a release by up to their full length, and the synchronous
+// paths block the event loop for each sleep. The schedule keeps the earlier
+// ~4.2 s total window for rename retries (Windows AV/indexer file holds).
+const RETRY_MAX_MS = 200;
+export const DEFAULT_BACKOFFS_MS = Object.freeze([25, 50, 100, ...Array(20).fill(RETRY_MAX_MS)]);
 const configuredLockTimeoutMs = Number(process.env.MIXDOG_LOCK_TIMEOUT_MS);
 const DEFAULT_LOCK_TIMEOUT_MS =
   Number.isFinite(configuredLockTimeoutMs) && configuredLockTimeoutMs >= 0 ? configuredLockTimeoutMs : 2000;

package/src/runtime/shared/file-permissions-worker.mjs

@@ -0,0 +1,38 @@
+// Worker side of file-permissions.mjs's sync bridge: owner-only enforcement
+// for synchronous callers, through this thread's own long-lived ACL helper.
+// Every request is answered on the port, then the shared counter (slot 0) is
+// bumped and notified so the blocked caller wakes; slot 1 marks this thread
+// gone, slot 2 marks it ready.
+import { workerData } from 'node:worker_threads';
+import { enforceOwnerOnlyAclWin32Async, prewarmOwnerOnlyAclWin32 } from './file-permissions.mjs';
+
+const { port, signal } = workerData;
+
+function wake() {
+  Atomics.add(signal, 0, 1);
+  Atomics.notify(signal, 0);
+}
+
+process.on('exit', () => {
+  Atomics.store(signal, 1, 1);
+  wake();
+});
+
+port.on('message', async (request) => {
+  if (request?.warm === true) {
+    await prewarmOwnerOnlyAclWin32({ bridge: false });
+    return;
+  }
+  let reply;
+  try {
+    await enforceOwnerOnlyAclWin32Async(request.path, { fresh: true });
+    reply = { id: request.id, ok: true };
+  } catch (error) {
+    reply = { id: request.id, ok: false, message: String(error?.message || error), code: error?.code ?? null };
+  }
+  port.postMessage(reply);
+  wake();
+});
+
+Atomics.store(signal, 2, 1);
+wake();

package/src/runtime/shared/file-permissions.d.mts

@@ -1,8 +1,23 @@
 export function enforceOwnerOnlyAclWin32(targetPath: string, options?: { fresh?: boolean }): void;
 
-export function enforceOwnerOnlyAclWin32Async(
-  targetPath: string,
-  options?: { fresh?: boolean }
-): Promise<void>;
+/** Test hook: the live per-process ACL helper, or null. */
+export function ownerOnlyAclHelperForTests(): import('node:child_process').ChildProcess | null;
+
+/** Test/diagnostic hook: helper attachment, pending requests, starts in the restart window. */
+export function ownerOnlyAclHelperStats(): {
+  alive: boolean;
+  pid: number | null;
+  pending: number;
+  recentStarts: number;
+};
+
+/** Non-fresh calls verify (and tighten) the real DACL on every call through a shared helper. */
+export function enforceOwnerOnlyAclWin32Async(targetPath: string, options?: { fresh?: boolean }): Promise<void>;
 
 export function enforceOwnerOnlyDirectoryWin32Async(targetPath: string): Promise<void>;
+
+/** Test hook: synchronous calls skip the sync bridge and use the one-shot update. */
+export function disableOwnerOnlyAclSyncBridgeForTests(): void;
+
+/** Starts this thread's ACL helper and the sync bridge off any write path. Never rejects. */
+export function prewarmOwnerOnlyAclWin32(options?: { bridge?: boolean }): Promise<void>;