mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -9,15 +9,17 @@
 // tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
 // POSIX). No external dependencies.
 import { spawn } from 'node:child_process';
+import { runProcessOffThread } from '../../../shared/process-runner.mjs';
 import { detachedSpawnOpts } from '../../../shared/spawn-flags.mjs';
 
 const isWin = process.platform === 'win32';
 
+// The SIGTERM → SIGKILL escalation wait. Kept ref'd: it runs right after the
+// tree was signalled, when the dying children may be the only handles left,
+// and an unref'd timer would then never fire, leaving the awaited kill (and
+// every close awaiting it) pending forever. It is short and bounded.
 function delay(ms) {
-  return new Promise((resolve) => {
-    const t = setTimeout(resolve, ms);
-    if (t.unref) t.unref();
-  });
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 // Best-effort signal: a pid that already exited (or cannot be signalled) is skipped.
@@ -44,54 +46,26 @@ function transportPid(transport) {
  *  settled, so enumerators never pile up whatever this value is. */
 export const ENUMERATION_DEADLINE_MS = 20_000;
 
-// Spawn a helper command and resolve its stdout (empty string on any error).
-// `timeoutMs` > 0: past the deadline the helper is killed (Node reaps it on
-// exit) and the call settles at once instead of waiting for it.
-function run(cmd, args, { strict = false, timeoutMs = 0 } = {}) {
-  return new Promise((resolve, reject) => {
-    let out = '';
-    let cp;
-    let timer = null;
-    let settled = false;
-    const settle = (finish) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      finish();
-    };
-    try {
-      cp = spawn(cmd, args, { windowsHide: true });
-    } catch (error) {
-      if (strict) {
-        reject(error);
-        return;
-      }
-      resolve('');
-      return;
-    }
-    cp.stdout?.on('data', (d) => {
-      out += String(d);
-    });
-    cp.on('error', (error) => settle(() => (strict ? reject(error) : resolve(out))));
-    cp.on('close', (code) =>
-      settle(() => (strict && code !== 0 ? reject(new Error(`Process enumeration failed (${code}).`)) : resolve(out)))
-    );
-    if (timeoutMs > 0) {
-      timer = setTimeout(() => {
-        try {
-          cp.kill('SIGKILL');
-        } catch {
-          /* already gone */
-        }
-        cp.stdout?.destroy?.();
-        cp.stderr?.destroy?.();
-        settle(() =>
-          strict ? reject(new Error(`Process enumeration timed out after ${timeoutMs} ms.`)) : resolve('')
-        );
-      }, timeoutMs);
-      timer.unref?.();
+// Output bound of one helper command: a process table is tens of KB.
+const HELPER_MAX_BYTES = 64 * 1024 * 1024;
+
+// Run a helper command off the event loop (process-runner.mjs: under load one
+// PowerShell start blocked the daemon's loop for seconds) and resolve its
+// stdout. Past `timeoutMs` (default ENUMERATION_DEADLINE_MS) the helper is
+// killed and the call settles. Strict: a failed, non-zero or timed-out run
+// rejects; otherwise it resolves '' (non-zero exits keep their stdout).
+function run(cmd, args, { strict = false, timeoutMs = ENUMERATION_DEADLINE_MS } = {}) {
+  return runProcessOffThread(cmd, args, { timeoutMs, maxBytes: HELPER_MAX_BYTES }).then(
+    ({ code, stdout }) => {
+      if (strict && code !== 0) throw new Error(`Process enumeration failed (${code}).`);
+      return stdout;
+    },
+    (error) => {
+      if (!strict) return '';
+      if (error?.code === 'ETIMEDOUT') throw new Error(`Process enumeration timed out after ${timeoutMs} ms.`);
+      throw error;
     }
-  });
+  );
 }
 
 // Snapshot the whole process table once: parent map + a per-pid identity
@@ -114,21 +88,25 @@ async function enumerate({ strict = false } = {}) {
         ],
         { strict, timeoutMs: ENUMERATION_DEADLINE_MS }
       )
-    : await run('ps', ['-A', '-o', 'pid=,ppid=,pgid=,comm=,lstart='], {
+    : await run('ps', ['-A', '-o', 'pid=,ppid=,pgid=,stat=,comm=,lstart='], {
         strict,
         timeoutMs: ENUMERATION_DEADLINE_MS,
       });
-  const row = isWin ? /^(\d+)\s+(\d+)\s+()(\S+)(?:\s+(.+))?$/ : /^(\d+)\s+(\d+)\s+(\d+)\s+(\S+)(?:\s+(.+))?$/;
+  const row = isWin ? /^(\d+)\s+(\d+)\s+()()(\S+)(?:\s+(.+))?$/ : /^(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\S+)(?:\s+(.+))?$/;
   for (const line of out.split(/\r?\n/)) {
     const m = line.trim().match(row);
     if (!m) continue;
+    // A zombie runs nothing and holds no port or file; it only waits to be
+    // reaped (forever under an init that does not reap, e.g. a container
+    // without one). Counting it alive would hold a dead tree as running.
+    if (m[4].startsWith('Z')) continue;
     const pid = Number(m[1]);
     const ppid = Number(m[2]);
-    const token = (m[5] || '').trim() || null;
+    const token = (m[6] || '').trim() || null;
     if (!childrenOf.has(ppid)) childrenOf.set(ppid, []);
     childrenOf.get(ppid).push(pid);
     tokenOf.set(pid, token);
-    nameOf.set(pid, m[4]);
+    nameOf.set(pid, m[5]);
     if (m[3]) pgidOf.set(pid, Number(m[3]));
   }
   if (strict && !nameOf.has(process.pid)) throw new Error('The process snapshot could not be verified.');
@@ -142,17 +120,33 @@ async function enumerate({ strict = false } = {}) {
  *  `shared: true` (pre-kill captures) joins a read already in flight, so many
  *  jobs promoted together do not each spawn an enumerator; a capture taken
  *  while its root runs is valid whenever that read began. An observation after
- *  a kill never shares: a read that began before the kill would report the
- *  killed tree alive and defer the confirmation by a whole re-check. */
+ *  a kill or exit must see a table taken AFTER it asked: a read that began
+ *  before the kill would report the killed tree alive and defer the
+ *  confirmation by a whole re-check. Such a caller starts a read when none
+ *  runs, else joins the one queued to begin when the running read settles —
+ *  every observer asking meanwhile shares it. At most one enumerator runs at
+ *  a time, however many shells settle or watch at once (each one is a
+ *  PowerShell process on Windows; one per settle and watch pass compounded
+ *  machine load into multi-second daemon stalls). */
 let tableInFlight = null;
+let nextTable = null;
+function startTableRead() {
+  const read = enumerate({ strict: true }).finally(() => {
+    if (tableInFlight === read) tableInFlight = null;
+  });
+  tableInFlight = read;
+  return read;
+}
 export function readProcessTable({ shared = false } = {}) {
-  if (!shared) return enumerate({ strict: true });
-  if (!tableInFlight) {
-    tableInFlight = enumerate({ strict: true }).finally(() => {
-      tableInFlight = null;
-    });
-  }
-  return tableInFlight;
+  if (shared && tableInFlight) return tableInFlight;
+  if (nextTable) return nextTable;
+  if (!tableInFlight) return startTableRead();
+  const settled = () => {};
+  nextTable = tableInFlight.then(settled, settled).then(() => {
+    nextTable = null;
+    return startTableRead();
+  });
+  return nextTable;
 }
 
 // Walk every descendant pid of rootPid (excludes rootPid).

package/src/runtime/agent/orchestrator/mcp/client-transport.mjs

@@ -5,6 +5,9 @@
  */
 import { readServicePort } from '../../../shared/service-discovery.mjs';
 import { createMcpOAuth } from './oauth.mjs';
+import { mcpOAuthClientFor } from './oauth-client.mjs';
+import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
+import { gmailAppPasswordService, withGmailAppPasswordMcp } from '../../../connectors/gmail-app-password.mjs';
 import {
   AUTO_DETECT_PORTS,
   expandEnvVars,
@@ -138,12 +141,18 @@ export function createMcpTransport({ name, cfg, sdk, log, strictEnv, oauthOption
       : createMcpOAuth({
           url,
           serverName: name,
+          oauthClient: mcpOAuthClientFor(cfg, url),
           ...oauthOptions,
+          // A built-in Google connector is answered in-process.
+          ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
           // SSE advertises its POST endpoint on the authenticated event stream.
           // No other path on the origin is allowed to receive this server's token.
           isTransportEndpoint: (input) => kind === 'sse' && transport?._endpoint?.href === new URL(input).href,
         });
-    transport = new Transport(new URL(url), oauth ? { fetch: oauth.fetch } : opts);
+    // Gmail with an app password is answered in-process too (its account
+    // header is the configured authentication; the password is in the keychain).
+    const local = !oauth && gmailAppPasswordService(url) ? { ...opts, fetch: withGmailAppPasswordMcp() } : opts;
+    transport = new Transport(new URL(url), oauth ? { fetch: oauth.fetch } : local);
     if (oauth) {
       transport.oauth = oauth;
       const close = transport.close.bind(transport);

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -14,7 +14,7 @@ import { basename, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { tmpdir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
-import { buildSmartReadTruncationMarker, smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
+import { smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
 import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
 import { makeToolEnvelope, normalizeToolEnvelope } from '../session/tool-envelope.mjs';
 import { classifyResultKind } from '../session/result-classification.mjs';
@@ -33,11 +33,17 @@ import {
 import { createLazyOutputValidator } from './lazy-output-validator.mjs';
 import { appendMcpStderrTail, createMcpTransport, hasConfiguredMcpAuth } from './client-transport.mjs';
 import { listAllMcpTools, MCP_CONNECT_CANCELLED, runBoundedHandshake } from './client-handshake.mjs';
+import { rememberServerConnector } from './server-connectors.mjs';
+import { mcpOAuthClientFor } from './oauth-client.mjs';
+import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
 import {
   clearMcpOAuth,
+  commitMcpOAuthSwitch,
   hasStoredMcpOAuthTokens,
   isMcpOAuthReauthenticationRequired,
   MCP_OAUTH_CALLBACK_NOT_PENDING,
+  startMcpOAuthSwitch,
+  storedMcpOAuthIdentity,
 } from './oauth.mjs';
 export { probeMcpServerAuth } from './oauth-probe.mjs';
 
@@ -67,6 +73,14 @@ const _connectAbortGenerations = new Map();
 const _pendingConnects = new Set();
 // scopeId -> root path advertised by that scope's scope-following servers.
 const _scopeRoots = new Map();
+// One stdio process per server config, shared by every scope that connects
+// the same server with the same resolved config: share key -> connection
+// { key, client, transport, liveness, stderrTail, warnings, tools,
+// capabilities, instructions, users: Set<registryKey> }. Every session
+// runtime has its own scope, so per-scope processes multiplied with the
+// number of retained sessions. A scope's close releases only its own use; the
+// process tree is shut down when its last user releases it.
+const _sharedStdio = new Map();
 let mcpSdkPromise = null;
 // Memo for mcpToolHasField(name, field) — keyed by `${scopeId}|${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
@@ -99,6 +113,24 @@ function scopedServerEntries(scopeId) {
   const normalized = normalizeMcpScopeId(scopeId);
   return [...servers.entries()].filter(([, server]) => server?.scopeId === normalized);
 }
+// Share key of a stdio server, or null when its connection must stay private
+// to one scope: remote transports, and servers whose advertised roots follow
+// their scope's cwd.
+function sharedStdioKey(name, cfg) {
+  if (cfg?._mixdogRootsFollowScope === true) return null;
+  try {
+    if (resolveMcpTransportKind(cfg) !== 'stdio') return null;
+  } catch {
+    return null;
+  }
+  return `${String(name || '')}\u0000${JSON.stringify(cfg)}`;
+}
+// A connection that failed a call is never handed to a later connect; scopes
+// still holding it keep it until they release it themselves.
+function retireSharedConnection(server) {
+  const shared = server?.shared;
+  if (shared && _sharedStdio.get(shared.key) === shared) _sharedStdio.delete(shared.key);
+}
 function currentConnectAbortGeneration(scopeId) {
   return _connectAbortGenerations.get(normalizeMcpScopeId(scopeId)) || 0;
 }
@@ -308,7 +340,11 @@ function callAdmissionFor(server) {
   const cfg = server?.cfg || {};
   gate = createOwnerFairGate({
     name: `MCP ${server.name}`,
-    activeMax: positiveInt(cfg.maxConcurrency ?? cfg.max_concurrency ?? process.env.MIXDOG_MCP_MAX_INFLIGHT, 8),
+    // JSON-RPC multiplexes requests by id over one transport, so the client
+    // imposes no in-flight cap of its own; a server that needs one declares
+    // it (maxConcurrency) or the operator sets MIXDOG_MCP_MAX_INFLIGHT.
+    activeMax:
+      positiveInt(cfg.maxConcurrency ?? cfg.max_concurrency ?? process.env.MIXDOG_MCP_MAX_INFLIGHT, null) ?? Infinity,
     queueMax: positiveInt(cfg.maxQueue ?? cfg.max_queue ?? process.env.MIXDOG_MCP_MAX_QUEUE, 256),
     minOwnerQueue: 8,
     waitTimeoutMs: positiveInt(
@@ -407,6 +443,7 @@ async function reconnectMcpServer(scopeId, serverName, failedServer) {
     if (!current || genAtStart !== currentConnectAbortGeneration(scopeId) || current.liveness?.closing) {
       throw new Error(`MCP server "${serverName}" was disconnected`);
     }
+    retireSharedConnection(current);
     await replaceServerConnection(scopeId, serverName, current, failedServer.cfg, genAtStart);
   });
   const replacement = servers.get(registryKey);
@@ -1037,7 +1074,7 @@ function capMcpOutputParts(content) {
   const s = typeof content === 'string' ? content : String(content ?? '');
   const bodyBytes = Buffer.byteLength(s, 'utf8');
   const bodyLines = countTextLines(s);
-  const { text, truncated } = smartReadTruncate(s, bodyLines, bodyBytes);
+  const { text, truncated, marker } = smartReadTruncate(s, bodyLines, bodyBytes);
   if (!truncated) return { text, spillNote: '', truncated: false };
   // Spill the full body to a tmp file so the caller can recover content
   // elided by the head/tail cap.
@@ -1056,7 +1093,6 @@ function capMcpOutputParts(content) {
     /* spill best-effort */
   }
   const spillNote = spillPath ? `\n\n... [full output spilled to ${spillPath}] ...` : '';
-  const marker = buildSmartReadTruncationMarker(bodyLines, bodyBytes);
   const split = text.indexOf(`\n${marker}\n`);
   return {
     text,
@@ -1220,22 +1256,52 @@ export function getMcpServerOAuthState(cfg) {
     return null;
   }
   if (!url || hasConfiguredMcpAuth(cfg)) return null;
-  return { signedIn: hasStoredMcpOAuthTokens(url) };
+  const signedIn = hasStoredMcpOAuthTokens(url);
+  if (!signedIn) return { signedIn };
+  // Who it is signed in as (never guessed: empty when the server named nobody)
+  // and whether 계정 바꾸기 can make the provider show its account choice.
+  const who = storedMcpOAuthIdentity(url);
+  return {
+    signedIn,
+    account: typeof who?.account === 'string' ? who.account : '',
+    workspace: typeof who?.workspace === 'string' ? who.workspace : '',
+    forcedAccountChoice: who?.forcedChoice === true,
+  };
+}
+/** 계정 바꾸기 of an HTTP/SSE server: a browser sign-in beside the stored one
+ *  (oauth.mjs startMcpOAuthSwitch); `launch` opens the authorization URL. */
+export function startMcpServerOAuthSwitch(cfg, launch, serverName) {
+  const url = resolveMcpOAuthUrl(cfg);
+  if (!url) throw new Error(`MCP server "${serverName}" does not use OAuth sign-in`);
+  return startMcpOAuthSwitch({
+    url,
+    launch,
+    serverName,
+    oauthClient: mcpOAuthClientFor(cfg, url),
+    ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp() } : {}),
+  });
+}
+/** Store a switch's sign-in for the server's URL; resolves its rollback. */
+export function commitMcpServerOAuthSwitch(cfg, signIn) {
+  return commitMcpOAuthSwitch({ url: resolveMcpOAuthUrl(cfg), signIn });
 }
 /**
  * Log out of an HTTP/SSE server URL: delete the OAuth tokens and client
  * registration stored for it, shared by every server configured with that
- * exact URL, and drop them from live connections.
+ * exact URL, and drop them from live connections. `options.revoke` also
+ * revokes the grant where the authorization server documents how; resolves
+ * `{ revoked }`.
  */
-export async function clearMcpServerOAuth(cfg) {
+export async function clearMcpServerOAuth(cfg, options = {}) {
   let url;
   try {
     url = resolveMcpOAuthUrl(cfg);
   } catch {
     // A config without a valid remote URL never connected, so never logged in.
-    return;
+    return { revoked: false };
   }
-  if (url) await clearMcpOAuth({ url });
+  if (url) return clearMcpOAuth({ url, revoke: options.revoke === true });
+  return { revoked: false };
 }
 /**
  * Close a single server: for stdio transports first shut down the full child
@@ -1245,6 +1311,13 @@ export async function clearMcpServerOAuth(cfg) {
  * only kills the direct child and discards the pid we need to walk the tree.
  */
 async function _closeServer(server) {
+  // A shared stdio connection closes only when its last scope releases it.
+  const shared = server?.shared;
+  if (shared) {
+    shared.users.delete(server.registryKey);
+    if (shared.users.size > 0) return;
+    retireSharedConnection(server);
+  }
   // A deliberate close is not a crash: suppress the unexpected-close report.
   if (server?.liveness) server.liveness.closing = true;
   const transport = server?.transport;
@@ -1263,6 +1336,19 @@ async function _closeServer(server) {
     /* ignore */
   }
 }
+// Register `name` in `scopeId` on the live shared connection for `shareKey`,
+// when there is one. Returns whether it did.
+function adoptSharedConnection(shareKey, name, cfg, scopeId, genAtStart) {
+  const shared = shareKey ? _sharedStdio.get(shareKey) : null;
+  if (!shared || shared.liveness.alive === false || shared.liveness.closing) return false;
+  const registryKey = mcpServerRegistryKey(scopeId, name);
+  const { key: _key, users, ...connection } = shared;
+  users.add(registryKey);
+  rememberServerConnector(name, cfg);
+  servers.set(registryKey, { scopeId, registryKey, name, ...connection, cfg, shared, generation: genAtStart });
+  _invalidateMcpToolFieldMemo();
+  return true;
+}
 // Connects whose handshake has not finished yet: disconnectAll() must be able
 // to see (and tear down) their transports, because `servers` only lists fully
 // handshaken entries. Generation token aborts a connect that outlives a
@@ -1282,6 +1368,8 @@ async function connectServer(
     // abort before creating a transport/child at all.
     throw new Error(`MCP server "${name}" connect aborted by shutdown`);
   }
+  const shareKey = sharedStdioKey(name, cfg);
+  if (adoptSharedConnection(shareKey, name, cfg, scopeId, genAtStart)) return;
   const client = createMcpClient(sdk, name, cfg, scopeId);
   const { transport, autoDetectAdvert, stderrTail, warnings } = createMcpTransport({
     name,
@@ -1326,26 +1414,42 @@ async function connectServer(
       }
       throw new Error(`MCP server "${name}" connect aborted by shutdown`);
     }
+    // Another scope finished connecting the same server meanwhile: use its
+    // process and release this one.
+    if (adoptSharedConnection(shareKey, name, cfg, scopeId, genAtStart)) {
+      await _closeServer({ client, transport, liveness });
+      return;
+    }
     const tools = mcpServerTools(name, capabilities, toolsResult.tools, cfg);
     const registryKey = mcpServerRegistryKey(scopeId, name);
-    servers.set(registryKey, {
-      scopeId,
-      registryKey,
-      name,
+    const connection = {
       client,
       transport,
       tools,
-      cfg,
       instructions,
       capabilities,
       liveness,
       stderrTail,
       warnings: warnings || [],
+    };
+    const shared = shareKey ? { ...connection, key: shareKey, users: new Set([registryKey]) } : null;
+    if (shared) _sharedStdio.set(shareKey, shared);
+    rememberServerConnector(name, cfg);
+    servers.set(registryKey, {
+      scopeId,
+      registryKey,
+      name,
+      ...connection,
+      cfg,
+      shared,
       generation: genAtStart,
     });
     if (capabilities?.tools?.listChanged && sdk.ToolListChangedNotificationSchema) {
+      // A shared connection refreshes the tools of every scope using it.
       client.setNotificationHandler(sdk.ToolListChangedNotificationSchema, () =>
-        refreshServerTools(registryKey, client, name, cfg, capabilities)
+        Promise.all(
+          [...(shared?.users ?? [registryKey])].map((key) => refreshServerTools(key, client, name, cfg, capabilities))
+        )
       );
     }
     _invalidateMcpToolFieldMemo();
@@ -1514,6 +1618,8 @@ async function runToolRefresh(registryKey, live, name, cfg, capabilities) {
     }
     if (servers.get(registryKey) !== live) return;
     live.tools = mcpServerTools(name, capabilities, refreshed.tools, cfg);
+    // A scope adopting the connection later starts from the current listing.
+    if (live.shared) live.shared.tools = live.tools;
     _invalidateMcpToolFieldMemo();
   } catch (error) {
     mcpLog(
@@ -1567,6 +1673,7 @@ export function _registerMcpServerForTest(scopeId, name, rawTools = [], options
     generation: currentConnectAbortGeneration(normalizedScopeId),
   };
   _knownMcpScopes.add(normalizedScopeId);
+  rememberServerConnector(name, server.cfg);
   servers.set(registryKey, server);
   _invalidateMcpToolFieldMemo();
   return server;

package/src/runtime/agent/orchestrator/mcp/oauth-account.mjs

@@ -0,0 +1,97 @@
+// The account side of an MCP OAuth sign-in: which documented authorization
+// parameter makes a provider show its account choice, and who a sign-in
+// belongs to, read only from what the authorization server returned.
+//
+// Parameters are sent only where the provider documents them (keyed by the
+// authorization endpoint's host); everywhere else nothing is added:
+//   Google  prompt=select_account  developers.google.com/identity/protocols/oauth2/web-server#creatingclient
+//   GitHub  prompt=select_account  docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps
+//   Atlassian (Jira, Confluence, Trello) prompt=consent  developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/
+//   Linear  prompt=consent         linear.app/developers/oauth-2-0-authentication
+//   Dropbox force_reapprove=true   www.dropbox.com/developers/documentation/http/documentation#oauth2-authorize
+
+const SELECT_ACCOUNT = Object.freeze({ prompt: 'select_account' });
+// A normal connect shows the chooser only where it is the documented choice.
+const CONNECT_PARAMS = Object.freeze({
+  'accounts.google.com': SELECT_ACCOUNT,
+  'github.com': SELECT_ACCOUNT,
+});
+// 계정 바꾸기: the provider's documented way to force the choice (or the grant).
+const SWITCH_PARAMS = Object.freeze({
+  ...CONNECT_PARAMS,
+  'auth.atlassian.com': Object.freeze({ prompt: 'consent' }),
+  'linear.app': Object.freeze({ prompt: 'consent' }),
+  'mcp.linear.app': Object.freeze({ prompt: 'consent' }),
+  'www.dropbox.com': Object.freeze({ force_reapprove: 'true' }),
+});
+
+const hostOf = (url) => {
+  try {
+    return new URL(url).host.toLowerCase();
+  } catch {
+    return '';
+  }
+};
+
+/** `authorizationUrl` with the account parameters of `mode` (`connect`,
+ *  `reauth`, `switch`); a repair (`reauth`) adds nothing. A `prompt` the
+ *  request already carries (the SDK's `consent` for offline access) is kept. */
+export function withAccountParams(authorizationUrl, mode = 'connect') {
+  const target = new URL(authorizationUrl);
+  const table = mode === 'switch' ? SWITCH_PARAMS : mode === 'connect' ? CONNECT_PARAMS : {};
+  const params = table[target.host.toLowerCase()];
+  if (!params) return target;
+  for (const [key, value] of Object.entries(params)) {
+    if (key !== 'prompt') {
+      target.searchParams.set(key, value);
+      continue;
+    }
+    const values = new Set((target.searchParams.get('prompt') || '').split(' ').filter(Boolean));
+    values.add(value);
+    target.searchParams.set('prompt', [...values].join(' '));
+  }
+  return target;
+}
+
+/** Whether 계정 바꾸기 can make the provider of this authorization endpoint
+ *  show its choice (otherwise the user switches at the provider first). */
+export function canForceAccountChoice(authorizationEndpoint) {
+  return Object.hasOwn(SWITCH_PARAMS, hostOf(authorizationEndpoint));
+}
+
+const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : '');
+
+function idTokenClaims(idToken) {
+  const payload = typeof idToken === 'string' ? idToken.split('.')[1] : '';
+  if (!payload) return {};
+  try {
+    const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    return claims && typeof claims === 'object' ? claims : {};
+  } catch {
+    return {};
+  }
+}
+
+/** `{ account, workspace }` from a token endpoint response: the OIDC id_token
+ *  claims and the identity fields providers return beside the tokens (Notion's
+ *  workspace and owner, Slack's team, a `user` / `organization` object). Null
+ *  when the response names nobody: an identity is never guessed. */
+export function identityFromTokenResponse(body) {
+  if (!body || typeof body !== 'object') return null;
+  const claims = idTokenClaims(body.id_token);
+  const user = body.user && typeof body.user === 'object' ? body.user : {};
+  const person = body.owner?.user?.person;
+  const account =
+    text(claims.email) ||
+    text(claims.preferred_username) ||
+    text(body.email) ||
+    text(user.email) ||
+    text(user.login) ||
+    text(user.username) ||
+    text(person?.email) ||
+    text(body.owner?.user?.name);
+  const workspace =
+    text(body.workspace_name) || text(body.team?.name) || text(body.organization?.name) || text(body.org?.name);
+  if (!account && !workspace) return null;
+  return { account, workspace };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-callback.mjs

@@ -70,8 +70,7 @@ export function answerOAuthCallback(req, res, { redirectUrl, state, finish, serv
     });
     res.end(html);
   };
-  const invalid = () =>
-    page(400, oauthErrorHtml('This sign-in link is invalid or has expired.', 'Start the sign-in again from Mixdog.'));
+  const invalid = () => page(400, oauthErrorHtml('This sign-in link is invalid or has expired.'));
   let target;
   try {
     target = new URL(req.url || '/', redirectUrl);
@@ -94,7 +93,7 @@ export function answerOAuthCallback(req, res, { redirectUrl, state, finish, serv
   const server = serverName || 'the MCP server';
   if (target.searchParams.has('error')) {
     // The authorization server's error text is never reflected.
-    page(400, oauthErrorHtml(`Sign-in to ${server} was not completed.`, 'Start the sign-in again from Mixdog.'));
+    page(400, oauthErrorHtml(`Sign-in to ${server} was not completed.`));
     finish(undefined);
     return;
   }

package/src/runtime/agent/orchestrator/mcp/oauth-client.mjs

@@ -0,0 +1,49 @@
+// A pre-registered OAuth client for an MCP server, used as static client
+// information in place of dynamic client registration:
+//   - the user's own (custom connector → 고급 설정 → 앱 번호/비밀값): the id
+//     in the server config (`oauthClientId`, not a secret), the secret only in
+//     the keychain under mcpOAuthClientSecretAccount(url);
+//   - else the catalog connector's (connector-catalog.mjs `oauthClient`), with
+//     its scopes and the provider's offline-access parameter.
+import { createHash } from 'node:crypto';
+import keychain from '../../../../lib/keychain-cjs.cjs';
+import { connectorById, connectorOfServer } from '../../../shared/connector-catalog.mjs';
+import { GOOGLE_AUTH_PARAMS, googleOAuthClient } from '../../../shared/google-oauth-client.mjs';
+import { normalizeMcpTransportUrl } from './client-config.mjs';
+
+const BUILT_IN_CLIENTS = {
+  google: () => {
+    const client = googleOAuthClient();
+    return client && { ...client, authParams: GOOGLE_AUTH_PARAMS };
+  },
+};
+
+/** The keychain account of the user's client secret for one server URL. */
+export function mcpOAuthClientSecretAccount(url) {
+  const key = normalizeMcpTransportUrl(String(url));
+  return `mcp-oauth-client.${createHash('sha256').update(key).digest('hex')}`;
+}
+
+/** Store (or, with '', delete) the user's client secret for server `url`. */
+export async function saveMcpOAuthClientSecret(url, secret, credentialStore = keychain) {
+  const account = mcpOAuthClientSecretAccount(url);
+  if (secret) await credentialStore.setSecretAsync(account, secret);
+  else await credentialStore.deleteSecretAsync(account);
+}
+
+/**
+ * `{ clientId, clientSecret?, secretAccount?, scopes?, authParams? }` for
+ * server config `cfg` at `url`, or null to register a client dynamically.
+ */
+export function mcpOAuthClientFor(cfg, url) {
+  const backend = connectorById(connectorOfServer(cfg))?.backend;
+  const catalog = backend?.kind === 'oauth' ? backend : null;
+  const scopes = catalog?.scopes ? [...catalog.scopes] : undefined;
+  const own = typeof cfg?.oauthClientId === 'string' ? cfg.oauthClientId.trim() : '';
+  if (own) {
+    const authParams = catalog?.oauthClient === 'google' ? GOOGLE_AUTH_PARAMS : undefined;
+    return { clientId: own, secretAccount: mcpOAuthClientSecretAccount(url), scopes, authParams };
+  }
+  const builtIn = catalog?.oauthClient ? BUILT_IN_CLIENTS[catalog.oauthClient]?.() : null;
+  return builtIn ? { ...builtIn, scopes } : null;
+}