mixdog 1.2.6 → 1.3.1

package/src/runtime/shared/connector-catalog.mjs

@@ -0,0 +1,228 @@
+// The built-in connector catalog: services a user connects with one click
+// from Desktop (Extensions → 커넥터) or from a chat card the setup tool's
+// `connect_connector` action surfaces. Each entry declares its backend
+// explicitly:
+//   oauth   — a remote MCP server that signs in with MCP OAuth;
+//   apiKey  — an MCP server that takes one key (an HTTP header or a stdio
+//             environment variable).
+// GitHub is not a connector: it is the signed-in GitHub CLI (github tool).
+// A connected catalog service is an ordinary user MCP server whose config
+// carries `connector: <id>`. An existing custom server is never adopted into
+// the catalog row.
+
+import { connectorTrigger } from './connector-triggers.mjs';
+
+// `oauthClient` names a pre-registered client the runtime supplies
+// (mcp/oauth-client.mjs: 'google') in place of dynamic client registration;
+// `scopes` are then the ones requested.
+const oauth = (url, client = {}) => Object.freeze({ kind: 'oauth', url, ...client });
+
+const GOOGLE_SCOPE = 'https://www.googleapis.com/auth';
+// The Google access each built-in connector asks for: the one place to widen
+// it (e.g. gmail.readonly). openid + email name the signed-in account.
+export const GOOGLE_SCOPES = Object.freeze({
+  gmail: Object.freeze(['openid', 'email', `${GOOGLE_SCOPE}/gmail.send`]),
+  calendar: Object.freeze(['openid', 'email', `${GOOGLE_SCOPE}/calendar.events`]),
+  drive: Object.freeze(['openid', 'email', `${GOOGLE_SCOPE}/drive.file`]),
+});
+// Gmail / Calendar / Drive are Mixdog's built-in Google connectors
+// (runtime/connectors/google-mcp.mjs), answered in-process at a reserved
+// address and signed in with Mixdog's Google client. `askTools` ask before
+// they run unless the agent set them.
+const google = (service, scopes, askTools) =>
+  oauth(`https://${service}.mixdog.invalid/mcp`, { oauthClient: 'google', scopes, askTools });
+// Gmail can also connect with a Google app password instead of the sign-in:
+// IMAP and SMTP over TLS (runtime/connectors/gmail-app-password.mjs), answered
+// in-process at its own reserved address. Its server is still the Gmail
+// connector (`connector: 'gmail'`, so Gmail's askTools apply to its tools of
+// the same names); the account rides in a header, the app password lives only
+// in the keychain.
+export const GMAIL_APP_PASSWORD = Object.freeze({
+  url: 'https://gmail-imap.mixdog.invalid/mcp',
+  accountHeader: 'X-Mixdog-Gmail-Account',
+  helpUrl: 'https://myaccount.google.com/apppasswords',
+});
+const apiKey = (spec) => Object.freeze({ kind: 'apiKey', ...spec });
+
+export const CONNECTOR_CATALOG = Object.freeze(
+  [
+    { id: 'airtable', name: 'Airtable', backend: oauth('https://mcp.airtable.com/mcp') },
+    { id: 'confluence', name: 'Confluence', backend: oauth('https://mcp.atlassian.com/v1/mcp/authv2') },
+    { id: 'dropbox', name: 'Dropbox', backend: oauth('https://mcp.dropbox.com/mcp') },
+    {
+      id: 'gmail',
+      name: 'Gmail',
+      backend: google('gmail', GOOGLE_SCOPES.gmail, ['send_email']),
+    },
+    // Calendar and Drive are offered only to a user who entered their own
+    // Google OAuth client (Connectors → add custom → 내 Google 키): `ownKey`.
+    // Existing connections keep working; Mixy and the chat cards never offer them.
+    {
+      id: 'google-calendar',
+      name: 'Google Calendar',
+      ownKey: true,
+      backend: google('calendar', GOOGLE_SCOPES.calendar, ['delete_event']),
+    },
+    {
+      id: 'google-drive',
+      name: 'Google Drive',
+      ownKey: true,
+      backend: google('drive', GOOGLE_SCOPES.drive, []),
+    },
+    {
+      id: 'hugging-face',
+      name: 'Hugging Face',
+      backend: apiKey({
+        url: 'https://huggingface.co/mcp',
+        header: 'Authorization',
+        prefix: 'Bearer ',
+        keyUrl: 'https://huggingface.co/settings/tokens',
+      }),
+    },
+    { id: 'jira', name: 'Jira', backend: oauth('https://mcp.atlassian.com/v1/mcp/authv2') },
+    { id: 'linear', name: 'Linear', backend: oauth('https://mcp.linear.app/mcp') },
+    { id: 'notion', name: 'Notion', backend: oauth('https://mcp.notion.com/mcp') },
+    {
+      id: 'postgres',
+      name: 'Postgres',
+      backend: apiKey({
+        command: 'npx',
+        args: ['-y', '@microsoft/postgres-mcp@0.2.0', 'run'],
+        env: 'POSTGRES_MCP_CONNECTION_STRING',
+        keyUrl: 'https://github.com/microsoft/postgres-mcp/blob/main/USAGE.md',
+        placeholder: 'postgresql://user:password@host:5432/db',
+      }),
+    },
+    { id: 'sentry', name: 'Sentry', backend: oauth('https://mcp.sentry.dev/mcp') },
+    {
+      id: 'stripe',
+      name: 'Stripe',
+      backend: apiKey({
+        url: 'https://mcp.stripe.com',
+        header: 'Authorization',
+        prefix: 'Bearer ',
+        keyUrl: 'https://dashboard.stripe.com/apikeys',
+        placeholder: 'rk_live_…',
+      }),
+    },
+    { id: 'supabase', name: 'Supabase', backend: oauth('https://mcp.supabase.com/mcp') },
+    { id: 'trello', name: 'Trello', backend: oauth('https://mcp.trello.com/v1') },
+    { id: 'vercel', name: 'Vercel', backend: oauth('https://mcp.vercel.com') },
+    // The ids are the deferred-tool manifest's curated keys: a server named by
+    // its id gets that one-line trigger (connector-triggers.mjs).
+  ].map((entry) => Object.freeze({ ...entry, trigger: connectorTrigger(entry.id) }))
+);
+
+/** The ids offered to everyone (the setup tool's `connect_connector`): the
+ *  catalog minus the own-key-only Google services. */
+export const CONNECTOR_IDS = Object.freeze(CONNECTOR_CATALOG.filter((entry) => !entry.ownKey).map((entry) => entry.id));
+
+/** The catalog entry for `id`, or null. */
+export function connectorById(id) {
+  return CONNECTOR_CATALOG.find((entry) => entry.id === id) || null;
+}
+
+const urlKey = (url) =>
+  String(url || '')
+    .trim()
+    .replace(/\/+$/, '')
+    .toLowerCase();
+
+/** The catalog id a configured MCP server connects: its `connector` marker,
+ *  '' for none (or a marker the catalog no longer knows). */
+export function connectorOfServer(cfg) {
+  const marker = typeof cfg?.connector === 'string' ? cfg.connector : '';
+  return connectorById(marker) ? marker : '';
+}
+
+/** The permission a catalog connector's tool has when nothing set its own:
+ *  `needs_approval` for the high-risk tools it names, else `auto`. */
+export function connectorToolDefault(connectorId, tool) {
+  const backend = connectorById(connectorId)?.backend;
+  return backend?.askTools?.includes(tool) ? 'needs_approval' : 'auto';
+}
+
+const EMAIL = /^[^\s@<>(),;:"]+@[^\s@<>(),;:"]+\.[^\s@<>(),;:".]+$/;
+
+/** A Gmail address as typed (trimmed, lowercased), or '' when it is none. */
+export function gmailAddress(value) {
+  const address = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  return EMAIL.test(address) ? address : '';
+}
+
+/** A Google app password as typed, its spaces removed; '' unless it then
+ *  has the 16 characters Google issues. */
+export function gmailAppPasswordValue(value) {
+  const password = String(value ?? '').replace(/\s+/g, '');
+  return password.length === 16 ? password : '';
+}
+
+/** The account of a Gmail app-password server config, '' for any other. */
+export function gmailAppPasswordAccount(cfg) {
+  if (urlKey(cfg?.url) !== urlKey(GMAIL_APP_PASSWORD.url)) return '';
+  const headers = cfg?.headers && typeof cfg.headers === 'object' ? cfg.headers : {};
+  const header = GMAIL_APP_PASSWORD.accountHeader.toLowerCase();
+  const key = Object.keys(headers).find((name) => name.toLowerCase() === header);
+  return key ? gmailAddress(headers[key]) : '';
+}
+
+/** The MCP server input that connects Gmail under `name` as `email` with an
+ *  app password. `appPassword` only travels to the host, which checks it
+ *  with Gmail and keeps it in the keychain; it never reaches the config. */
+export function gmailAppPasswordServerInput(name, email, password) {
+  const address = gmailAddress(email);
+  if (!address) throw new Error('GMAIL_APP_PASSWORD_ADDRESS: Enter a Gmail address.');
+  const appPassword = gmailAppPasswordValue(password);
+  if (!appPassword) throw new Error('GMAIL_APP_PASSWORD_FORMAT: An app password has 16 characters.');
+  return {
+    name,
+    type: 'http',
+    url: GMAIL_APP_PASSWORD.url,
+    headers: { [GMAIL_APP_PASSWORD.accountHeader]: address },
+    connector: 'gmail',
+    appPassword,
+  };
+}
+
+/** Whether several accounts of catalog connector `entry` can be connected at
+ *  once: Gmail (also by app password), Calendar and Drive with the Google
+ *  sign-in. Other remote servers keep one (their tokens and URL are shared). */
+export function connectorMultiAccount(entry) {
+  return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
+}
+
+/** The MCP server input that connects catalog entry `entry` under `name`
+ *  (oauth / apiKey); `key` fills an apiKey backend; `extraAccount`
+ *  makes it one more account of a multi-account connector. */
+export function connectorServerInput(entry, name, key = '', { extraAccount = false } = {}) {
+  const { backend } = entry;
+  if (backend.kind === 'oauth') {
+    // Tokens are stored per exact server URL, so another account of the same
+    // connector needs its own URL; the in-process Google servers ignore the query.
+    const url =
+      extraAccount && connectorMultiAccount(entry) ? `${backend.url}?account=${encodeURIComponent(name)}` : backend.url;
+    return { name, type: 'http', url, connector: entry.id };
+  }
+  if (backend.kind !== 'apiKey') throw new Error(`${entry.name} is not an MCP connector`);
+  const value = String(key || '').trim();
+  if (!value) throw new Error(`${entry.name} needs a key`);
+  if (backend.url) {
+    return {
+      name,
+      type: 'http',
+      url: backend.url,
+      headers: { [backend.header]: `${backend.prefix || ''}${value}` },
+      connector: entry.id,
+    };
+  }
+  return {
+    name,
+    type: 'stdio',
+    command: backend.command,
+    args: [...backend.args],
+    env: { [backend.env]: value },
+    connector: entry.id,
+  };
+}

package/src/runtime/shared/connector-triggers.d.mts

@@ -0,0 +1,3 @@
+export declare const CONNECTOR_TRIGGER_MAX_CHARS: number;
+export declare const CONNECTOR_TRIGGERS: Readonly<Record<string, string>>;
+export declare function connectorTrigger(serverId: string): string;

package/src/runtime/shared/connector-triggers.mjs

@@ -0,0 +1,45 @@
+// Curated selection triggers for catalog connectors (MCP servers). A catalog
+// entry carries its line as `trigger`; the deferred-tool manifest lists each
+// connected server once as `- mcp__<server id>: <trigger>`, so one line must
+// say what the connector is for (plus a close negative where useful), in
+// English, at most CONNECTOR_TRIGGER_MAX_CHARS characters.
+export const CONNECTOR_TRIGGER_MAX_CHARS = 100;
+
+export const CONNECTOR_TRIGGERS = Object.freeze({
+  // Not a catalog connector (Mixdog uses the signed-in GitHub CLI), but a
+  // user-added `github` MCP server still gets this line.
+  github: 'GitHub repos, issues, pull requests, Actions and code search; not local Git history or diffs.',
+  notion: 'Notion pages, databases and workspace search; create or update team docs and notes.',
+  linear: 'Linear issues, projects, cycles and comments; create, triage or update tickets.',
+  sentry: 'Sentry issues, events, stack traces and releases; triage production errors.',
+  gmail: 'Gmail: send email; with an app password also search, read, archive, label, star, trash.',
+  'google-calendar': 'Google Calendar events on the primary calendar; list, search, create, update or delete.',
+  'google-drive': 'Google Drive files Mixdog created or was given; search, read or create; not local files.',
+  jira: 'Jira issues, projects, sprints and comments; JQL search, create or transition tickets.',
+  confluence: 'Confluence spaces and pages; search, read or edit the team wiki; not Jira tickets.',
+  dropbox: 'Dropbox files and folders; search, read, upload or share cloud files; not local files.',
+  trello: 'Trello boards, lists and cards; create, move or update cards.',
+  airtable: 'Airtable bases, tables and records; query, create or update rows.',
+  stripe: 'Stripe customers, payments, invoices, subscriptions and refunds; billing data and actions.',
+  vercel: 'Vercel projects, deployments, domains and logs; deploy status and build errors.',
+  supabase: 'Supabase projects: Postgres tables and SQL, auth, storage and edge functions.',
+  postgres: 'PostgreSQL schemas, tables and SQL queries on a connected database; not local files.',
+  'hugging-face': 'Hugging Face Hub models, datasets, Spaces and papers; not local GGUF model setup.',
+});
+
+// Server ids differ only in separators and case (google_calendar, huggingface).
+const triggerKey = (id) =>
+  String(id || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, '');
+const TRIGGERS_BY_KEY = new Map(Object.entries(CONNECTOR_TRIGGERS).map(([id, line]) => [triggerKey(id), line]));
+
+/** The curated trigger of the catalog connector `serverId`, or ''. */
+export function connectorTrigger(serverId) {
+  // Another account of a connector is named `<id>-2`, `<id>-3`…
+  return (
+    TRIGGERS_BY_KEY.get(triggerKey(serverId)) ||
+    TRIGGERS_BY_KEY.get(triggerKey(String(serverId || '').replace(/[-_]\d+$/, ''))) ||
+    ''
+  );
+}

package/src/runtime/shared/err-text.mjs

@@ -237,7 +237,9 @@ function typedStreamFailureText(error, text) {
 
 export function presentErrorText(error, options = {}) {
   const presentation = describeError(error);
-  if (['image-size', 'payload-size', 'request'].includes(presentation.kind)) return presentation.summary;
+  if (['image-size', 'payload-size', 'request', 'model-unavailable', 'tool-schema'].includes(presentation.kind)) {
+    return presentation.summary;
+  }
   const kindLine = hasTypedEvidence(error) ? KIND_LINES[presentation.providerKind] : null;
   if (kindLine && presentation.kind !== 'unknown') {
     return typeof kindLine === 'function' ? kindLine(presentation) : kindLine;

package/src/runtime/shared/error-presentation.mjs

@@ -138,6 +138,77 @@ function resetLabel(resetAt) {
   return reset.toDateString() === new Date().toDateString() ? time : `${reset.getMonth() + 1}/${reset.getDate()} ${time}`;
 }
 
+// A refused request that names its model as unknown, retired or not offered
+// to this account. Read only for request-refusal kinds, so a typed overload,
+// quota or auth failure never reads as a missing model.
+const MODEL_REFUSAL_KINDS = new Set(['invalid_request', 'permission', 'unknown']);
+const MODEL_UNAVAILABLE_CODES = new Set(['model_not_found', 'model_not_supported']);
+// The model must be the subject of the refusal, at the start of a line or
+// sentence ("The model `x` does not exist", "models/x is not found", Ollama's
+// `model "x" not found`), or the refusal names it ("Unknown model", "… is not
+// a valid model ID", Anthropic's bare "model: x"). A model merely mentioned
+// beside some other missing thing ("For model x, tool lookup: route not
+// found") does not count.
+const MODEL_REFUSAL_PREDICATE =
+  "(?:(?:is|was|has been)\\s+)?(?:not found|does not exist|doesn'?t exist|not (?:supported|available)|(?:currently\\s+)?unavailable|no longer (?:available|supported)|deprecated|retired|removed)\\b";
+const SENTENCE_START = '(?:^|[.:;!]\\s+)';
+const MODEL_UNAVAILABLE_RE = new RegExp(
+  [
+    // "The model `x` does not exist", "models/x is not found", Vertex
+    // "Publisher Model `…` was not found", Ollama `model "x" not found`.
+    `${SENTENCE_START}(?:(?:the|this|that|requested|selected|publisher)\\s+)*models?(?:\\/\\S+|\\s+[\`'"]?[\\w./:@-]+[\`'"]?)?\\s+${MODEL_REFUSAL_PREDICATE}`,
+    // OpenAI "The 'gpt-x' model is not supported when using Codex …".
+    `${SENTENCE_START}(?:the\\s+)?[\`'"][^\`'"\\n]+[\`'"]\\s+model\\s+${MODEL_REFUSAL_PREDICATE}`,
+    `${SENTENCE_START}(?:unknown|invalid|unsupported) model\\b`,
+    // OpenRouter: no provider serves this model id.
+    `${SENTENCE_START}no endpoints found for [\\w.-]+\\/[\\w.:-]+`,
+    '\\bis not a valid model\\b',
+    '^model: \\S+$',
+  ].join('|'),
+  'im'
+);
+
+/**
+ * True when `error` (or its text) says the requested model is unknown,
+ * retired or not offered to this account: a typed model code, or provider
+ * wording with the model as the subject of the refusal.
+ */
+export function namesUnavailableModel(error) {
+  if (!error) return false;
+  if (typeof error === 'string') return MODEL_UNAVAILABLE_RE.test(error);
+  const codes = [error.code, error.providerErrorCode, error.error?.code, error.providerError?.code];
+  if (codes.some((code) => MODEL_UNAVAILABLE_CODES.has(String(code || '').toLowerCase()))) return true;
+  return [error.message, error.error?.message, error.providerError?.message, error.detail]
+    .filter((text) => typeof text === 'string' && text)
+    .some((text) => MODEL_UNAVAILABLE_RE.test(text));
+}
+const MODEL_UNAVAILABLE_COPY = [
+  'model-unavailable',
+  "This model isn't available for this account.",
+  'Choose another model, or check the model and endpoint in Providers.',
+];
+const NOT_FOUND_SUMMARY = "The provider couldn't find the requested model or endpoint.";
+// A tool definition the provider's schema validator refused (an MCP or custom
+// tool schema), named by the field path or wording each API uses.
+const TOOL_SCHEMA_RE =
+  /invalid schema for (?:function|tool)\b|\btools\.\d+\.(?:custom\.)?input_schema\b|\bfunction_declarations\[\d+\]\.parameters\b|\btools\[\d+\]\.function\.parameters\b|\binvalid (?:tool|function) (?:schema|parameters|definition)\b/i;
+const TOOL_SCHEMA_COPY = [
+  'tool-schema',
+  'The provider rejected a tool definition.',
+  'Disable the tool or MCP server named in the details, then try again.',
+];
+
+// The first line of a provider message worth showing as-is; '' for a stack
+// frame, a markup page or a raw JSON body.
+function firstReadableLine(clean) {
+  const lines = clean
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean);
+  const first = lines.find((line) => !/^at\s|^\{|^<!doctype|^<html/i.test(line)) || '';
+  return first && !/^[{[]|^<|(?:API|HTTP)\s+[45]\d\d.*[<{]/i.test(first) ? first : '';
+}
+
 // Only legacy items (no persisted descriptor) and untyped strings reach this.
 const LEGACY_TEXT_KINDS = [
   [/The provider usage limit was reached|quota.*(?:hit|exceed)|usage limit/i, 'quota_exhausted'],
@@ -241,6 +312,25 @@ export function describeError(value) {
     kind = 'image-size';
     summary = 'An attached image exceeds the provider limit.';
     recovery = 'Reduce the image dimensions or number of images, then try again.';
+  } else if (
+    clean === MODEL_UNAVAILABLE_COPY[1] ||
+    (MODEL_REFUSAL_KINDS.has(descriptor.kind) &&
+      (MODEL_UNAVAILABLE_CODES.has(code) || MODEL_UNAVAILABLE_RE.test(clean)))
+  ) {
+    [kind, summary, recovery] = MODEL_UNAVAILABLE_COPY;
+  } else if (
+    clean === TOOL_SCHEMA_COPY[1] ||
+    (['invalid_request', 'unknown'].includes(descriptor.kind) && TOOL_SCHEMA_RE.test(clean))
+  ) {
+    [kind, summary, recovery] = TOOL_SCHEMA_COPY;
+  } else if (
+    clean === NOT_FOUND_SUMMARY ||
+    (MODEL_REFUSAL_KINDS.has(descriptor.kind) && (status === 404 || status === 410))
+  ) {
+    // The provider's own words name what is missing; the next step is the same.
+    kind = 'not-found';
+    summary = firstReadableLine(clean) || NOT_FOUND_SUMMARY;
+    recovery = MODEL_UNAVAILABLE_COPY[2];
   } else if (
     descriptor.kind === 'unknown' &&
     /payload too large|request (?:body )?too large|The request exceeds the size limit/i.test(clean)
@@ -272,12 +362,7 @@ export function describeError(value) {
     summary = 'The provider rejected this request.';
     recovery = 'Review the request details before trying again.';
   } else {
-    const lines = clean
-      .split('\n')
-      .map((line) => line.trim())
-      .filter(Boolean);
-    const first = lines.find((line) => !/^at\s|^\{|^<!doctype|^<html/i.test(line)) || '';
-    summary = first && !/^[{[]|^<|(?:API|HTTP)\s+[45]\d\d.*[<{]/i.test(first) ? first : 'Something went wrong.';
+    summary = firstReadableLine(clean) || 'Something went wrong.';
   }
   summary = summary.replace(/\s+/g, ' ').trim() || 'Something went wrong.';
   if (summary.length > SUMMARY_LIMIT) summary = `${summary.slice(0, SUMMARY_LIMIT - 1).trimEnd()}…`;

package/src/runtime/shared/google-oauth-client.mjs

@@ -0,0 +1,24 @@
+// Mixdog's own Google OAuth client (a "Desktop app" client, marked "Use this
+// client for an AI-powered agent"), used by the Gmail, Google Calendar and
+// Google Drive catalog connectors instead of dynamic client registration,
+// which Google does not offer. Google treats desktop clients as public: the
+// id and its non-confidential secret ship with the app, and every sign-in
+// uses PKCE (S256), state and a loopback redirect
+// (developers.google.com/identity/protocols/oauth2/native-app).
+//
+// The values come only from the environment; the source ships none, so a
+// build without them offers no built-in Google sign-in (the user's own
+// Google client still works).
+
+const value = (name) => String(process.env[name] || '').trim();
+
+/** `{ clientId, clientSecret }` of Mixdog's Google client, or null when this
+ *  build has none. */
+export function googleOAuthClient() {
+  const clientId = value('MIXDOG_GOOGLE_OAUTH_CLIENT_ID');
+  if (!clientId) return null;
+  return { clientId, clientSecret: value('MIXDOG_GOOGLE_OAUTH_CLIENT_SECRET') };
+}
+
+/** Google issues a refresh token only for `access_type=offline`. */
+export const GOOGLE_AUTH_PARAMS = Object.freeze({ access_type: 'offline' });

package/src/runtime/shared/handoff-artifacts.d.mts

@@ -0,0 +1,20 @@
+export interface HandoffFile {
+  name: string;
+  path: string;
+  kind: 'image' | 'file' | 'text';
+  mimeType: string;
+  size: number;
+  /** Attachment-store reference when the file was stored. */
+  id?: string;
+}
+export function normalizeHandoffFiles(files: unknown): HandoffFile[];
+export function artifactLines(files: unknown, omitted?: number, options?: { ids?: boolean }): string[];
+export interface HandoffRecord {
+  id: string;
+  attachmentRef: string;
+  kind: 'image' | 'file' | 'text';
+  name: string;
+  mimeType: string;
+  size: number;
+}
+export function artifactRecords(files: unknown): HandoffRecord[];

package/src/runtime/shared/handoff-artifacts.mjs

@@ -0,0 +1,61 @@
+// The files a bot's or agent's turn handed back (session-runtime/
+// handoff-attachments.mjs collectTurnArtifacts) as the rows that carry them
+// show them: one model-facing line per file — the attachment id that forwards
+// it, or its path when it is too large or of a type no prompt carries — and
+// the message attachment records of the stored ones. Only those records
+// authorize forwarding by id; the lines are information for the model.
+import { escapeHarnessTags } from './shell-output-summary.mjs';
+import { normalizeMessageAttachments } from './transcript-metadata.mjs';
+
+const sizeLabel = (size) => {
+  const bytes = Number(size) || 0;
+  if (bytes >= 1_048_576) return `${(bytes / 1_048_576).toFixed(1)} MB`;
+  return bytes >= 1024 ? `${Math.round(bytes / 1024)} KB` : `${bytes} B`;
+};
+
+const oneLine = (value) => escapeHarnessTags(String(value ?? '').replace(/[\r\n]+/g, ' '));
+
+/** `files` ({ name, mimeType, size, path, id? }) normalized: bounded strings,
+ *  ids only of the attachment-store shape. */
+export function normalizeHandoffFiles(files) {
+  return (Array.isArray(files) ? files : [])
+    .filter((file) => file && typeof file === 'object' && typeof file.path === 'string' && file.path)
+    .slice(0, 8)
+    .map((file) => ({
+      name: String(file.name || 'file').slice(0, 200),
+      path: file.path.slice(0, 1024),
+      kind: ['image', 'file', 'text'].includes(file.kind) ? file.kind : 'file',
+      mimeType: String(file.mimeType || 'application/octet-stream').slice(0, 100),
+      size: Number(file.size) >= 0 ? Number(file.size) : 0,
+      ...(/^[a-f0-9]{64}$/.test(String(file.id ?? '')) ? { id: file.id } : {}),
+    }));
+}
+
+/** The model-facing list of `files`, empty when there are none. `ids`: the
+ *  row also records the stored files as its attachments (a task report), so
+ *  their ids can be forwarded; a plain-text handoff (an agent completion)
+ *  lists paths only — an id named in text is never trusted. */
+export function artifactLines(files, omitted = 0, { ids = true } = {}) {
+  const list = normalizeHandoffFiles(files);
+  if (!list.length) return [];
+  const attachable = (file) => (ids ? ` [attachment:${file.id}]` : ' (attachable: forward it by path)');
+  return [
+    `Files from this turn (forward one with attachments: [${ids ? 'id or path' : 'path'}]; link a path to show it):`,
+    ...list.map(
+      (file) =>
+        `- ${oneLine(file.name)} (${oneLine(file.mimeType)}, ${sizeLabel(file.size)}) — ${oneLine(file.path)}${
+          file.id ? attachable(file) : ' (too large or unsupported to attach; link the path)'
+        }`
+    ),
+    ...(omitted > 0 ? [`- …and ${omitted} more file(s)`] : []),
+  ];
+}
+
+/** The message attachment records of `files` (the stored ones). */
+export function artifactRecords(files) {
+  return normalizeMessageAttachments(
+    normalizeHandoffFiles(files)
+      .filter((file) => file.id)
+      .map((file) => ({ ...file, attachmentRef: file.id }))
+  );
+}

package/src/runtime/shared/held-request-host.d.mts

@@ -0,0 +1,12 @@
+export interface HeldRequestPushEvent {
+  sessionId: string;
+  agentId: string;
+  agentName: string;
+  requestId: string;
+}
+export function registerHeldRequestResolver(resolver: (id: string, decision: unknown) => boolean): () => void;
+export function resolveHeldRequest(id: string, decision: unknown): boolean;
+export function registerHeldRequestNotifier(notifier: (event: HeldRequestPushEvent) => void): () => void;
+export function notifyHeldRequest(event: Partial<HeldRequestPushEvent>): void;
+export function recordRunOwner(sessionId: string, agentId: string): void;
+export function runOwnerOf(sessionId: string): string;

package/src/runtime/shared/held-request-host.mjs

@@ -0,0 +1,71 @@
+// Runtime ↔ desktop-service channel for held requests of unattended runs
+// (session-runtime/held-requests.mjs). The daemon's held-request registry
+// registers the resolver; the desktop service hosted in this daemon registers
+// a notifier that sends the sanitized phone push. The session API answers a
+// held request through resolveHeldRequest, whatever session it was sent from.
+//
+// Deliberately dependency-free: the desktop service bundle imports this file
+// too, and both copies share one registry through a global symbol.
+
+const KEY = Symbol.for('mixdog.heldRequestHost.v1');
+
+function registry() {
+  globalThis[KEY] ??= { resolver: null, notifiers: [], runOwners: new Map() };
+  return globalThis[KEY];
+}
+
+const RUN_OWNER_LIMIT = 500;
+/** Remember which agent an unattended run session belongs to, so its pushes
+ *  follow that agent's notification mute after the run ends (bounded, newest kept). */
+export function recordRunOwner(sessionId, agentId) {
+  const owners = registry().runOwners;
+  owners.delete(sessionId);
+  owners.set(String(sessionId), String(agentId));
+  while (owners.size > RUN_OWNER_LIMIT) owners.delete(owners.keys().next().value);
+}
+
+export function runOwnerOf(sessionId) {
+  return registry().runOwners.get(String(sessionId || '')) || '';
+}
+
+/** `resolver(id, decision) → boolean` (true when `id` was a pending held request). */
+export function registerHeldRequestResolver(resolver) {
+  registry().resolver = resolver;
+  return () => {
+    if (registry().resolver === resolver) registry().resolver = null;
+  };
+}
+
+export function resolveHeldRequest(id, decision) {
+  const { resolver } = registry();
+  return typeof resolver === 'function' && String(id || '').startsWith('held_')
+    ? resolver(id, decision) === true
+    : false;
+}
+
+/** `notifier({ sessionId, agentId, agentName, requestId })`: one per desktop service. */
+export function registerHeldRequestNotifier(notifier) {
+  const entry = { notifier };
+  registry().notifiers.push(entry);
+  return () => {
+    const list = registry().notifiers;
+    const index = list.indexOf(entry);
+    if (index >= 0) list.splice(index, 1);
+  };
+}
+
+/** Hand one held request to every registered notifier. Carries ids and the
+ *  agent's name only: never the tool, its arguments or any text. */
+export function notifyHeldRequest({ sessionId, agentId, agentName, requestId }) {
+  const event = {
+    sessionId: String(sessionId || ''),
+    agentId: String(agentId || ''),
+    agentName: String(agentName || ''),
+    requestId: String(requestId || ''),
+  };
+  for (const { notifier } of registry().notifiers) {
+    try {
+      notifier(event);
+    } catch {}
+  }
+}

package/src/runtime/shared/llm/provider-model-identities.mjs

@@ -28,7 +28,12 @@ export const ANTIGRAVITY_MODELS = Object.freeze([
     low: 'gemini-3.1-pro-low',
     high: 'gemini-3.1-pro-high',
   }),
-  fallbackModel('gemini-4-argon', 'Gemini 4 Argon', 'gemini-pro', 1048576, 'gemini-4-argon', ['low', 'medium', 'high']),
+  // The gateway serves Argon only through per-tier ids; bare `gemini-4-argon` is a 404.
+  fallbackModel('gemini-4-argon', 'Gemini 4 Argon', 'gemini-pro', 1048576, {
+    low: 'gemini-4-argon-low',
+    medium: 'gemini-4-argon-medium',
+    high: 'gemini-4-argon-high',
+  }),
   fallbackModel('claude-opus-4-6-thinking', 'Claude Opus 4.6 (Thinking)', null, 250000, 'claude-opus-4-6-thinking', [
     'low',
     'medium',

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -63,6 +63,12 @@ export async function accountProviderSend(provider, instance, send, model, opts
     if (!ledger) return;
     recorded.add(owner);
     const usage = result.usage || UNMEASURED_USAGE;
+    const durationMs = timed ? Date.now() - startedAt : 0;
+    // The one measured request time: the loop's speed figures read it, so
+    // the composer and the ledger show the same span.
+    if (timed && result && typeof result === 'object') {
+      Object.defineProperty(result, 'usageDurationMs', { value: durationMs, configurable: true, writable: true });
+    }
     const row = makeUsageRecord({
       id: result.responseId ? undefined : id,
       ts: Date.now(),
@@ -88,7 +94,7 @@ export async function accountProviderSend(provider, instance, send, model, opts
       // The account this send is bound to, so quota history can tell one
       // connected subscription's records from another's.
       account: ACCOUNT_PROVIDERS.includes(provider) ? currentProviderAccountId(provider) : '',
-      durationMs: timed ? Date.now() - startedAt : 0,
+      durationMs,
     });
     // Committed by the ledger worker (batched with concurrent sends); the
     // send still settles only once its row is durable, as before, but the