mixdog 1.2.5 → 1.3.0

package/src/session-runtime/provider-auth/setup.mjs

@@ -4,6 +4,7 @@
 import { refreshKeychainStatus, retryKeychain } from '../../runtime/shared/config.mjs';
 import { keychainIssueFor } from '../services/provider-admin.mjs';
 import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
+import { providerCatalogFailure } from '../../runtime/agent/orchestrator/providers/catalog-failures.mjs';
 
 // The keyring alert must reflect the live state (it can lock or unlock while a
 // cached setup is served), so overlay it on every ready read.
@@ -14,6 +15,22 @@ function withLiveKeychain(setup) {
   return keychain ? { ...rest, keychain } : rest;
 }
 
+// A provider whose model list failed says why on its row (`catalogError`), so a
+// view never shows its empty list as if nothing were wrong. Overlaid on every
+// read like the keyring alert: the cached setup predates the failure.
+export function withCatalogErrors(setup) {
+  if (!setup || typeof setup !== 'object') return setup;
+  const out = { ...setup };
+  for (const group of ['api', 'oauth', 'local']) {
+    if (!Array.isArray(setup[group])) continue;
+    out[group] = setup[group].map((row) => {
+      const { message, errorKind } = providerCatalogFailure(row?.id) ?? {};
+      return message ? { ...row, catalogError: { message, errorKind } } : row;
+    });
+  }
+  return out;
+}
+
 export function createSetupApi({
   awaitKeychainPrewarm,
   isKeychainPrewarmReady,
@@ -41,7 +58,7 @@ export function createSetupApi({
         void Promise.resolve(awaitKeychainPrewarm())
           .then(() => cachedProviderSetup({}))
           .catch(() => {});
-        return { ...quick, pendingSecrets: !isKeychainPrewarmReady() };
+        return withCatalogErrors({ ...quick, pendingSecrets: !isKeychainPrewarmReady() });
       }
       await awaitKeychainPrewarm();
       // A keyring the user has since unlocked: rebuild the setup that was cached
@@ -53,7 +70,7 @@ export function createSetupApi({
       // `recheckKeychain` (window focus) skips the snapshot TTL.
       const changed = await refreshKeychainStatus({ force: options?.recheckKeychain === true });
       if (changed) reloadFullConfig();
-      return withLiveKeychain(await cachedProviderSetup({ force: force || recovered || changed }));
+      return withCatalogErrors(withLiveKeychain(await cachedProviderSetup({ force: force || recovered || changed })));
     },
     async getUsageDashboard(options = {}) {
       return await getUsageDashboard(options);

package/src/session-runtime/provider-catalog-cache.mjs

@@ -1,52 +1,128 @@
 // Provider registries are process-global. Share raw catalog rows across
 // sessions, while each session owns its saved-settings projection.
-let sharedCatalogRevision = -1;
+//
+// One slow or offline provider must not hold, or force a reload of, everyone
+// else's rows. Each provider's model list runs through catalog-deadline.mjs:
+// bounded per provider (a timed-out list becomes an error entry and is
+// aborted where listModels honors `{ signal }`), and single-flight per
+// provider until the underlying work settles. When some but not all providers
+// answer, the answered entries are kept for the catalog state, and each
+// failed entry carries a process-wide `retryAt`: non-forced reads by any
+// session reuse the partial answer and ask a missing provider again only once
+// its backoff passed. Forced reads ask every provider. A load where every
+// provider failed is never kept, so it stays immediately retryable. A
+// provider whose previous list ignored its deadline and is still running is
+// not asked at all (catalog-deadline.mjs): it gets a timed-out entry at
+// once, with the same backoff, until that list settles.
+//
+// The catalog state is the registry revision plus a local epoch that
+// invalidateSharedProviderCatalog() bumps on auth/account changes, so rows
+// listed under the previous account are never served again.
+import {
+  boundedProviderCatalogOp,
+  bumpProviderCatalogGeneration,
+  PROVIDER_CATALOG_TIMEOUT_MS,
+} from '../runtime/agent/orchestrator/providers/catalog-deadline.mjs';
+
+export { PROVIDER_CATALOG_TIMEOUT_MS };
+
+/** Backoff before a provider missing from a partial catalog is asked again. */
+export const PROVIDER_CATALOG_RETRY_MS = 30_000;
+
+let catalogEpoch = 0;
+let sharedCatalogKey = null;
 let sharedCatalogEntries = null;
+let sharedPartialKey = null;
+let sharedPartialEntries = null;
 let sharedCatalogPromise = null;
-let sharedCatalogPromiseRevision = -1;
+let sharedCatalogPromiseKey = null;
+let sharedCatalogPromiseForced = false;
 
 export function catalogRevision(registry) {
   const value = Number(registry?.providerCatalogRevision?.());
   return Number.isFinite(value) ? value : 0;
 }
 
-export async function sharedProviderCatalog(registry) {
-  const revision = catalogRevision(registry);
-  if (sharedCatalogRevision === revision && Array.isArray(sharedCatalogEntries)) {
+const catalogKey = (registry) => `${catalogRevision(registry)}:${catalogEpoch}`;
+
+/** Drops every shared entry (complete or partial) and opens a new epoch: the
+ *  next read asks every provider again. Called on auth/account changes. */
+export function invalidateSharedProviderCatalog() {
+  catalogEpoch += 1;
+  // Pending refreshes and lists of the previous account, of either kind, must
+  // not block or fail the new account's work.
+  bumpProviderCatalogGeneration();
+  sharedCatalogKey = null;
+  sharedCatalogEntries = null;
+  sharedPartialKey = null;
+  sharedPartialEntries = null;
+}
+
+const answered = (entry) => !Object.hasOwn(entry, 'error');
+
+async function providerEntry(name, provider, timeoutMs, epoch) {
+  if (typeof provider?.listModels !== 'function') return { name, models: [], ms: 0 };
+  const startedAt = performance.now();
+  const outcome = await boundedProviderCatalogOp({
+    name,
+    provider,
+    kind: 'list',
+    run: (signal) => provider.listModels({ signal }),
+    timeoutMs,
+    epoch,
+  });
+  const ms = performance.now() - startedAt;
+  if (outcome.error) {
+    return { name, models: [], error: outcome.error, ms, retryAt: Date.now() + PROVIDER_CATALOG_RETRY_MS };
+  }
+  return { name, models: Array.isArray(outcome.value) ? outcome.value : [], ms };
+}
+
+export async function sharedProviderCatalog(registry, { force = false, timeoutMs = PROVIDER_CATALOG_TIMEOUT_MS } = {}) {
+  const key = catalogKey(registry);
+  if (!force && sharedCatalogKey === key && Array.isArray(sharedCatalogEntries)) {
     return sharedCatalogEntries;
   }
-  if (sharedCatalogPromise && sharedCatalogPromiseRevision === revision) {
+  if (sharedCatalogPromise && sharedCatalogPromiseKey === key && (sharedCatalogPromiseForced || !force)) {
     return await sharedCatalogPromise;
   }
+  const kept = new Map();
+  if (!force && sharedPartialKey === key) {
+    const now = Date.now();
+    for (const entry of sharedPartialEntries) {
+      if (answered(entry) || now < entry.retryAt) kept.set(entry.name, entry);
+    }
+  }
   const providers = [...registry.getAllProviders()];
-  sharedCatalogPromiseRevision = revision;
+  // Every missing provider is still inside its backoff: the partial answer is
+  // the answer, without asking anyone.
+  if (providers.length > 0 && providers.every(([name]) => kept.has(name))) {
+    return providers.map(([name]) => kept.get(name));
+  }
+  // A pending list from an older catalog state (revision or account epoch) is
+  // not joined: its answer may describe the previous catalog.
+  const epoch = key;
+  sharedCatalogPromiseKey = key;
+  sharedCatalogPromiseForced = force;
   const request = Promise.all(
-    providers.map(async ([name, provider]) => {
-      if (typeof provider?.listModels !== 'function') return { name, models: [], ms: 0 };
-      const startedAt = performance.now();
-      try {
-        const models = await provider.listModels();
-        return { name, models: Array.isArray(models) ? models : [], ms: performance.now() - startedAt };
-      } catch (error) {
-        return { name, models: [], error, ms: performance.now() - startedAt };
-      }
-    })
+    providers.map(([name, provider]) => kept.get(name) || providerEntry(name, provider, timeoutMs, epoch))
   )
     .then((entries) => {
-      if (
-        sharedCatalogPromise === request &&
-        catalogRevision(registry) === revision &&
-        entries.every((entry) => !Object.hasOwn(entry, 'error'))
-      ) {
-        sharedCatalogRevision = revision;
-        sharedCatalogEntries = entries;
+      if (sharedCatalogPromise === request && catalogKey(registry) === key) {
+        const complete = entries.every(answered);
+        const partial = !complete && entries.some(answered);
+        sharedCatalogKey = complete ? key : null;
+        sharedCatalogEntries = complete ? entries : null;
+        sharedPartialKey = partial ? key : null;
+        sharedPartialEntries = partial ? entries : null;
       }
       return entries;
     })
     .finally(() => {
       if (sharedCatalogPromise === request) {
         sharedCatalogPromise = null;
-        sharedCatalogPromiseRevision = -1;
+        sharedCatalogPromiseKey = null;
+        sharedCatalogPromiseForced = false;
       }
     });
   sharedCatalogPromise = request;

package/src/session-runtime/provider-models/catalog-load.mjs

@@ -17,6 +17,7 @@ export function createCatalogLoader({
   ensureFullConfig,
   awaitKeychainPrewarm,
   ensureProvidersReady,
+  providerTimeoutMs,
 }) {
   function rowsForEntry({ name, models, error, ms }) {
     const out = [];
@@ -76,7 +77,10 @@ export function createCatalogLoader({
   }
 
   /** `request` ({ seq }) identifies the caller's load; `request.complete`
-   *  reports whether every provider answered. */
+   *  reports whether every provider answered, `request.missing` names the
+   *  providers that failed or timed out, `request.partial` marks a load
+   *  where some but not all providers answered, and `request.retryAt` is when
+   *  the first missing provider may be asked again. */
   return async function loadProviderModelsFresh({ forceRefresh = false, loadSecrets = true, request = null } = {}) {
     const startedAt = performance.now();
     profile('load:start', { forceRefresh, loadSecrets });
@@ -93,8 +97,15 @@ export function createCatalogLoader({
     // forward only for the still-current request, never for a superseded load.
     if (ownsLoad) request.seq = caches.providerModelsLoadSeq;
     const seq = request?.seq ?? caches.providerModelsLoadSeq;
-    const catalogEntries = await sharedProviderCatalog(reg());
-    if (request) request.complete = catalogEntries.every((entry) => !Object.hasOwn(entry, 'error'));
+    const catalogEntries = await sharedProviderCatalog(reg(), { force: forceRefresh, timeoutMs: providerTimeoutMs });
+    if (request) {
+      const failed = catalogEntries.filter((entry) => Object.hasOwn(entry, 'error'));
+      request.missing = failed.map((entry) => entry.name);
+      request.complete = failed.length === 0;
+      request.partial = !request.complete && failed.length < catalogEntries.length;
+      // The shared, process-wide backoff of the soonest missing provider.
+      request.retryAt = request.partial ? Math.min(...failed.map((entry) => entry.retryAt)) : null;
+    }
     const results = [];
     const seen = new Set();
     for (const row of catalogEntries.flatMap(rowsForEntry)) {

package/src/session-runtime/provider-models/row-hydration.mjs

@@ -69,6 +69,10 @@ export function hydrateProviderModelRow(cfg, row) {
     savedModelParameters: saved.modelParameters || {},
     savedContextPercent: Number(saved.contextPercent) || undefined,
     savedContextTokens: Number(saved.contextTokens) || undefined,
+    // Model management: an explicit /model visibility choice and the favorite
+    // mark (absent = the picker's default listing, not a favorite).
+    ...(typeof saved.hidden === 'boolean' ? { savedHidden: saved.hidden } : {}),
+    ...(saved.favorite === true ? { favorite: true } : {}),
   };
 }
 

package/src/session-runtime/provider-models.mjs

@@ -10,6 +10,7 @@
 //   row-hydration      — saved model settings layered onto catalog rows
 //   web-search-catalog — the native web-search model list
 //   catalog-load       — one authoritative provider catalog load
+import { PROVIDER_CATALOG_RETRY_MS } from './provider-catalog-cache.mjs';
 import { createCatalogLoader } from './provider-models/catalog-load.mjs';
 import { createModelMetaIndex, modelMetaKey } from './provider-models/model-meta.mjs';
 import { createRowHydration } from './provider-models/row-hydration.mjs';
@@ -19,6 +20,25 @@ const PROVIDER_MODELS_PROFILE_ENABLED = /^(1|true|yes|on)$/i.test(
   String(process.env.MIXDOG_PROVIDER_MODELS_PROFILE || process.env.MIXDOG_BOOT_PROFILE || '')
 );
 
+/** How long a partial catalog (some provider failed or timed out) is served
+ *  as-is before a read retries the missing providers in the background. The
+ *  backoff is process-wide (provider-catalog-cache.mjs), not per session. */
+export const PARTIAL_CATALOG_RETRY_MS = PROVIDER_CATALOG_RETRY_MS;
+
+/** Rows of a partial answer say so explicitly, on quick and full reads alike:
+ *  `catalogPartial`, the `catalogMissing` providers and `catalogRetryAt`
+ *  (epoch ms) after which a reader should ask again. Complete answers carry
+ *  none of these. */
+function withCatalogState(models, partial) {
+  if (!partial) return models;
+  return models.map((row) => ({
+    ...row,
+    catalogPartial: true,
+    catalogMissing: [...partial.missing],
+    catalogRetryAt: partial.retryAt,
+  }));
+}
+
 export function createProviderModels({
   caches,
   modelMetaByRoute,
@@ -37,6 +57,8 @@ export function createProviderModels({
   scheduleProviderModelWarmup,
   // Quick-row helpers wired in after createQuickModelRows resolves.
   quickHelpers,
+  // Per-provider model-list bound; defaults to PROVIDER_CATALOG_TIMEOUT_MS.
+  providerCatalogTimeoutMs,
 }) {
   const config = () => getConfig();
   const route = () => getRoute();
@@ -66,17 +88,56 @@ export function createProviderModels({
     collectProviderModels,
     ...readiness,
   });
-  const loadProviderModelsFresh = createCatalogLoader({ caches, config, reg, meta, rows, profile, ...readiness });
+  const loadProviderModelsFresh = createCatalogLoader({
+    caches,
+    config,
+    reg,
+    meta,
+    rows,
+    profile,
+    providerTimeoutMs: providerCatalogTimeoutMs,
+    ...readiness,
+  });
+
+  // Partial-catalog state of a loaded rows array, for readers that joined the
+  // shared load instead of reading the adopted cache.
+  const partialLoads = new WeakMap();
+  const partialOf = (request) => (request.partial ? { missing: request.missing, retryAt: request.retryAt } : null);
 
   function adoptProviderModelCache(models, request, loadSecrets = true) {
     const revision = meta.syncCatalogRevision();
-    // No-secrets and failed loads may be partial. Keep them retryable rather
-    // than turning a transient failure into an authoritative empty catalog.
-    if (request.seq === caches.providerModelsLoadSeq && loadSecrets && request.complete) {
-      caches.providerModelsCache = { models, at: Date.now(), revision };
+    const partial = partialOf(request);
+    if (partial) partialLoads.set(models, partial);
+    if (request.seq !== caches.providerModelsLoadSeq || !loadSecrets) return;
+    const at = Date.now();
+    if (request.complete) {
+      caches.providerModelsCache = { models, at, revision };
+    } else if (partial) {
+      // Some providers answered. Serving that answer beats reloading every
+      // provider on each read while one is down; it stays marked partial and
+      // its missing providers are retried once the shared backoff passes. A
+      // no-secrets, empty or all-failed load stays uncached and retryable
+      // rather than becoming an authoritative empty catalog.
+      caches.providerModelsCache = { models, at, revision, partial: true, ...partial };
     }
   }
 
+  /** Background refill of a partial catalog: only its missing providers are
+   *  asked again (provider-catalog-cache keeps the ones that answered, and
+   *  holds back providers still inside the shared backoff), and readers keep
+   *  the partial rows until the refill lands. */
+  function refillPartialCatalog(cached) {
+    if (!cached.partial || Date.now() < cached.retryAt || caches.providerModelsPromise) return;
+    profile('partial:retry', { missing: cached.missing.join(',') });
+    startSharedLoad({
+      loadSecrets: true,
+      onFailed: (err) => {
+        profile('partial:retry-failed', { error: err instanceof Error ? err.message : String(err) });
+        return cached.models;
+      },
+    });
+  }
+
   /** The shared in-flight load every concurrent reader joins. `onFailed`, when
    *  given, is part of the shared promise so joiners see its value too;
    *  `caches.providerModelsPromise` is cleared once it settles so a later read
@@ -97,13 +158,17 @@ export function createProviderModels({
 
   async function collectProviderModels({ force = false, quick = false } = {}) {
     meta.syncCatalogRevision();
-    if (!force && Array.isArray(caches.providerModelsCache.models)) {
-      const models = rows.providerModelsFromCacheRows(caches.providerModelsCache.models);
+    const cached = caches.providerModelsCache;
+    if (!force && Array.isArray(cached.models)) {
+      refillPartialCatalog(cached);
+      const models = rows.providerModelsFromCacheRows(cached.models);
       // A quick read answered from the loaded catalog already IS the full
       // catalog. Saying so lets a caller skip the full read it would otherwise
       // follow up with (a phone paid the whole catalog twice at boot). Only
       // this answer carries the mark: a full read is complete by definition,
-      // and an unmarked quick answer keeps meaning "follow up".
+      // and an unmarked quick answer keeps meaning "follow up". A partial
+      // catalog is never marked complete; it carries its partial state.
+      if (cached.partial) return withCatalogState(models, cached);
       return quick ? models.map((row) => ({ ...row, catalogComplete: true })) : models;
     }
     if (!force && quick) {
@@ -117,10 +182,11 @@ export function createProviderModels({
       const request = { seq: ++caches.providerModelsLoadSeq };
       const models = await loadProviderModelsFresh({ forceRefresh: true, loadSecrets: true, request });
       adoptProviderModelCache(models, request);
-      return rows.providerModelsFromCacheRows(models);
+      return withCatalogState(rows.providerModelsFromCacheRows(models), partialOf(request));
     }
     if (!caches.providerModelsPromise) startSharedLoad({ loadSecrets: true });
-    return rows.providerModelsFromCacheRows(await caches.providerModelsPromise);
+    const loaded = await caches.providerModelsPromise;
+    return withCatalogState(rows.providerModelsFromCacheRows(loaded), partialLoads.get(loaded));
   }
 
   function warmProviderModelCache({ loadSecrets = false } = {}) {

package/src/session-runtime/provider-readiness.mjs

@@ -5,6 +5,7 @@
 // registry import and the provider-models factory resolve after this gate is
 // created, while ensureProvidersReady only reaches them on demand.
 import { bootProfile } from './boot-profile.mjs';
+import { invalidateSharedProviderCatalog } from './provider-catalog-cache.mjs';
 import { providerInitCacheKey } from './provider-init-key.mjs';
 
 const KEYCHAIN_PREWARM_WAIT_MS = 5000;
@@ -52,6 +53,9 @@ export function createProviderReadiness({ rt, keychain, getReg, getWarmProviderM
   const providerInitPromises = new Map();
 
   function invalidateProviderCaches(options = {}) {
+    // Auth/account/config changes alter what providers list: the process-wide
+    // catalog (partial rows and retry backoffs included) starts a new epoch.
+    invalidateSharedProviderCatalog();
     Object.assign(providerModelCaches, emptyModelCaches());
     providerModelCaches.providerModelsLoadSeq += 1;
     Object.assign(providerUsageCaches, emptyUsageCaches());

package/src/session-runtime/resource-api.mjs

@@ -30,6 +30,11 @@ export function createResourceApi(deps) {
       if (!EXTENSION_SCOPE_KINDS.includes(scopeKind)) {
         throw new Error(`extension scope kind must be one of ${EXTENSION_SCOPE_KINDS.join(', ')}`);
       }
+      // A connector is on in every project unless a project switches it off
+      // (setProjectConnectorEnabled); "only in this project" no longer exists.
+      if (scopeKind === 'mcp') {
+        throw new Error('MCP servers are switched off per project in Project settings (setProjectConnectorEnabled)');
+      }
       let key = clean(name);
       if (!key) throw new Error('extension name is required');
       // Plugin scopes are keyed by registry id; a name must resolve to it.

package/src/session-runtime/resource-mcp-api.mjs

@@ -11,6 +11,9 @@ import { resolveMcpOAuthUrl } from '../runtime/agent/orchestrator/mcp/client-con
 import { withAdoptedCopies, withPinnedCollisionNames, withPluginServerIntent } from './mcp-glue/plugin-servers.mjs';
 import { findRegisteredPlugin } from './resource-plugins-api.mjs';
 import { createMcpOAuthLogins } from './mcp-oauth-login.mjs';
+import { connectorById, gmailAppPasswordAccount, gmailAppPasswordValue } from '../runtime/shared/connector-catalog.mjs';
+import { saveMcpOAuthClientSecret } from '../runtime/agent/orchestrator/mcp/oauth-client.mjs';
+import { forgetGmailAppPassword, saveGmailAppPassword } from '../runtime/connectors/gmail-app-password.mjs';
 
 /** The URL a server's OAuth credentials are stored under, or null. */
 function oauthUrlOf(cfg) {
@@ -83,8 +86,17 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     completeMcpLogin,
     getMcpServerOAuthState = () => null,
     probeMcpServerAuth,
+    startMcpServerOAuthSwitch,
+    commitMcpServerOAuthSwitch,
+    gmailAppPassword = { save: saveGmailAppPassword, forget: forgetGmailAppPassword },
+    saveOAuthClientSecret = saveMcpOAuthClientSecret,
   } = deps;
 
+  const reconnectOne = async (name) => {
+    const status = await connectConfiguredMcp({ only: name, enabled: true });
+    const row = status?.servers?.find((server) => server.name === name);
+    return { connected: row?.connected === true, error: row?.error || null };
+  };
   // Explicit OAuth sign-in: the one interactive MCP connect. On success the
   // other runtimes reconnect the server non-interactively with the new tokens.
   const oauthLogins = createMcpOAuthLogins({
@@ -95,6 +107,22 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     },
     cancel: (name) => cancelMcpLogin(name),
     completeCallback: completeMcpLogin,
+    // 계정 바꾸기, transactionally: the working connection stays until the new
+    // sign-in succeeded and connects; a cancel or failure changes nothing, and
+    // a new sign-in that cannot connect is rolled back.
+    async switchAccount(name, launch, attempt) {
+      const cfg = resolveMcpCatalog().servers[name];
+      const switching = startMcpServerOAuthSwitch(cfg, launch, name);
+      attempt.abort = () => switching.cancel();
+      attempt.answer = (callbackUrl) => switching.answer(callbackUrl);
+      const signIn = await switching.done;
+      const rollback = await commitMcpServerOAuthSwitch(cfg, signIn);
+      const outcome = await reconnectOne(name);
+      if (outcome.connected) return outcome;
+      await rollback();
+      await reconnectOne(name);
+      return { connected: false, error: outcome.error || 'The new sign-in could not connect' };
+    },
     onComplete: (name) => sync.announce('mcp', { detail: { mcpChanges: [{ name, enabled: true }] } }),
   });
   /** The effective config of a server that signs in with MCP OAuth (HTTP/SSE
@@ -130,6 +158,49 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     const owned = name ? pluginMcpServer(name) : null;
     if (owned) throw pluginOwnedError(name, owned.owner);
   };
+  // The user's OAuth client secret (custom connector → 고급 설정 → 비밀값)
+  // goes to the keychain only; clearing the client id forgets it.
+  const storeOAuthClientSecret = async (input, cfg, previous = {}) => {
+    if (!cfg?.url) return;
+    const secret = typeof input.oauthClientSecret === 'string' ? input.oauthClientSecret.trim() : '';
+    if (cfg.oauthClientId && secret) await saveOAuthClientSecret(cfg.url, secret);
+    else if (!cfg.oauthClientId && previous.oauthClientId) await saveOAuthClientSecret(previous.url || cfg.url, '');
+  };
+  // Gmail with an app password (connector-catalog.mjs GMAIL_APP_PASSWORD): the
+  // password is checked with Gmail before anything is saved and goes to the
+  // keychain only. A new connection needs one; an edit without one keeps it.
+  const storeGmailAppPassword = async (input, cfg, required) => {
+    const account = gmailAppPasswordAccount(cfg);
+    if (!account) return;
+    const password = gmailAppPasswordValue(input.appPassword);
+    if (password) await gmailAppPassword.save(account, password);
+    else if (required || input.appPassword !== undefined) {
+      throw new Error('GMAIL_APP_PASSWORD_FORMAT: An app password has 16 characters.');
+    }
+  };
+  // A server's OAuth tokens and client registration go with it, unless another
+  // configured server (plugin or disabled ones included, even with MCP
+  // disabled for this runtime) still uses them through the same exact URL.
+  // `signIn` tells the caller what happened to the sign-in: `removed` (local
+  // secrets deleted, `revoked` when the provider confirmed the revocation
+  // too), `shared` (another server still uses it), or none (null).
+  const releaseOAuth = async (cfg) => {
+    const url = oauthUrlOf(cfg);
+    if (!url) return null;
+    if (Object.values(resolveConfiguredMcpCatalog().servers).some((other) => oauthUrlOf(other) === url)) {
+      return { signIn: 'shared', revoked: false };
+    }
+    const { revoked = false } = (await clearMcpServerOAuth(cfg, { revoke: true })) || {};
+    return { signIn: 'removed', revoked };
+  };
+  // An app password is deleted once no configured server uses its account.
+  const forgetUnusedGmailAppPassword = async (account) => {
+    if (!account) return false;
+    const servers = Object.values(resolveConfiguredMcpCatalog().servers);
+    if (servers.some((cfg) => gmailAppPasswordAccount(cfg) === account)) return false;
+    await gmailAppPassword.forget(account);
+    return true;
+  };
   // Peers reload config from disk on receipt: land the write before publishing.
   const persisted = async () => {
     await flushSkillsSave?.();
@@ -164,11 +235,18 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     async beginMcpOAuthLogin(name, options = {}) {
       const { serverName, cfg } = await oauthServerConfig(name);
       if (cfg.enabled === false) throw new Error(`MCP server is disabled: ${serverName}`);
+      // `mode`: `connect` (a normal authorization), `reauth` (repair the same
+      // connection; a refresh is tried first) or `switch` (계정 바꾸기).
+      if (options?.mode === 'switch' && !getMcpServerOAuthState(cfg)?.signedIn) {
+        throw new Error(`MCP server "${serverName}" is not signed in`);
+      }
       return oauthLogins.begin(serverName, options);
     },
-    /** `{ flowId, state: 'pending' | 'complete' | 'failed' | 'cancelled', error? }` */
-    getMcpOAuthLoginStatus(flowId) {
-      return oauthLogins.status(flowId);
+    /** `{ flowId, state: 'pending' | 'complete' | 'failed' | 'cancelled',
+     *  step?, error?, reason? }`; with `{ since, waitMs }` it resolves on the
+     *  flow's next change (mcp-oauth-login.mjs). */
+    getMcpOAuthLoginStatus(flowId, options) {
+      return oauthLogins.status(flowId, options);
     },
     cancelMcpOAuthLogin(flowId) {
       return oauthLogins.cancel(flowId);
@@ -186,8 +264,9 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       const { serverName, cfg } = await oauthServerConfig(name);
       // A begin issued meanwhile waits until the credentials are gone.
       return oauthLogins.cancelServer(serverName, async () => {
-        await clearMcpServerOAuth(cfg);
-        return sync.reconnectMcpAndAnnounce({ only: serverName, enabled: cfg.enabled !== false });
+        const { revoked = false } = (await clearMcpServerOAuth(cfg, { revoke: true })) || {};
+        const status = await sync.reconnectMcpAndAnnounce({ only: serverName, enabled: cfg.enabled !== false });
+        return { ...status, revoked };
       });
     },
     /** `{ auth: 'oauth' | 'none' | 'configured' | 'unreachable', error? }` for an
@@ -203,10 +282,18 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     },
     async addMcpServer(input = {}) {
       const { name, config: serverConfig } = normalizeMcpServerInput(input);
+      // A catalog connector's server keeps its catalog id (connector-catalog.mjs).
+      const connector = clean(input.connector);
+      if (connector) {
+        if (!connectorById(connector)) throw new Error(`Unknown connector: ${connector}`);
+        serverConfig.connector = connector;
+      }
       const servers = userServers();
       if (Object.hasOwn(servers, name)) throw new Error(`MCP server already exists: ${name}`);
       const owned = pluginMcpServer(name);
       if (owned) throw new Error(`MCP server already exists: ${name} (provided by plugin "${owned.owner.id}")`);
+      await storeOAuthClientSecret(input, serverConfig);
+      await storeGmailAppPassword(input, serverConfig, true);
       saveServers({ ...servers, [name]: serverConfig });
       const status = await sync.reconnectMcpAndAnnounce({ only: name, enabled: serverConfig.enabled !== false });
       return { name, status };
@@ -232,7 +319,14 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       }
       if (originalName && originalName !== name) delete servers[originalName];
       servers[name] = mergeMcpServerConfig(existing, normalizedInput.config);
+      await storeOAuthClientSecret(input, servers[name], existing);
+      await storeGmailAppPassword(input, servers[name], false);
       saveServers(servers);
+      const previousAccount = gmailAppPasswordAccount(existing);
+      const account = gmailAppPasswordAccount(servers[name]);
+      if (previousAccount !== account) await forgetUnusedGmailAppPassword(previousAccount);
+      // Gmail switched from the Google sign-in to an app password keeps no sign-in.
+      if (account && !previousAccount) await releaseOAuth(existing);
       const status = await sync.reconnectMcpAndAnnounce({
         only: name,
         enabled: servers[name].enabled !== false,
@@ -252,15 +346,15 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       delete servers[serverName];
       saveServers(servers);
       const status = await sync.reconnectMcpAndAnnounce({ drop: [serverName] });
-      // A removed server keeps no OAuth tokens or client registration, unless
-      // another configured server (plugin or disabled ones included, even
-      // with MCP disabled for this runtime) still uses them through the same
-      // exact URL.
-      const url = oauthUrlOf(removed);
-      if (url && !Object.values(resolveConfiguredMcpCatalog().servers).some((cfg) => oauthUrlOf(cfg) === url)) {
-        await clearMcpServerOAuth(removed);
+      // A removed server keeps no sign-in another server does not share: an
+      // app password leaves the keychain (it is revoked at Google only).
+      const account = gmailAppPasswordAccount(removed);
+      if (account) {
+        const forgotten = await forgetUnusedGmailAppPassword(account);
+        return { ...status, signIn: forgotten ? 'removed' : 'shared', revoked: false };
       }
-      return status;
+      const released = await releaseOAuth(removed);
+      return released ? { ...status, ...released } : status;
     },
     async setMcpServerEnabled(name, enabled) {
       const serverName = clean(name);

package/src/session-runtime/resource-skills-api.mjs

@@ -24,6 +24,7 @@ export function createSkillsResourceApi({ deps, sync, decorate }) {
     skillContent,
     addGlobalSkill,
     saveSkillDocument,
+    removeGlobalSkill,
     invalidateSkills,
     getDisabledSkills,
     setDisabledSkills,
@@ -56,6 +57,17 @@ export function createSkillsResourceApi({ deps, sync, decorate }) {
       await sync.announce('skills', { invalidate: false });
       return { skill, status: skillsStatus() };
     },
+    async removeSkill(input = {}) {
+      const removed = removeGlobalSkill(input);
+      // A removed skill leaves no stale disabled entry behind.
+      const disabled = getDisabledSkills?.().disabled;
+      if (Array.isArray(disabled) && disabled.includes(removed.name)) {
+        setDisabledSkills?.(disabled.filter((name) => name !== removed.name));
+        await flushSkillsSave?.();
+      }
+      await sync.announce('skills');
+      return { skill: removed, status: skillsStatus() };
+    },
     async setDisabledSkills(names = []) {
       const result = setDisabledSkills?.(names);
       await flushSkillsSave?.();