mixdog 1.2.6 → 1.3.1

package/src/session-runtime/held-requests.mjs

@@ -0,0 +1,228 @@
+/**
+ * Held requests: unattended runs never auto-approve. In a schedule, webhook or
+ * group-room-member run, an approval-needing call is HELD instead of shown as
+ * a card: the run pauses on it, a structured held-request row lands in the
+ * owning agent's home thread (agent-home-delivery.mjs queue), a phone push
+ * says only "<agent>가 승인을 기다립니다" (no tool, arguments or text), and the
+ * request expires after HELD_REQUEST_EXPIRY_MS into a deny, so the run goes
+ * on with the denial. The user answers from the home thread through the
+ * ordinary approval call with the held id (runtime/shared/held-request-host.mjs).
+ *
+ * Importing this module installs the unattended port of human-gate/gate.mjs.
+ * Rooms: a room member session counts as unattended by its id; a surface that
+ * hosts its own approval UI (a room) keeps it, and may call holdApprovalRequest
+ * itself to hold one request for the member's agent.
+ */
+import { randomUUID } from 'node:crypto';
+import { MIXY_AGENT_ID, agentHomeSessionId } from '../runtime/agent/orchestrator/session/agent-home.mjs';
+import { roomMemberOfSession } from '../runtime/agent/orchestrator/session/agent-room.mjs';
+import { mixyDisplayName } from '../runtime/agent/orchestrator/session/mixy-name.mjs';
+import {
+  recordHumanDecision,
+  setUnattendedApprovalPort,
+} from '../runtime/agent/orchestrator/session/human-gate/gate.mjs';
+import { normalizeHumanResponse } from '../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import { normalizeHeldRequest } from '../runtime/agent/orchestrator/session/human-gate/held-message.mjs';
+import {
+  notifyHeldRequest,
+  recordRunOwner,
+  registerHeldRequestResolver,
+} from '../runtime/shared/held-request-host.mjs';
+
+/** Default expiry; MIXDOG_HELD_REQUEST_EXPIRY_MS overrides it. */
+export const HELD_REQUEST_EXPIRY_MS = 5 * 60_000;
+
+function configuredExpiryMs() {
+  const value = Number(process.env.MIXDOG_HELD_REQUEST_EXPIRY_MS);
+  return Number.isFinite(value) && value > 0 ? value : HELD_REQUEST_EXPIRY_MS;
+}
+
+const runs = new Map(); // sessionId → { kind, agentId, name }
+
+/** Mark `sessionId` as an unattended schedule/webhook run of `agentId`. */
+export function markUnattendedRun(sessionId, { kind, agentId, name = '' }) {
+  if (!sessionId) return () => {};
+  const run = {
+    kind: kind === 'webhook' ? 'webhook' : 'schedule',
+    agentId: agentId || MIXY_AGENT_ID,
+    name: String(name),
+  };
+  runs.set(sessionId, run);
+  recordRunOwner(sessionId, run.agentId);
+  return () => {
+    if (runs.get(sessionId) === run) runs.delete(sessionId);
+  };
+}
+
+/** The unattended run `sessionId` belongs to, or null for an attended session. */
+export function unattendedRunOf(sessionId) {
+  const run = runs.get(sessionId);
+  if (run) return run;
+  const member = roomMemberOfSession(sessionId);
+  return member ? { kind: 'room', agentId: member.agentId, name: member.roomId } : null;
+}
+
+/**
+ * A schedule or webhook turn has nobody to hand a step to: a takeover there
+ * (an expired sign-in, 2FA, a CAPTCHA, a confirmation) ends the turn at once
+ * instead of waiting, and the routine turn (routine-home-turn.mjs) fails with
+ * routineHumanNeededText. `outcome` is login_required, human_action_required
+ * or sensitive_confirmation_required. Rooms keep their own UI. Resolves false
+ * for a session that is not such a run.
+ */
+export async function failRunForHuman(sessionId, outcome, site, abortTurn = defaultAbortTurn) {
+  const run = runs.get(sessionId);
+  if (!run) return false;
+  run.humanNeeded = { outcome, site: String(site || '') };
+  await abortTurn(sessionId);
+  return true;
+}
+
+async function defaultAbortTurn(sessionId) {
+  const { abortSessionTurn } = await import('../runtime/agent/orchestrator/session/manager/session-close.mjs');
+  abortSessionTurn(sessionId, 'login-required');
+}
+
+/** Push name of an agent; the representative's display name for the Lead. */
+function defaultAgentName(agentId) {
+  return agentId === MIXY_AGENT_ID ? mixyDisplayName() : agentId;
+}
+
+/**
+ * The held-request registry. `deliver(agentId, held)` posts a row into the
+ * home thread; `push(event)` sends the sanitized phone push; `record(gate,
+ * approval)` writes the audit line.
+ */
+export function createHeldRequests({
+  deliver,
+  push = notifyHeldRequest,
+  record = recordHumanDecision,
+  agentName = defaultAgentName,
+  expiryMs = configuredExpiryMs,
+  runOf = unattendedRunOf,
+  now = Date.now,
+  log = (line) => process.stderr.write(`mixdog held-requests: ${line}\n`),
+}) {
+  const pending = new Map();
+  const post = (agentId, held) =>
+    Promise.resolve()
+      .then(() => deliver(agentId, held))
+      .catch((error) => log(`held request ${held.id} could not be delivered: ${error?.message || error}`));
+
+  function settle(id, approval, status) {
+    const entry = pending.get(id);
+    if (!entry) return false;
+    pending.delete(id);
+    clearTimeout(entry.timer);
+    entry.release();
+    void post(entry.agentId, { ...entry.held, status, ...(approval.device ? { device: approval.device } : {}) });
+    void Promise.resolve()
+      .then(() => record(entry.gate, approval))
+      .catch((error) => log(`held request ${id} audit failed: ${error?.message || error}`));
+    entry.resolve(approval);
+    return true;
+  }
+
+  /** Hold `request` (the approval hook's payload) until answered or expired. */
+  function hold(request = {}, { signal } = {}) {
+    const run = runOf(request.sessionId) || { kind: 'schedule', agentId: MIXY_AGENT_ID, name: '' };
+    const id = `held_${randomUUID()}`;
+    const ms = typeof expiryMs === 'function' ? expiryMs() : expiryMs;
+    const held = normalizeHeldRequest({
+      id,
+      status: 'pending',
+      agentId: run.agentId,
+      kind: request.kind || 'approval',
+      tool: request.name,
+      target: request.outbound?.target || '',
+      reason: request.reason || '',
+      ...(request.kind === 'outbound'
+        ? {
+            payload: request.outbound?.payload || '',
+            action: request.outbound?.category,
+            account: request.outbound?.account,
+            editable: request.outbound?.editable,
+            details: request.outbound?.details,
+          }
+        : {}),
+      remember: request.remember || ['once'],
+      run: { kind: run.kind, name: run.name, sessionId: request.sessionId },
+      expiresAt: now() + ms,
+    });
+    const shape = { kind: held.kind, outbound: request.outbound, remember: request.remember || ['once'] };
+    const gate = {
+      agentId: run.agentId,
+      kind: held.kind,
+      ...(held.action ? { action: held.action } : {}),
+      tool: held.tool,
+      target: held.target,
+    };
+    return new Promise((resolve) => {
+      const onAbort = () => settle(id, { ...normalizeHumanResponse(shape, false), reason: 'run cancelled' }, 'denied');
+      signal?.addEventListener?.('abort', onAbort, { once: true });
+      const entry = {
+        held,
+        shape,
+        gate,
+        agentId: run.agentId,
+        resolve,
+        release: () => signal?.removeEventListener?.('abort', onAbort),
+        timer: setTimeout(
+          () =>
+            settle(
+              id,
+              { ...normalizeHumanResponse(shape, false), reason: 'held request expired', timedOut: true },
+              'expired'
+            ),
+          ms
+        ),
+      };
+      entry.timer.unref?.();
+      pending.set(id, entry);
+      void post(run.agentId, held);
+      try {
+        push({
+          sessionId: agentHomeSessionId(run.agentId) || agentHomeSessionId(MIXY_AGENT_ID),
+          agentId: run.agentId,
+          agentName: agentName(run.agentId),
+          requestId: id,
+        });
+      } catch (error) {
+        log(`held request ${id} push failed: ${error?.message || error}`);
+      }
+    });
+  }
+
+  /** Answer held request `id`; false when it is not pending (already settled). */
+  function resolve(id, decision = {}) {
+    const entry = pending.get(id);
+    if (!entry) return false;
+    const approved = decision === true || decision?.approved === true;
+    const approval = {
+      ...normalizeHumanResponse(entry.shape, approved, decision),
+      reason: String(decision?.reason || (approved ? 'approved by user' : 'denied by user')),
+      ...(typeof decision?.device === 'string' && decision.device ? { device: decision.device } : {}),
+    };
+    return settle(id, approval, approved ? 'approved' : 'denied');
+  }
+
+  return { hold, resolve, pending: () => [...pending.values()].map((entry) => entry.held) };
+}
+
+let processHeld = null;
+async function defaultDeliver(agentId, held) {
+  const { deliverHeldRequest } = await import('./agent-home-delivery.mjs');
+  return deliverHeldRequest(agentId, held);
+}
+function heldRequests() {
+  processHeld ??= createHeldRequests({ deliver: defaultDeliver });
+  return processHeld;
+}
+
+/** Hold one request for its session's agent (rooms call this from their own hook). */
+export function holdApprovalRequest(request, options) {
+  return heldRequests().hold(request, options);
+}
+
+setUnattendedApprovalPort({ runOf: unattendedRunOf, hold: holdApprovalRequest, humanNeeded: failRunForHuman });
+registerHeldRequestResolver((id, decision) => heldRequests().resolve(id, decision));

package/src/session-runtime/internal-tool-executor/ask-user-tool.mjs

@@ -1,11 +1,123 @@
 // ask_user: put 1-4 multiple-choice questions to the user through the session's
 // tool-approval hook (kind: 'question') and report the answers to the model.
+import { randomUUID } from 'node:crypto';
 import {
+  validateAskUserHandoff,
   validateAskUserQuestions,
   ASK_USER_MAX_TEXT,
 } from '../../runtime/agent/orchestrator/runtime-core/ask-user-tool-defs.mjs';
 import { createCallerContextResolvers } from './caller-context.mjs';
 import { runAbortable } from '../../runtime/shared/abort-race.mjs';
+import { SECRET_REQUEST_TIMEOUT_MS } from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import {
+  agentIdForSession,
+  recordHumanDecision,
+  unattendedApprovalPort,
+} from '../../runtime/agent/orchestrator/session/human-gate/gate.mjs';
+import { browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
+import { computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+
+/**
+ * A secret or takeover handoff. Secret: the card collects the value on the
+ * desktop, which holds it for `requestId` and fills it into the target field
+ * (isolated-world fill for the browser, one-shot typed input for computer
+ * use); here only the verdict travels, and the result is exactly 'provided',
+ * 'skipped' or 'timeout'. Takeover: the run waits until the user says done
+ * (computer and browser actions stay blocked meanwhile, desktop
+ * main/takeover-gate.ts); the result is 'done' or 'denied'.
+ */
+export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId, signal, inputs = {} }) {
+  const secretInput = {
+    browser: inputs.browser || browserSecretInput,
+    computer: inputs.computer || computerSecretInput,
+  };
+  const gate = {
+    agentId: agentIdForSession(sessionId),
+    kind: handoff.kind,
+    tool: `ask_user:${handoff.surface}`,
+    target: handoff.target || handoff.field || '',
+  };
+  // A schedule or webhook run has nobody to take over: the step ends it now,
+  // reported by what it needs (a sign-in, a step, a confirmation), never a waiting card.
+  const outcome = HANDOFF_OUTCOMES[handoff.need] || HANDOFF_OUTCOMES.action;
+  if (
+    handoff.kind === 'takeover' &&
+    (await unattendedApprovalPort()?.humanNeeded?.(sessionId, outcome, handoffSite(handoff)))
+  ) {
+    return UNATTENDED_TAKEOVER;
+  }
+  if (typeof hook !== 'function') {
+    // Nobody can take over here: blocked, never "proceed".
+    if (handoff.kind === 'takeover') return NO_TAKEOVER;
+    await recordHumanDecision(gate, { response: 'skipped' });
+    return 'skipped';
+  }
+  if (handoff.kind === 'secret') {
+    const requestId = `secret_${randomUUID()}`;
+    const result = await runAbortable(signal, () =>
+      hook({
+        name: 'ask_user',
+        kind: 'secret',
+        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field },
+        reason: '',
+        timeoutMs: SECRET_REQUEST_TIMEOUT_MS,
+        sessionId,
+        toolCallId,
+      })
+    );
+    let verdict = 'skipped';
+    if (result?.timedOut === true) verdict = 'timeout';
+    else if (result?.approved === true && result.response === 'provide-secret') {
+      verdict = await secretInput[handoff.surface](sessionId, requestId, { signal });
+    }
+    await recordHumanDecision(gate, { response: verdict, device: result?.device });
+    return verdict;
+  }
+  const result = await runAbortable(signal, () =>
+    hook({
+      name: 'ask_user',
+      kind: 'takeover',
+      takeover: {
+        surface: handoff.surface,
+        instructions: handoff.instructions,
+        target: handoff.target,
+        ...handoff.identity,
+        // A login takeover: the desktop opens its sign-in window on this page.
+        ...(handoff.login ? { purpose: 'login', url: handoff.login.url } : {}),
+      },
+      args: { surface: handoff.surface, instructions: handoff.instructions },
+      reason: '',
+      timeoutMs: null,
+      sessionId,
+      toolCallId,
+    })
+  );
+  const answer = result?.approved === true ? 'done' : 'denied';
+  await recordHumanDecision(gate, { response: answer, device: result?.device });
+  return answer;
+}
+
+/** The unattended outcome of a takeover by what it needs (routine-result.mjs). */
+const HANDOFF_OUTCOMES = Object.freeze({
+  sign_in: 'login_required',
+  action: 'human_action_required',
+  confirmation: 'sensitive_confirmation_required',
+});
+const UNATTENDED_TAKEOVER =
+  'Nobody is present in this routine run, so it ends here and the user is told what needs them. Stop; do not retry or work around this step.';
+const NO_TAKEOVER =
+  'Blocked: nobody can take over in this session, so this step was not done. Stop and tell the user what needs them; do not work around it.';
+
+/** The site a takeover is about: the first host its target (or instructions)
+ *  names, else the target as the model wrote it. */
+export function handoffSite(handoff) {
+  if (handoff.login) return new URL(handoff.login.url).hostname;
+  for (const text of [handoff.target, handoff.instructions]) {
+    const host = /\b((?:[a-z0-9-]+\.)+[a-z]{2,})\b/i.exec(String(text || ''))?.[1];
+    if (host) return host.toLowerCase();
+  }
+  return String(handoff.target || '').trim();
+}
 
 const NO_USER =
   'No user is available to answer in this session. Proceed with your best judgment and state the choices you made.';
@@ -63,6 +175,15 @@ export function createAskUserToolHandlers({ rt }) {
   const { sessionIdFor, signalFor } = createCallerContextResolvers(rt);
   return {
     ask_user: async (args, { callerCtx }) => {
+      const handoff = validateAskUserHandoff(args);
+      if (handoff) {
+        return runAskUserHandoff(handoff, {
+          hook: callerCtx?.toolApprovalHook,
+          sessionId: sessionIdFor(callerCtx),
+          toolCallId: callerCtx?.toolCallId || null,
+          signal: signalFor(callerCtx),
+        });
+      }
       const questions = validateAskUserQuestions(args);
       const hook = callerCtx?.toolApprovalHook;
       if (typeof hook !== 'function') return NO_USER;

package/src/session-runtime/internal-tool-executor/feature-tools.mjs

@@ -46,6 +46,10 @@ export function createFeatureToolHandlers({ rt, setupTool, officeToolsEnabled, m
         signal: signalFor(callerCtx),
       });
     },
-    setup: async (args, { callerCtx }) => await setupTool.execute(args || {}, { signal: signalFor(callerCtx) }),
+    setup: async (args, { callerCtx }) =>
+      await setupTool.execute(args || {}, {
+        signal: signalFor(callerCtx),
+        callerSessionId: callerCtx?.callerSessionId || null,
+      }),
   };
 }

package/src/session-runtime/internal-tool-executor/knowledge-tools.mjs

@@ -1,12 +1,15 @@
 // Tools that read rather than act: web search/fetch, memory, the code graph,
 // the deferred tool catalog, and skill bodies.
 import {
+  deferredCatalogUnion,
   refreshDeferredMcpToolCatalog,
   renderToolSearch,
 } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { parseToolSelection } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog-schema.mjs';
 import { resolveDeferredSelectMode } from '../../runtime/agent/orchestrator/session/loop/deferred-call-through.mjs';
 import { dispatchWebSearchRuntimeTool, memoryToolArgsForCaller } from '../runtime-tool-routing.mjs';
 import { createCallerContextResolvers } from './caller-context.mjs';
+import { memoryCallerScope } from '../services/memory-access.mjs';
 
 export function createKnowledgeToolHandlers({
   rt,
@@ -17,6 +20,7 @@ export function createKnowledgeToolHandlers({
   runNativeWebSearch,
   activeToolSurface,
   mcpStatus,
+  awaitMcpConnect,
   skillToolContent,
 }) {
   const { signalFor } = createCallerContextResolvers(rt);
@@ -29,10 +33,23 @@ export function createKnowledgeToolHandlers({
       runNativeWebSearch,
     });
 
+  // The calling session's memory scope always replaces any model-supplied
+  // one: the memory runtime authorizes every pool read and write by it. A
+  // caller named but not resolvable here counts as an unattended run.
+  const memoryCallerSession = (callerCtx) => {
+    if (callerCtx?.callerSession) return callerCtx.callerSession;
+    const id = callerCtx?.callerSessionId;
+    return !id || id === rt.session?.id ? rt.session || null : null;
+  };
   const memory = async (args, { name, callerCtx, callerCwd }) => {
     const memoryMod = await getMemoryModule();
     if (!memoryMod?.handleToolCall) throw new Error('memory runtime is not available');
-    return await memoryMod.handleToolCall(name, memoryToolArgsForCaller(args, callerCwd), signalFor(callerCtx));
+    const memoryCaller = memoryCallerScope(memoryCallerSession(callerCtx));
+    return await memoryMod.handleToolCall(
+      name,
+      { ...memoryToolArgsForCaller(args, callerCwd), memory_caller: memoryCaller },
+      signalFor(callerCtx)
+    );
   };
 
   // Catalog tools answer for the calling session's own scope, bridge or
@@ -41,9 +58,21 @@ export function createKnowledgeToolHandlers({
   const scopeSession = (callerCtx) => callerCtx?.callerSession || activeToolSurface();
   const scopeMode = (session) => session?.deferredSurfaceMode || resolveDeferredSelectMode(session) || rt.mode;
 
-  const toolSearch = (args, { callerCtx } = {}) => {
+  const catalogLacks = (session, names) => {
+    const known = new Set(deferredCatalogUnion(session).map((tool) => String(tool?.name || '').toLowerCase()));
+    return parseToolSelection(names).some((name) => !known.has(String(name).toLowerCase()));
+  };
+  // A name the catalog does not hold yet may belong to a server still in its
+  // handshake (a fresh session's first turn, or the reconnect after a
+  // sign-in): wait for that connect before reporting it missing. Returns at
+  // once when no connect is in flight.
+  const toolSearch = async (args, { callerCtx } = {}) => {
     const session = scopeSession(callerCtx);
     refreshDeferredMcpToolCatalog(session, rt.config);
+    if (awaitMcpConnect && catalogLacks(session, args?.names)) {
+      await awaitMcpConnect();
+      refreshDeferredMcpToolCatalog(session, rt.config);
+    }
     return renderToolSearch(args, session, scopeMode(session), { mcpStatus });
   };
 

package/src/session-runtime/internal-tool-executor/workspace-tools.mjs

@@ -5,9 +5,33 @@ import { resolve } from 'node:path';
 import { listProjects } from '../../runtime/shared/projects.mjs';
 import { applySessionSidebarChange } from '../../runtime/shared/session-sidebar-host.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { scheduleCallerScope } from '../services/schedule-access.mjs';
+import { resolveHandoffAttachments, sessionRoots } from '../handoff-attachments.mjs';
 
 const USER_TITLE_ERROR = 'session: the user already titled this session; the title was not changed';
 
+/** The agent an attended agent conversation (an agent's home thread) acts as;
+ *  '' for every other caller: delegated workers, coding sessions (task
+ *  sessions included) and unattended schedule/webhook runs. */
+function attendedAgentOf(session) {
+  const { mode, agentId } = resolveSessionMode({ session });
+  const { kind } = scheduleCallerScope(session);
+  return mode === AGENT_MODE && (kind === 'human' || kind === 'agent') ? agentId : '';
+}
+
+/** The caller's `attachments` as stored prompt parts, resolved against its own
+ *  conversation and folders (handoff-attachments.mjs). */
+function callerAttachmentParts(rt, args, callerCwd, surface) {
+  return resolveHandoffAttachments(args?.attachments, {
+    messages: rt.session?.messages,
+    roots: sessionRoots(rt.session, callerCwd),
+    cwd: callerCwd,
+    surface,
+  }).parts;
+}
+
 export function createWorkspaceToolHandlers({
   rt,
   goalRuntime,
@@ -65,12 +89,37 @@ export function createWorkspaceToolHandlers({
   const session = async (args, { callerCtx, callerCwd }) => {
     const action = clean(args?.action || (args?.path ? 'set-project' : 'status')).toLowerCase();
     const target = clean(args?.session_id);
-    if (['list', 'read', 'send', 'cancel', 'delete'].includes(action) || (action === 'status' && target)) {
+    if (['list', 'read', 'send', 'cancel', 'delete', 'create'].includes(action) || (action === 'status' && target)) {
       const callerSessionId = assertLead(action, callerCtx);
+      const callerAgentId = attendedAgentOf(rt.session);
+      if (action === 'create' && !callerAgentId) {
+        throw new Error(
+          'session: create belongs to a bot conversation; delegated workers, agent task sessions and schedule/webhook runs cannot create agent task sessions'
+        );
+      }
+      // A task session reaches its agent only through its reported result.
+      const origin = rt.session?.taskOrigin;
+      if (
+        action === 'send' &&
+        origin &&
+        (target === origin.sessionId || agentIdOfHomeSession(target) === origin.agentId)
+      ) {
+        throw new Error('session: a task session reports to its agent only through its result');
+      }
       if (typeof executeSessionControl !== 'function') {
         throw new Error('session: cross-session control is unavailable in this runtime');
       }
-      return JSON.stringify(await executeSessionControl({ ...args, action }, { callerSessionId }));
+      const { attachments, ...rest } = args || {};
+      if (attachments !== undefined && action !== 'send' && action !== 'create') {
+        throw new Error(`session: attachments apply to send and create, not action=${action}`);
+      }
+      const attachmentParts = callerAttachmentParts(rt, args, callerCwd, 'session');
+      return JSON.stringify(
+        await executeSessionControl(
+          { ...rest, action },
+          { callerSessionId, callerAgentId, callerCwd, ...(attachmentParts.length ? { attachmentParts } : {}) }
+        )
+      );
     }
     if (target && target !== assertLead(action, callerCtx)) {
       throw new Error(`session: action=${action} only applies to the current session`);
@@ -192,7 +241,11 @@ export function createWorkspaceToolHandlers({
       }),
     agent: async (args, { callerCtx, callerCwd }) => {
       const callerSessionId = callerCtx?.callerSessionId || rt.session?.id || null;
-      return await agentTool.execute(args, {
+      // `attachmentParts` is never the model's to set: only the resolved
+      // `attachments` reach the agent's turn.
+      const { attachments, attachmentParts: _ignored, ...rest } = args || {};
+      const attachmentParts = callerAttachmentParts(rt, { attachments }, callerCwd, 'agent');
+      return await agentTool.execute(attachmentParts.length ? { ...rest, attachmentParts } : rest, {
         callerCwd,
         invocationSource: 'model-tool',
         callerSessionId,

package/src/session-runtime/internal-tool-executor.mjs

@@ -30,6 +30,7 @@ export function createInternalToolExecutor({
   runNativeWebSearch,
   activeToolSurface,
   mcpStatus,
+  awaitMcpConnect,
   skillToolContent,
   getWorkspaceApi,
   getSessionManager,
@@ -49,6 +50,7 @@ export function createInternalToolExecutor({
       runNativeWebSearch,
       activeToolSurface,
       mcpStatus,
+      awaitMcpConnect,
       skillToolContent,
     }),
     ...createWorkspaceToolHandlers({

package/src/session-runtime/lifecycle/session-catalog.mjs

@@ -3,6 +3,8 @@
  * catalog: durable visibility filter, lead-shape heuristics and preview rows.
  */
 import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+import { normalizeRoutineProvenance } from '../../runtime/agent/orchestrator/session/routine-result.mjs';
+import { sessionModeOf } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
 import {
   isAgentOnlySession,
   isRootLeadSession,
@@ -70,9 +72,12 @@ export function leadSessionRow(s, working = false) {
   if (!agentSession && !isLeadShaped(s, owner, sourceType)) return null;
   const { preview, messageCount, realTurnCount } = previewOf(s);
   if (!preview && messageCount === 0) return null;
+  const lastMessageRoutine = normalizeRoutineProvenance(s.lastMessageRoutine);
   return {
     id: s.id,
     agent: s.agent || null,
+    // 'agent' | 'coding' (agent-mode.mjs): the desktop renders agent-mode chats.
+    sessionMode: sessionModeOf(s),
     owner,
     visibility: isAgentOnlySession(s) ? 'agent-only' : 'ordinary',
     ownerSessionId: s.ownerSessionId || s.parentSessionId || null,
@@ -92,6 +97,10 @@ export function leadSessionRow(s, working = false) {
     messageCount,
     title: cleanSessionPreview(s.title || '', 100),
     preview,
+    // The latest user or assistant line (an agent contact's row shows it).
+    ...(s.lastMessagePreview ? { lastMessagePreview: String(s.lastMessagePreview) } : {}),
+    // That line's routine provenance: clients label a routine result by it.
+    ...(lastMessageRoutine ? { lastMessageRoutine } : {}),
     // Working indicator: the in-memory runtime state ALONE is the liveness
     // signal. The persisted lastHeartbeatAt JSON field (refreshed by the final
     // save) must not be folded in — it outlives the turn it describes.

package/src/session-runtime/lifecycle/session-switch/resume.mjs

@@ -60,6 +60,7 @@ export function createSessionResume(deps, { ingestSessionIntoMemory, closeSurfac
     getStandaloneTools,
     beginRoutePreparation,
     clearRoutePreparation,
+    refreshAgentProfile,
   } = deps;
 
   function restoreResumedToolSurface(target, targetRoute) {
@@ -165,6 +166,9 @@ export function createSessionResume(deps, { ingestSessionIntoMemory, closeSurfac
     // preparation temporarily dropped loaded tools and invalidated the
     // provider-aligned context baseline.
     restoreResumedToolSurface(resumed, resumedRoute);
+    // A thread running as an agent whose profile was edited while no runtime
+    // held it takes the saved profile now (tool-policy-refresh.mjs).
+    await refreshAgentProfile?.({ trigger: 'resume' });
     const finishRoutePreparation = routePreparation(resumed, resumedRoute);
     if (typeof beginRoutePreparation === 'function') {
       beginRoutePreparation(finishRoutePreparation);

package/src/session-runtime/lifecycle/shared.mjs

@@ -3,6 +3,8 @@
  * lifecycle groups (teardown, session switching, inheritance).
  */
 import { hasUserConversationMessage } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
+import { isAgentHomeSessionId } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { isRoomThreadSessionId } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
 
 export { SESSION_ID_PATTERN } from '../../runtime/agent/orchestrator/runtime-core/session-id.mjs';
 
@@ -19,7 +21,11 @@ export function isScratchConversation(messages, liveTurnMessages) {
   );
 }
 
+/** An agent's home thread is never scratch: a blank one is tombstoned on no
+ *  close, so its fixed id stays open for the next visit. Neither is a group
+ *  room's log or member session (agent-room.mjs), whose ids are fixed too. */
 export function isScratchSession(session) {
+  if (isAgentHomeSessionId(session?.id) || isRoomThreadSessionId(session?.id)) return false;
   return isScratchConversation(session?.messages, session?.liveTurnMessages);
 }
 

package/src/session-runtime/mcp-glue/server-catalog.mjs

@@ -2,6 +2,7 @@
 // servers plus the servers registered plugins declare (resolved live, with
 // explicit owner metadata), per-server config reads, and the live/failed rollup.
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { connectorOfServer, gmailAppPasswordAccount } from '../../runtime/shared/connector-catalog.mjs';
 import { envFlag } from '../../runtime/shared/env.mjs';
 import { resolveMcpServerCatalog } from './plugin-servers.mjs';
 
@@ -142,9 +143,16 @@ export function createMcpServerCatalog({
         source: sources[name] || 'config',
       };
       if (authRequired) row.authRequired = true;
+      // The catalog service this server connects (connector-catalog.mjs):
+      // its marker.
+      const connector = entry.owner ? '' : connectorOfServer(cfg);
+      if (connector) row.connector = connector;
       const oauth = mcpClient.getMcpServerOAuthState?.(cfg);
       // Why the last sign-in did not complete (already credential-scrubbed).
       if (oauth) row.oauth = authRequired && fail?.msg ? { ...oauth, lastError: fail.msg } : oauth;
+      // Gmail connected with an app password: the account it runs as.
+      const appPasswordAccount = gmailAppPasswordAccount(cfg);
+      if (appPasswordAccount) row.appPassword = { account: appPasswordAccount };
       if (entry.owner) {
         row.owner = entry.owner;
         row.pluginEnabled = entry.pluginEnabled;

package/src/session-runtime/mcp-glue/server-input.mjs

@@ -70,6 +70,9 @@ export function createMcpServerInput({ mcpClient, getCurrentCwd }) {
       if (bearerTokenEnvVar) config.bearer_token_env_var = bearerTokenEnvVar;
       const envHeaders = coerceStringRecord(input.env_http_headers || input.envHttpHeaders);
       if (envHeaders) config.env_http_headers = envHeaders;
+      // The user's own OAuth client (앱 번호); its secret never lands here.
+      const oauthClientId = clean(input.oauthClientId);
+      if (oauthClientId) config.oauthClientId = oauthClientId;
       return config;
     };
     const url = clean(input.url);