mixdog 1.2.5 → 1.3.0

package/src/session-runtime/lifecycle/shared.mjs

@@ -3,6 +3,8 @@
  * lifecycle groups (teardown, session switching, inheritance).
  */
 import { hasUserConversationMessage } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
+import { isAgentHomeSessionId } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { isRoomThreadSessionId } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
 
 export { SESSION_ID_PATTERN } from '../../runtime/agent/orchestrator/runtime-core/session-id.mjs';
 
@@ -19,13 +21,34 @@ export function isScratchConversation(messages, liveTurnMessages) {
   );
 }
 
+/** An agent's home thread is never scratch: a blank one is tombstoned on no
+ *  close, so its fixed id stays open for the next visit. Neither is a group
+ *  room's log or member session (agent-room.mjs), whose ids are fixed too. */
 export function isScratchSession(session) {
+  if (isAgentHomeSessionId(session?.id) || isRoomThreadSessionId(session?.id)) return false;
   return isScratchConversation(session?.messages, session?.liveTurnMessages);
 }
 
-export function createSurfaceSessionCloser(mgr) {
+/** `nonBlocking`: the closer returns the manager's closeSessionAsync promise
+ *  (when it has one), whose barrier never sleeps the event loop. */
+export function createSurfaceSessionCloser(mgr, nonBlocking = false) {
   return function closeSurfaceSession(session, reason, options) {
     if (!session?.id) return false;
-    return mgr.closeSession(session.id, reason, options);
+    return closeManagedSession(mgr, session.id, reason, options, nonBlocking);
   };
 }
+
+/** Await a switch path's close of the outgoing session. A close whose durable
+ *  barrier failed leaves the session open, so the switch must not proceed. */
+export async function closeOutgoingSession(closeSurfaceSession, session, reason, options) {
+  if ((await closeSurfaceSession(session, reason, options)) === false) {
+    throw new Error(`session close failed (reason=${reason}); the current session is kept`);
+  }
+}
+
+/** The manager's close: closeSessionAsync when asked for and available,
+ *  else its closeSession, unchanged. */
+export function closeManagedSession(mgr, id, reason, options, nonBlocking = true) {
+  if (nonBlocking && typeof mgr.closeSessionAsync === 'function') return mgr.closeSessionAsync(id, reason, options);
+  return mgr.closeSession(id, reason, options);
+}

package/src/session-runtime/lifecycle/teardown/session-close.mjs

@@ -47,6 +47,8 @@ export function closeOwnSession(deps, closeSurfaceSession, reason) {
     clearRuntimeNotifications,
     notificationListeners,
   } = deps;
+  // The close's answer: a boolean, or the promise of one when the closer
+  // retries a refused barrier rename on timers (callers await it).
   let ok = false;
   const session = getSession();
   if (session?.id) {

package/src/session-runtime/lifecycle/teardown.mjs

@@ -226,13 +226,16 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
     };
     if (outstandingCloses.size > 0) void finish();
     else await finish();
-    const { ok, stops } = await inOwnLoopTurn(() => {
+    const { ownClose, stops } = await inOwnLoopTurn(() => {
       const runtimeStops = startRuntimeStops(deps, reason, scope);
       const closed = closeOwnSession(deps, closeSurfaceSession, reason);
-      return { ok: closed, stops: { channelStop, ...runtimeStops, ...startWorkStops(deps, reason, scope) } };
+      return { ownClose: closed, stops: { channelStop, ...runtimeStops, ...startWorkStops(deps, reason, scope) } };
     });
     if (scope.detach) await settleDetached(withTeardownDeadline, stops);
     else await settleAll(withTeardownDeadline, stops);
+    // Reported closed only once the barrier is on disk (closeSessionAsync),
+    // and its write control is released only after that.
+    const ok = await ownClose;
     // The session went away (idle eviction included): free its save baselines.
     if (scope.closingSessionId) forgetSessionSaveBaseline(scope.closingSessionId, { releaseWriteControl: true });
     // Self-update stages in the background and swaps on the next clean launch

package/src/session-runtime/lifecycle-api.mjs

@@ -20,7 +20,9 @@ export { resolveResumeCwd } from './lifecycle/session-switch.mjs';
 export function createLifecycleApi(deps) {
   const shared = {
     cancelBackgroundTasks: deps.cancelBackgroundTasks || cancelBackgroundTasks,
-    closeSurfaceSession: createSurfaceSessionCloser(deps.mgr),
+    // Teardown and the switch paths await their close: a barrier rename the OS
+    // refuses is retried on timers instead of sleeping the daemon loop.
+    closeSurfaceSession: createSurfaceSessionCloser(deps.mgr, true),
     ingestSessionIntoMemory: createMemoryIngest(deps),
   };
   const teardown = createTeardown(deps, shared);

package/src/session-runtime/mcp-glue/server-catalog.mjs

@@ -2,6 +2,7 @@
 // servers plus the servers registered plugins declare (resolved live, with
 // explicit owner metadata), per-server config reads, and the live/failed rollup.
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { connectorOfServer, gmailAppPasswordAccount } from '../../runtime/shared/connector-catalog.mjs';
 import { envFlag } from '../../runtime/shared/env.mjs';
 import { resolveMcpServerCatalog } from './plugin-servers.mjs';
 
@@ -142,9 +143,16 @@ export function createMcpServerCatalog({
         source: sources[name] || 'config',
       };
       if (authRequired) row.authRequired = true;
+      // The catalog service this server connects (connector-catalog.mjs):
+      // its marker.
+      const connector = entry.owner ? '' : connectorOfServer(cfg);
+      if (connector) row.connector = connector;
       const oauth = mcpClient.getMcpServerOAuthState?.(cfg);
       // Why the last sign-in did not complete (already credential-scrubbed).
       if (oauth) row.oauth = authRequired && fail?.msg ? { ...oauth, lastError: fail.msg } : oauth;
+      // Gmail connected with an app password: the account it runs as.
+      const appPasswordAccount = gmailAppPasswordAccount(cfg);
+      if (appPasswordAccount) row.appPassword = { account: appPasswordAccount };
       if (entry.owner) {
         row.owner = entry.owner;
         row.pluginEnabled = entry.pluginEnabled;

package/src/session-runtime/mcp-glue/server-input.mjs

@@ -70,6 +70,9 @@ export function createMcpServerInput({ mcpClient, getCurrentCwd }) {
       if (bearerTokenEnvVar) config.bearer_token_env_var = bearerTokenEnvVar;
       const envHeaders = coerceStringRecord(input.env_http_headers || input.envHttpHeaders);
       if (envHeaders) config.env_http_headers = envHeaders;
+      // The user's own OAuth client (앱 번호); its secret never lands here.
+      const oauthClientId = clean(input.oauthClientId);
+      if (oauthClientId) config.oauthClientId = oauthClientId;
       return config;
     };
     const url = clean(input.url);

package/src/session-runtime/mcp-oauth-login.mjs

@@ -8,6 +8,15 @@ import { openInBrowser } from '../runtime/shared/open-url.mjs';
 // Settled flows stay readable long enough for a poller to observe the result.
 const SETTLED_FLOW_TTL_MS = 10 * 60_000;
 const NOT_COMPLETED = 'MCP OAuth sign-in was not completed';
+export const MCP_OAUTH_LOGIN_TIMED_OUT = 'MCP OAuth sign-in timed out';
+// A sign-in nobody finishes ends here, ahead of the OAuth layer's own 5-minute
+// abort, so its failure is reported as the timeout it is.
+const LOGIN_DEADLINE_MS = 5 * 60_000 - 10_000;
+// The longest a status read waits for a change (local callers only).
+const MAX_STATUS_WAIT_MS = 15_000;
+// How a sign-in treats the account (mcp/oauth-account.mjs): a normal
+// authorization, a repair of the same connection, or a transactional switch.
+const MODES = new Set(['connect', 'reauth', 'switch']);
 
 const NOT_PENDING = 'MCP OAuth sign-in is no longer pending';
 
@@ -19,17 +28,36 @@ const NOT_PENDING = 'MCP OAuth sign-in is no longer pending';
 const flows = new Map();
 
 // A pending flow keeps its authorization URL readable: a client polling the
-// status (remote sign-in) still shows the page to open.
+// status (remote sign-in) still shows the page to open. `step` names what a
+// pending flow waits for: `browser` (the sign-in page), `connecting` (the
+// callback arrived; tokens are exchanged), `tools` (signed in; the server
+// connects and lists its tools).
 const view = (flow) => ({
   flowId: flow.flowId,
   state: flow.state,
+  ...(flow.state === 'pending' ? { step: flow.step } : {}),
   ...(flow.state === 'pending' && flow.url ? { url: flow.url } : {}),
   ...(flow.error ? { error: flow.error } : {}),
+  ...(flow.reason ? { reason: flow.reason } : {}),
 });
+const versionOf = (flow) => `${flow.state}:${flow.step}`;
+// Wake every status read waiting on this flow.
+function changed(flow) {
+  const waiters = flow.waiters;
+  flow.waiters = [];
+  for (const wake of waiters) wake();
+}
+function setStep(flow, step) {
+  if (flow.state !== 'pending' || flow.step === step) return;
+  flow.step = step;
+  changed(flow);
+}
 function settle(flow, state, error = null) {
   if (flow.state !== 'pending') return;
   flow.state = state;
   if (state === 'failed') flow.error = error || NOT_COMPLETED;
+  clearTimeout(flow.deadline);
+  changed(flow);
   setTimeout(() => flows.delete(flow.flowId), SETTLED_FLOW_TTL_MS).unref?.();
 }
 function flowOf(flowId) {
@@ -40,19 +68,23 @@ function flowOf(flowId) {
 async function cancelFlow(flow) {
   if (flow.state === 'pending') {
     flow.cancelled = true;
-    flow.owner.cancel(flow.name);
+    flow.abort();
     await flow.done;
   }
   return view(flow);
 }
 
 /**
- * `connect(name, openBrowser)` reconnects the server interactively, calling
- * `openBrowser(url)` when a login starts, and resolves `{ connected, error }`.
+ * `connect(name, launch)` reconnects the server interactively, calling
+ * `launch(url)` when a login starts, and resolves `{ connected, error }`.
  * `cancel(name)` aborts that server's pending login. `completeCallback(name,
  * callbackUrl)` answers it with a pasted redirect URL (throws a fixed message
- * for an invalid one). `onComplete(name)` runs after a successful sign-in,
- * before the flow reports complete.
+ * for an invalid one). `switchAccount(name, launch, attempt)` runs an account
+ * switch instead (mode `switch`): it registers `attempt.abort` / `attempt.answer`
+ * and resolves `{ connected, error }` only after committing (or rolling back)
+ * the new sign-in. `launch` carries `accountMode` and the progress hooks
+ * `onCallback` / `onAuthorized` the OAuth layer calls. `onComplete(name)` runs
+ * after a successful sign-in, once the flow already reports complete.
  */
 export function createMcpOAuthLogins({
   connect,
@@ -60,8 +92,12 @@ export function createMcpOAuthLogins({
   completeCallback = () => {
     throw new Error(NOT_PENDING);
   },
+  switchAccount = async () => {
+    throw new Error('Switching the account is not supported here');
+  },
   onComplete = async () => {},
   openBrowser = openInBrowser,
+  loginTimeoutMs = LOGIN_DEADLINE_MS,
 }) {
   // name -> tail of that server's serialized begin/cancel/sign-out steps, so
   // replacing a pending flow is atomic and exactly one can be pending.
@@ -89,10 +125,11 @@ export function createMcpOAuthLogins({
     Promise.all([...flows.values()].filter((flow) => flow.owner === owner && flow.name === name).map(cancelFlow));
 
   async function begin(name, options = {}) {
-    const { openBrowser: hostBrowser } = options || {};
+    const { openBrowser: hostBrowser, mode = 'connect' } = options || {};
     if (hostBrowser !== undefined && typeof hostBrowser !== 'boolean') {
       throw new TypeError('openBrowser must be a boolean');
     }
+    if (!MODES.has(mode)) throw new TypeError('mode must be connect, reauth or switch');
     let announceUrl;
     const urlReady = new Promise((resolve) => {
       announceUrl = resolve;
@@ -105,10 +142,17 @@ export function createMcpOAuthLogins({
         flowId: `mcp_oauth_${randomUUID()}`,
         name,
         owner,
+        mode,
         state: 'pending',
+        step: 'starting',
         error: null,
+        reason: null,
         cancelled: false,
+        timedOut: false,
         url: null,
+        waiters: [],
+        abort: () => owner.cancel(name),
+        answer: (callbackUrl) => owner.completeCallback(name, callbackUrl),
       };
       flows.set(flow.flowId, flow);
       const launch = async (url) => {
@@ -117,22 +161,51 @@ export function createMcpOAuthLogins({
         if (flow.cancelled) throw new Error('MCP OAuth login cancelled');
         flow.awaitingCallback = true;
         flow.url = url;
+        setStep(flow, 'browser');
         announceUrl(url);
         if (hostBrowser !== false) openBrowser(url);
+        // Nobody finished the sign-in page in time.
+        flow.deadline = setTimeout(() => {
+          if (flow.state !== 'pending' || flow.step !== 'browser') return;
+          flow.timedOut = flow.cancelled = true;
+          flow.abort();
+        }, loginTimeoutMs);
+        flow.deadline.unref?.();
       };
+      launch.accountMode = mode;
+      launch.onCallback = () => setStep(flow, 'connecting');
+      launch.onAuthorized = () => setStep(flow, 'tools');
       flow.done = (async () => {
         try {
-          const outcome = await connect(name, launch);
-          if (flow.cancelled) settle(flow, 'cancelled');
+          const outcome =
+            mode === 'switch'
+              ? await switchAccount(name, launch, {
+                  set abort(fn) {
+                    flow.abort = fn;
+                  },
+                  set answer(fn) {
+                    flow.answer = fn;
+                  },
+                })
+              : await connect(name, launch);
+          if (flow.timedOut) {
+            flow.reason = 'timeout';
+            settle(flow, 'failed', MCP_OAUTH_LOGIN_TIMED_OUT);
+          } else if (flow.cancelled) settle(flow, 'cancelled');
           else if (outcome?.connected) {
-            // The sign-in itself succeeded; a failed follow-up never undoes it.
-            await Promise.resolve()
+            settle(flow, 'complete');
+            // The other runtimes reconnect after the flow already reports
+            // complete: the caller never waits for every peer's reconnect, and
+            // a failed follow-up never undoes the sign-in.
+            void Promise.resolve()
               .then(() => onComplete(name))
               .catch(() => {});
-            settle(flow, 'complete');
           } else settle(flow, 'failed', outcome?.error);
         } catch (error) {
-          settle(flow, flow.cancelled ? 'cancelled' : 'failed', error?.message || String(error));
+          if (flow.timedOut) {
+            flow.reason = 'timeout';
+            settle(flow, 'failed', MCP_OAUTH_LOGIN_TIMED_OUT);
+          } else settle(flow, flow.cancelled ? 'cancelled' : 'failed', error?.message || String(error));
         }
       })();
       return flow;
@@ -147,7 +220,31 @@ export function createMcpOAuthLogins({
 
   return {
     begin,
-    status: (flowId) => view(flowOf(flowId)),
+    /** The flow's view. With `{ since, waitMs }` (the `state:step` a caller
+     *  last saw) the read resolves on the flow's next change, or after at most
+     *  `waitMs` unchanged: the caller follows each step as it happens. */
+    status(flowId, options = {}) {
+      const flow = flowOf(flowId);
+      const { since, waitMs } = options || {};
+      if (since === undefined) return view(flow);
+      if (typeof since !== 'string') throw new TypeError('since must be a string');
+      if (!Number.isFinite(waitMs) || waitMs < 0) throw new TypeError('waitMs must be a non-negative number');
+      if (since !== versionOf(flow) || flow.state !== 'pending' || waitMs === 0) return view(flow);
+      return new Promise((resolve) => {
+        const wake = () => {
+          clearTimeout(timer);
+          resolve(view(flow));
+        };
+        const timer = setTimeout(
+          () => {
+            flow.waiters = flow.waiters.filter((waiter) => waiter !== wake);
+            resolve(view(flow));
+          },
+          Math.min(waitMs, MAX_STATUS_WAIT_MS)
+        );
+        flow.waiters.push(wake);
+      });
+    },
     cancel(flowId) {
       const flow = flowOf(flowId);
       return flow.owner.exclusive(flow.name, () => cancelFlow(flow));
@@ -158,7 +255,7 @@ export function createMcpOAuthLogins({
     async complete(flowId, callbackUrl) {
       const flow = flowOf(flowId);
       if (flow.state !== 'pending' || flow.cancelled || !flow.awaitingCallback) throw new Error(NOT_PENDING);
-      flow.owner.completeCallback(flow.name, callbackUrl);
+      flow.answer(callbackUrl);
       await flow.done;
       return view(flow);
     },

package/src/session-runtime/model-route/set-route.mjs

@@ -140,15 +140,26 @@ function modelSwitchAnchorIndex(messages) {
  *  (like an inheritance boundary): the transcript shows it live and after a
  *  restore, and the model conversation gains no synthetic message. */
 export function recordModelSwitchBoundary(session, boundary) {
+  return recordTranscriptBoundary(
+    session,
+    'modelSwitches',
+    boundary,
+    (entry) => entry?.at === boundary.at && entry?.modelId === boundary.modelId
+  );
+}
+
+/** A display-only boundary appended to `meta[field]` of the switch anchor
+ *  message (model and workflow switches); `same` finds an already recorded one. */
+export function recordTranscriptBoundary(session, field, boundary, same) {
   const messages = Array.isArray(session?.messages) ? session.messages : [];
   const index = modelSwitchAnchorIndex(messages);
   if (index < 0) return false;
   const anchor = messages[index];
-  const switches = Array.isArray(anchor.meta?.modelSwitches) ? anchor.meta.modelSwitches : [];
-  if (switches.some((entry) => entry?.at === boundary.at && entry?.modelId === boundary.modelId)) return true;
+  const switches = Array.isArray(anchor.meta?.[field]) ? anchor.meta[field] : [];
+  if (switches.some(same)) return true;
   // Replace the message object: the session save worker detects changed
   // messages by reference identity, so an in-place meta edit is never saved.
-  messages[index] = { ...anchor, meta: { ...anchor.meta, modelSwitches: [...switches, boundary] } };
+  messages[index] = { ...anchor, meta: { ...anchor.meta, [field]: [...switches, boundary] } };
   return true;
 }
 

package/src/session-runtime/owned-automation-run.mjs

@@ -0,0 +1,229 @@
+/**
+ * One run of an owned automation — a schedule or a webhook endpoint. The run
+ * itself is a turn in the owner bot's home thread (routine-home-turn.mjs);
+ * the bot's reply there is its result, so nothing is posted besides it. A run
+ * whose owner bot does not exist (routine-owner.mjs) never fires: it is
+ * skipped as paused, never run elsewhere. A second run of the same automation
+ * while one is in flight is skipped (and recorded).
+ *
+ * Unattended runs (timed fires, received webhooks; not the app's or a chat's
+ * "Run now") also back off after consecutive failures (ROUTINE_LIMITS).
+ * Runs have no concurrency cap or deadline (user decision).
+ *
+ * Routine results from before routines ran in the bot's thread may still sit
+ * on a routine's record (`result_delivery`): redeliverRoutine and the daemon's
+ * recovery queue them into the owner's thread (agent-home-delivery.mjs),
+ * never running the routine again.
+ */
+import { announceRoutineRun, deliverScheduleResult } from './agent-home-delivery.mjs';
+import { ROUTINE_LIMITS, routineBackoffRemaining } from '../runtime/shared/routine-limits.mjs';
+import { ROUTINE_OWNER_PROBLEMS, routineOwnerProblem } from './routine-owner.mjs';
+
+const DELIVERY_RETRY_MS = 60_000;
+const errorText = (error) => error?.message || String(error);
+const defaultLog = (line) => process.stderr.write(`mixdog routines: ${line}\n`);
+
+// `${kind}:${name}` of every run in flight in this process: timed fires,
+// received webhooks and the app's "Run now" all come through here.
+const activeRuns = new Set();
+
+// The PG record of each kind, imported on first use.
+const RECORDS = {
+  schedule: () =>
+    import('../runtime/channels/lib/schedules-db.mjs').then((db) => ({
+      state: (name) => db.getSchedule(name),
+      list: () => db.listSchedules(),
+      recordDelivery: db.recordScheduleDelivery,
+    })),
+  webhook: () =>
+    import('../runtime/channels/lib/webhooks-db.mjs').then((db) => ({
+      state: (name) => db.loadEndpointConfig(name),
+      list: () => db.listEndpoints(),
+      recordDelivery: db.recordEndpointDelivery,
+    })),
+};
+/** `deps` over the kind's PG record for whatever `deps` leaves out. */
+async function withRecord(kind, deps) {
+  if (deps.state && deps.list && deps.recordDelivery) return deps;
+  const record = await RECORDS[kind]();
+  return {
+    ...deps,
+    state: deps.state || record.state,
+    list: deps.list || record.list,
+    recordDelivery: deps.recordDelivery || record.recordDelivery,
+  };
+}
+
+let retryArmed = false;
+/** One timer for the whole host: re-queue every record's undelivered result. */
+function armDeliveryRetry() {
+  if (retryArmed) return;
+  retryArmed = true;
+  setTimeout(() => {
+    retryArmed = false;
+    recoverRoutineDeliveries().catch((error) => defaultLog(`delivery retry failed: ${errorText(error)}`));
+  }, DELIVERY_RETRY_MS).unref?.();
+}
+
+/** Show `run`'s live-only row in the owner's home; a failure only logs. */
+async function announceRun(announce, row, run, log) {
+  try {
+    await announce(row, run);
+  } catch (error) {
+    log(`${run.kind} "${row.name}": run row not shown: ${errorText(error)}`);
+  }
+}
+
+/** Queue `item` for `row`'s owner; clear the record on success, mark it
+ *  'failed' (and arm the retry) when the queue refuses it. */
+async function queueResult(row, item, entry, { deliver, recordDelivery, onDeliveryFailed, announce, log }) {
+  try {
+    await deliver(row, item);
+  } catch (error) {
+    const message = errorText(error);
+    log(`${item.kind} "${row.name}": result could not be queued (${message}); retrying later`);
+    await recordDelivery(row.name, item.runId, { ...entry, state: 'failed', error: message }).catch((recordError) =>
+      log(`${item.kind} "${row.name}": delivery failure not recorded: ${errorText(recordError)}`)
+    );
+    // The home's run row turns into "result not delivered" (retry: retryRoutineDelivery).
+    await announceRun(announce, row, { ...item, state: 'undelivered' }, log);
+    onDeliveryFailed();
+    return false;
+  }
+  // A clear that fails leaves the record 'pending': the next recovery re-queues
+  // it, which the queue's run-id key turns into a no-op.
+  await recordDelivery(row.name, item.runId, null).catch((error) =>
+    log(`${item.kind} "${row.name}": delivered result not cleared: ${errorText(error)}`)
+  );
+  return true;
+}
+
+/**
+ * `row` is `{ name, ownerAgentId }`; `run({ signal })` resolves `{ sessionId,
+ * result }` (`signal` is the caller's cancellation, if any). Resolves the
+ * outcome, or `{ skipped: true, reason: 'owner' | 'overlap' | 'backoff' }`
+ * (an owner skip also names `ownerProblem` and its `message`); a failed run
+ * rejects.
+ */
+export async function runOwnedAutomation(kind, row, run, deps = {}) {
+  if (!row?.name) throw new Error(`${kind} run: a ${kind} row is required`);
+  const {
+    recordSkip = async () => {},
+    active = activeRuns,
+    limits = ROUTINE_LIMITS,
+    attended = false,
+    signal = null,
+    now = Date.now,
+    ownerProblem = routineOwnerProblem,
+    log = defaultLog,
+  } = deps;
+  const name = row.name;
+  const key = `${kind}:${name}`;
+  const skip = async (reason, extra = {}) => {
+    await Promise.resolve()
+      .then(() => recordSkip(name, new Date(now())))
+      .catch((error) => log(`${kind} "${name}": skip record failed: ${errorText(error)}`));
+    return { name, skipped: true, reason, sessionId: null, result: '', ...extra };
+  };
+  // A routine runs only in its own bot's thread: without that bot it waits.
+  const problem = await Promise.resolve()
+    .then(() => ownerProblem(row.ownerAgentId))
+    .catch(() => '');
+  if (problem) {
+    log(`${kind} "${name}": paused, ${ROUTINE_OWNER_PROBLEMS[problem]}`);
+    return skip('owner', { ownerProblem: problem, message: ROUTINE_OWNER_PROBLEMS[problem] });
+  }
+  if (active.has(key)) return skip('overlap');
+  active.add(key);
+  try {
+    if (!attended) {
+      const record = await withRecord(kind, deps);
+      const state = await Promise.resolve()
+        .then(() => record.state(name))
+        .catch(() => null);
+      const wait = routineBackoffRemaining(state, now(), limits);
+      if (wait > 0) {
+        log(`${kind} "${name}": skipped, backing off ${Math.ceil(wait / 1000)}s after failures in a row`);
+        return await skip('backoff');
+      }
+    }
+    return await run({ signal });
+  } finally {
+    active.delete(key);
+  }
+}
+
+/** Re-queue every result `row`'s record still holds, oldest first; resolves
+ *  the errors of the ones the queue still refuses. Never reruns the routine. */
+export async function redeliverRoutine(kind, row, deps = {}) {
+  const {
+    deliver = deliverScheduleResult,
+    onDeliveryFailed = armDeliveryRetry,
+    announce = announceRoutineRun,
+    log = defaultLog,
+  } = deps;
+  const record = await withRecord(kind, deps);
+  const entries = Object.entries(row?.resultDelivery || {}).sort(([, a], [, b]) =>
+    String(a?.at).localeCompare(String(b?.at))
+  );
+  const errors = [];
+  for (const [runId, entry] of entries) {
+    const result = entry?.result || {};
+    const item = {
+      runId,
+      kind,
+      ok: result.ok === true,
+      text: result.text || '',
+      runSessionId: result.runSessionId,
+      reason: result.reason,
+      paused: result.paused,
+    };
+    await queueResult(row, item, entry, {
+      ...record,
+      deliver,
+      announce,
+      log,
+      onDeliveryFailed: () => errors.push(runId),
+    });
+  }
+  if (errors.length) onDeliveryFailed();
+  return errors;
+}
+
+/** Daemon start (and the retry timer): re-queue every undelivered result of
+ *  every schedule and webhook. Resolves how many runs still wait. Without a
+ *  PostgreSQL cluster no routine exists, and none is started for this. */
+export async function recoverRoutineDeliveries(depsByKind = null) {
+  if (!depsByKind) {
+    const [{ pgClusterExists }, { resolvePluginData }] = await Promise.all([
+      import('../runtime/memory/lib/pg/adapter.mjs'),
+      import('../runtime/shared/plugin-paths.mjs'),
+    ]);
+    if (!pgClusterExists(resolvePluginData())) return 0;
+  }
+  let waiting = 0;
+  for (const kind of ['schedule', 'webhook']) {
+    const deps = await withRecord(kind, depsByKind?.[kind] || {});
+    for (const row of await deps.list()) {
+      if (row?.resultDelivery && Object.keys(row.resultDelivery).length) {
+        waiting += (await redeliverRoutine(kind, row, deps)).length;
+      }
+    }
+  }
+  return waiting;
+}
+
+/** The app's "retry" on one routine: rejects with the error when still refused. */
+export async function retryRoutineDelivery(kind, name, deps = {}) {
+  if (kind !== 'schedule' && kind !== 'webhook') throw new Error(`unknown routine kind "${kind}"`);
+  const record = await withRecord(kind, deps);
+  const row = await record.state(name);
+  if (!row) throw new Error(`${kind} "${name}" does not exist`);
+  const failed = await redeliverRoutine(kind, row, { ...deps, ...record });
+  if (failed.length) {
+    const latest = await record.state(name);
+    const error = latest?.resultDelivery?.[failed.at(-1)]?.error;
+    throw new Error(`"${name}": the result still could not be delivered${error ? ` (${error})` : ''}`);
+  }
+  return { name, delivered: Object.keys(row.resultDelivery || {}).length };
+}

package/src/session-runtime/provider-auth/login.mjs

@@ -6,11 +6,11 @@ import {
   forgetProviderAuth,
   loginOAuthProvider,
   saveOpenAIUsageSessionKey,
-  saveOpenCodeGoUsageAuth,
   saveProviderApiKey,
   saveCustomProvider,
   removeCustomProvider,
   updateCustomProviderModel,
+  saveModelPreferences,
   testCustomProvider,
   checkCustomProviderKeyEnv,
   discoverCustomProviderModels,
@@ -70,11 +70,6 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       refresh.afterUsageAuthChange();
       return result;
     },
-    async saveOpenCodeGoUsageAuth(opts) {
-      const result = await saveOpenCodeGoUsageAuth(cfgMod, opts);
-      refresh.afterUsageAuthChange();
-      return result;
-    },
     async saveCustomProvider(input) {
       await awaitKeychainPrewarm();
       const result = await saveCustomProvider(cfgMod, input);
@@ -86,6 +81,15 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       refresh.afterCredentialChange();
       return result;
     },
+    /** Model management: /model visibility and favorites of one provider.
+     *  Catalog rows read modelSettings on every answer, so only a custom
+     *  provider's catalog (its hidden overrides) needs the refresh chain. */
+    setModelPreferences(providerId, changes) {
+      const result = saveModelPreferences(cfgMod, providerId, changes);
+      if (result.customCatalogChanged) refresh.afterCredentialChange();
+      else reloadFullConfig();
+      return result;
+    },
     async removeCustomProvider(providerId) {
       await awaitKeychainPrewarm();
       const result = await removeCustomProvider(cfgMod, providerId);