mixdog 1.2.6 → 1.3.1

package/src/session-runtime/mcp-oauth-login.mjs

@@ -8,6 +8,15 @@ import { openInBrowser } from '../runtime/shared/open-url.mjs';
 // Settled flows stay readable long enough for a poller to observe the result.
 const SETTLED_FLOW_TTL_MS = 10 * 60_000;
 const NOT_COMPLETED = 'MCP OAuth sign-in was not completed';
+export const MCP_OAUTH_LOGIN_TIMED_OUT = 'MCP OAuth sign-in timed out';
+// A sign-in nobody finishes ends here, ahead of the OAuth layer's own 5-minute
+// abort, so its failure is reported as the timeout it is.
+const LOGIN_DEADLINE_MS = 5 * 60_000 - 10_000;
+// The longest a status read waits for a change (local callers only).
+const MAX_STATUS_WAIT_MS = 15_000;
+// How a sign-in treats the account (mcp/oauth-account.mjs): a normal
+// authorization, a repair of the same connection, or a transactional switch.
+const MODES = new Set(['connect', 'reauth', 'switch']);
 
 const NOT_PENDING = 'MCP OAuth sign-in is no longer pending';
 
@@ -19,17 +28,36 @@ const NOT_PENDING = 'MCP OAuth sign-in is no longer pending';
 const flows = new Map();
 
 // A pending flow keeps its authorization URL readable: a client polling the
-// status (remote sign-in) still shows the page to open.
+// status (remote sign-in) still shows the page to open. `step` names what a
+// pending flow waits for: `browser` (the sign-in page), `connecting` (the
+// callback arrived; tokens are exchanged), `tools` (signed in; the server
+// connects and lists its tools).
 const view = (flow) => ({
   flowId: flow.flowId,
   state: flow.state,
+  ...(flow.state === 'pending' ? { step: flow.step } : {}),
   ...(flow.state === 'pending' && flow.url ? { url: flow.url } : {}),
   ...(flow.error ? { error: flow.error } : {}),
+  ...(flow.reason ? { reason: flow.reason } : {}),
 });
+const versionOf = (flow) => `${flow.state}:${flow.step}`;
+// Wake every status read waiting on this flow.
+function changed(flow) {
+  const waiters = flow.waiters;
+  flow.waiters = [];
+  for (const wake of waiters) wake();
+}
+function setStep(flow, step) {
+  if (flow.state !== 'pending' || flow.step === step) return;
+  flow.step = step;
+  changed(flow);
+}
 function settle(flow, state, error = null) {
   if (flow.state !== 'pending') return;
   flow.state = state;
   if (state === 'failed') flow.error = error || NOT_COMPLETED;
+  clearTimeout(flow.deadline);
+  changed(flow);
   setTimeout(() => flows.delete(flow.flowId), SETTLED_FLOW_TTL_MS).unref?.();
 }
 function flowOf(flowId) {
@@ -40,19 +68,23 @@ function flowOf(flowId) {
 async function cancelFlow(flow) {
   if (flow.state === 'pending') {
     flow.cancelled = true;
-    flow.owner.cancel(flow.name);
+    flow.abort();
     await flow.done;
   }
   return view(flow);
 }
 
 /**
- * `connect(name, openBrowser)` reconnects the server interactively, calling
- * `openBrowser(url)` when a login starts, and resolves `{ connected, error }`.
+ * `connect(name, launch)` reconnects the server interactively, calling
+ * `launch(url)` when a login starts, and resolves `{ connected, error }`.
  * `cancel(name)` aborts that server's pending login. `completeCallback(name,
  * callbackUrl)` answers it with a pasted redirect URL (throws a fixed message
- * for an invalid one). `onComplete(name)` runs after a successful sign-in,
- * before the flow reports complete.
+ * for an invalid one). `switchAccount(name, launch, attempt)` runs an account
+ * switch instead (mode `switch`): it registers `attempt.abort` / `attempt.answer`
+ * and resolves `{ connected, error }` only after committing (or rolling back)
+ * the new sign-in. `launch` carries `accountMode` and the progress hooks
+ * `onCallback` / `onAuthorized` the OAuth layer calls. `onComplete(name)` runs
+ * after a successful sign-in, once the flow already reports complete.
  */
 export function createMcpOAuthLogins({
   connect,
@@ -60,8 +92,12 @@ export function createMcpOAuthLogins({
   completeCallback = () => {
     throw new Error(NOT_PENDING);
   },
+  switchAccount = async () => {
+    throw new Error('Switching the account is not supported here');
+  },
   onComplete = async () => {},
   openBrowser = openInBrowser,
+  loginTimeoutMs = LOGIN_DEADLINE_MS,
 }) {
   // name -> tail of that server's serialized begin/cancel/sign-out steps, so
   // replacing a pending flow is atomic and exactly one can be pending.
@@ -89,10 +125,11 @@ export function createMcpOAuthLogins({
     Promise.all([...flows.values()].filter((flow) => flow.owner === owner && flow.name === name).map(cancelFlow));
 
   async function begin(name, options = {}) {
-    const { openBrowser: hostBrowser } = options || {};
+    const { openBrowser: hostBrowser, mode = 'connect' } = options || {};
     if (hostBrowser !== undefined && typeof hostBrowser !== 'boolean') {
       throw new TypeError('openBrowser must be a boolean');
     }
+    if (!MODES.has(mode)) throw new TypeError('mode must be connect, reauth or switch');
     let announceUrl;
     const urlReady = new Promise((resolve) => {
       announceUrl = resolve;
@@ -105,10 +142,17 @@ export function createMcpOAuthLogins({
         flowId: `mcp_oauth_${randomUUID()}`,
         name,
         owner,
+        mode,
         state: 'pending',
+        step: 'starting',
         error: null,
+        reason: null,
         cancelled: false,
+        timedOut: false,
         url: null,
+        waiters: [],
+        abort: () => owner.cancel(name),
+        answer: (callbackUrl) => owner.completeCallback(name, callbackUrl),
       };
       flows.set(flow.flowId, flow);
       const launch = async (url) => {
@@ -117,22 +161,51 @@ export function createMcpOAuthLogins({
         if (flow.cancelled) throw new Error('MCP OAuth login cancelled');
         flow.awaitingCallback = true;
         flow.url = url;
+        setStep(flow, 'browser');
         announceUrl(url);
         if (hostBrowser !== false) openBrowser(url);
+        // Nobody finished the sign-in page in time.
+        flow.deadline = setTimeout(() => {
+          if (flow.state !== 'pending' || flow.step !== 'browser') return;
+          flow.timedOut = flow.cancelled = true;
+          flow.abort();
+        }, loginTimeoutMs);
+        flow.deadline.unref?.();
       };
+      launch.accountMode = mode;
+      launch.onCallback = () => setStep(flow, 'connecting');
+      launch.onAuthorized = () => setStep(flow, 'tools');
       flow.done = (async () => {
         try {
-          const outcome = await connect(name, launch);
-          if (flow.cancelled) settle(flow, 'cancelled');
+          const outcome =
+            mode === 'switch'
+              ? await switchAccount(name, launch, {
+                  set abort(fn) {
+                    flow.abort = fn;
+                  },
+                  set answer(fn) {
+                    flow.answer = fn;
+                  },
+                })
+              : await connect(name, launch);
+          if (flow.timedOut) {
+            flow.reason = 'timeout';
+            settle(flow, 'failed', MCP_OAUTH_LOGIN_TIMED_OUT);
+          } else if (flow.cancelled) settle(flow, 'cancelled');
           else if (outcome?.connected) {
-            // The sign-in itself succeeded; a failed follow-up never undoes it.
-            await Promise.resolve()
+            settle(flow, 'complete');
+            // The other runtimes reconnect after the flow already reports
+            // complete: the caller never waits for every peer's reconnect, and
+            // a failed follow-up never undoes the sign-in.
+            void Promise.resolve()
               .then(() => onComplete(name))
               .catch(() => {});
-            settle(flow, 'complete');
           } else settle(flow, 'failed', outcome?.error);
         } catch (error) {
-          settle(flow, flow.cancelled ? 'cancelled' : 'failed', error?.message || String(error));
+          if (flow.timedOut) {
+            flow.reason = 'timeout';
+            settle(flow, 'failed', MCP_OAUTH_LOGIN_TIMED_OUT);
+          } else settle(flow, flow.cancelled ? 'cancelled' : 'failed', error?.message || String(error));
         }
       })();
       return flow;
@@ -147,7 +220,31 @@ export function createMcpOAuthLogins({
 
   return {
     begin,
-    status: (flowId) => view(flowOf(flowId)),
+    /** The flow's view. With `{ since, waitMs }` (the `state:step` a caller
+     *  last saw) the read resolves on the flow's next change, or after at most
+     *  `waitMs` unchanged: the caller follows each step as it happens. */
+    status(flowId, options = {}) {
+      const flow = flowOf(flowId);
+      const { since, waitMs } = options || {};
+      if (since === undefined) return view(flow);
+      if (typeof since !== 'string') throw new TypeError('since must be a string');
+      if (!Number.isFinite(waitMs) || waitMs < 0) throw new TypeError('waitMs must be a non-negative number');
+      if (since !== versionOf(flow) || flow.state !== 'pending' || waitMs === 0) return view(flow);
+      return new Promise((resolve) => {
+        const wake = () => {
+          clearTimeout(timer);
+          resolve(view(flow));
+        };
+        const timer = setTimeout(
+          () => {
+            flow.waiters = flow.waiters.filter((waiter) => waiter !== wake);
+            resolve(view(flow));
+          },
+          Math.min(waitMs, MAX_STATUS_WAIT_MS)
+        );
+        flow.waiters.push(wake);
+      });
+    },
     cancel(flowId) {
       const flow = flowOf(flowId);
       return flow.owner.exclusive(flow.name, () => cancelFlow(flow));
@@ -158,7 +255,7 @@ export function createMcpOAuthLogins({
     async complete(flowId, callbackUrl) {
       const flow = flowOf(flowId);
       if (flow.state !== 'pending' || flow.cancelled || !flow.awaitingCallback) throw new Error(NOT_PENDING);
-      flow.owner.completeCallback(flow.name, callbackUrl);
+      flow.answer(callbackUrl);
       await flow.done;
       return view(flow);
     },

package/src/session-runtime/model-route/route-persist.mjs

@@ -35,7 +35,7 @@ export function createRoutePersistence(deps) {
         hasSecrets: getConfigHasSecrets(),
       });
     },
-    persistAdoptedModelSettings(route, { keepMainModel } = {}) {
+    persistAdoptedModelSettings(route, { keepMainModel, onlyIfAbsent = false } = {}) {
       // saveModelSettings is in-memory only. persistLeadRoute debounce-writes
       // the adopted config (including modelSettings). If the lead preset cannot
       // be normalized, still debounce-persist so effort/fast are not memory-only.
@@ -43,7 +43,7 @@ export function createRoutePersistence(deps) {
         keepMainModel === true ||
         (keepMainModel !== false && tunesNonMainModel(getRoute(), route, resolveRoute(getConfig(), {})))
           ? null
-          : persistLeadRoute(route);
+          : persistLeadRoute(route, { onlyIfAbsent });
       if (!leadRoute) saveConfigAndAdopt(getConfig());
       return leadRoute;
     },

package/src/session-runtime/model-route/route-tuning.mjs

@@ -10,7 +10,13 @@ export function createRouteTuning(deps, persist) {
   const { getConfig, getRoute, setRouteState, resolveRoute, lookupModelMeta, refreshRouteEffort } = deps;
 
   /** Save the live route's modelSettings, re-resolve through the lead preset
-   *  when one exists, refresh effort and tune the current session. */
+   *  when one exists, refresh effort and tune the current session.
+   *
+   *  This is not a Main-model write and needs no compare-and-set: it persists
+   *  the LIVE route (read after every await), and only when that route's model
+   *  is already the Main model (persistAdoptedModelSettings: tunesNonMainModel),
+   *  so the lead preset's model is rewritten with itself and never changes. A
+   *  live route without a model normalizes to nothing and writes no preset. */
   async function commitRouteTuning(fastCapable, modelMeta) {
     persist.saveRouteModelSettings(getRoute(), fastCapable);
     const leadRoute = persist.persistAdoptedModelSettings(getRoute());

package/src/session-runtime/model-route/set-route.mjs

@@ -140,15 +140,26 @@ function modelSwitchAnchorIndex(messages) {
  *  (like an inheritance boundary): the transcript shows it live and after a
  *  restore, and the model conversation gains no synthetic message. */
 export function recordModelSwitchBoundary(session, boundary) {
+  return recordTranscriptBoundary(
+    session,
+    'modelSwitches',
+    boundary,
+    (entry) => entry?.at === boundary.at && entry?.modelId === boundary.modelId
+  );
+}
+
+/** A display-only boundary appended to `meta[field]` of the switch anchor
+ *  message (model and workflow switches); `same` finds an already recorded one. */
+export function recordTranscriptBoundary(session, field, boundary, same) {
   const messages = Array.isArray(session?.messages) ? session.messages : [];
   const index = modelSwitchAnchorIndex(messages);
   if (index < 0) return false;
   const anchor = messages[index];
-  const switches = Array.isArray(anchor.meta?.modelSwitches) ? anchor.meta.modelSwitches : [];
-  if (switches.some((entry) => entry?.at === boundary.at && entry?.modelId === boundary.modelId)) return true;
+  const switches = Array.isArray(anchor.meta?.[field]) ? anchor.meta[field] : [];
+  if (switches.some(same)) return true;
   // Replace the message object: the session save worker detects changed
   // messages by reference identity, so an in-place meta edit is never saved.
-  messages[index] = { ...anchor, meta: { ...anchor.meta, modelSwitches: [...switches, boundary] } };
+  messages[index] = { ...anchor, meta: { ...anchor.meta, [field]: [...switches, boundary] } };
   return true;
 }
 
@@ -184,9 +195,23 @@ async function adoptRoute(deps, persist, next, options, lease) {
     scheduleStatuslineUsageRefresh,
   } = deps;
   const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
+  // The Lead route a conditional fill wrote, until the file confirms it.
+  let filled = null;
   // Provider readiness may outlast the session the selection was made for.
   const adopted = lease.run(
     () => {
+      // Compare-and-set: a route that already has a model (picked while this
+      // selection was resolving) is never replaced. Checked synchronously with
+      // the adopt below, so nothing can set a route in between. A Lead route
+      // another process persisted may not have reached this runtime yet (the
+      // change notification is debounced): the config is re-read from disk
+      // right here, which adopts it and fills the empty route, and that route
+      // is the winner this selection answers with.
+      if (options?.onlyIfEmpty === true) {
+        if (clean(getRoute()?.model)) return false;
+        deps.reloadFullConfig?.();
+        if (clean(getRoute()?.model)) return false;
+      }
       if (options?.sessionOnly === true) {
         // An agent child's route belongs to that session alone: the shared
         // modelSettings bucket (saved effort/Fast per model) and the main
@@ -199,7 +224,9 @@ async function adoptRoute(deps, persist, next, options, lease) {
         // — the session surface's model pick, an heir — keeps it.
         const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
           keepMainModel: options?.keepMainModel !== false,
+          onlyIfAbsent: options?.onlyIfEmpty === true,
         });
+        filled = leadRoute;
         setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
       }
       return true;
@@ -207,9 +234,13 @@ async function adoptRoute(deps, persist, next, options, lease) {
     () => false
   );
   if (!adopted) return false;
+  // A conditional fill reaches the file only while no Lead route is stored
+  // there (judged under the config file lock). When another process wrote one
+  // after the re-read above, the file's route replaces the fill in the runtime.
+  const replaced = filled && (await deps.confirmLeadFill?.(filled)) === true;
   // The refresh completes against the route just adopted and only while the
   // selection still owns it.
-  await refreshRouteEffort(modelMeta, getRoute(), null, lease);
+  await refreshRouteEffort(replaced ? null : modelMeta, getRoute(), null, lease);
   return lease.run(
     () => {
       refreshStatuslineUsageSnapshot(getRoute());

package/src/session-runtime/native-web-search.mjs

@@ -14,7 +14,7 @@ import {
 } from './native-web-search/tool-shape.mjs';
 import { createWebSearchRouteCandidates } from './native-web-search/routes.mjs';
 import { reportNativeWebSearchUsage } from './native-web-search-usage.mjs';
-import { canFallbackRoute } from '../runtime/shared/model-route-fallback.mjs';
+import { canFallbackCapacityRoute } from '../runtime/shared/model-route-fallback.mjs';
 
 export function createNativeWebSearch(deps) {
   const {
@@ -103,7 +103,7 @@ export function createNativeWebSearch(deps) {
       try {
         return await sendCandidate(candidate, toolType, webSearchArgs, signal);
       } catch (err) {
-        if (!canFallbackRoute(err, { signal })) throw err;
+        if (!canFallbackCapacityRoute(err, { signal })) throw err;
         errors.push(
           `${candidate.provider}${candidate.model ? `/${candidate.model}` : ''}/${toolType}: ${err?.message || String(err)}`
         );

package/src/session-runtime/new-session-config.mjs

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from 'node:util';
+import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { flushPendingSessionConfigWrites } from './config-lifecycle.mjs';
 
 // Run only after the lifecycle has established that it needs a NEW session.
@@ -27,7 +28,11 @@ export function createNewSessionConfig({
     if (!initialConfig || typeof initialConfig !== 'object') {
       reloadFullConfig();
       if (!firstSession || !initialRouteExplicit) {
-        rt.route = resolveRoute(rt.config, {});
+        const configured = resolveRoute(rt.config, {});
+        // With no Lead model configured the model picked for this runtime's
+        // still-empty conversation (a session-only choice never writes the
+        // Lead route) stands; the reload must not drop it before the first turn.
+        if (clean(configured?.model) || !clean(rt.route?.model)) rt.route = configured;
       }
     }
     invalidateOutputStyleStatusCache();

package/src/session-runtime/owned-automation-run.mjs

@@ -0,0 +1,229 @@
+/**
+ * One run of an owned automation — a schedule or a webhook endpoint. The run
+ * itself is a turn in the owner bot's home thread (routine-home-turn.mjs);
+ * the bot's reply there is its result, so nothing is posted besides it. A run
+ * whose owner bot does not exist (routine-owner.mjs) never fires: it is
+ * skipped as paused, never run elsewhere. A second run of the same automation
+ * while one is in flight is skipped (and recorded).
+ *
+ * Unattended runs (timed fires, received webhooks; not the app's or a chat's
+ * "Run now") also back off after consecutive failures (ROUTINE_LIMITS).
+ * Runs have no concurrency cap or deadline (user decision).
+ *
+ * Routine results from before routines ran in the bot's thread may still sit
+ * on a routine's record (`result_delivery`): redeliverRoutine and the daemon's
+ * recovery queue them into the owner's thread (agent-home-delivery.mjs),
+ * never running the routine again.
+ */
+import { announceRoutineRun, deliverScheduleResult } from './agent-home-delivery.mjs';
+import { ROUTINE_LIMITS, routineBackoffRemaining } from '../runtime/shared/routine-limits.mjs';
+import { ROUTINE_OWNER_PROBLEMS, routineOwnerProblem } from './routine-owner.mjs';
+
+const DELIVERY_RETRY_MS = 60_000;
+const errorText = (error) => error?.message || String(error);
+const defaultLog = (line) => process.stderr.write(`mixdog routines: ${line}\n`);
+
+// `${kind}:${name}` of every run in flight in this process: timed fires,
+// received webhooks and the app's "Run now" all come through here.
+const activeRuns = new Set();
+
+// The PG record of each kind, imported on first use.
+const RECORDS = {
+  schedule: () =>
+    import('../runtime/channels/lib/schedules-db.mjs').then((db) => ({
+      state: (name) => db.getSchedule(name),
+      list: () => db.listSchedules(),
+      recordDelivery: db.recordScheduleDelivery,
+    })),
+  webhook: () =>
+    import('../runtime/channels/lib/webhooks-db.mjs').then((db) => ({
+      state: (name) => db.loadEndpointConfig(name),
+      list: () => db.listEndpoints(),
+      recordDelivery: db.recordEndpointDelivery,
+    })),
+};
+/** `deps` over the kind's PG record for whatever `deps` leaves out. */
+async function withRecord(kind, deps) {
+  if (deps.state && deps.list && deps.recordDelivery) return deps;
+  const record = await RECORDS[kind]();
+  return {
+    ...deps,
+    state: deps.state || record.state,
+    list: deps.list || record.list,
+    recordDelivery: deps.recordDelivery || record.recordDelivery,
+  };
+}
+
+let retryArmed = false;
+/** One timer for the whole host: re-queue every record's undelivered result. */
+function armDeliveryRetry() {
+  if (retryArmed) return;
+  retryArmed = true;
+  setTimeout(() => {
+    retryArmed = false;
+    recoverRoutineDeliveries().catch((error) => defaultLog(`delivery retry failed: ${errorText(error)}`));
+  }, DELIVERY_RETRY_MS).unref?.();
+}
+
+/** Show `run`'s live-only row in the owner's home; a failure only logs. */
+async function announceRun(announce, row, run, log) {
+  try {
+    await announce(row, run);
+  } catch (error) {
+    log(`${run.kind} "${row.name}": run row not shown: ${errorText(error)}`);
+  }
+}
+
+/** Queue `item` for `row`'s owner; clear the record on success, mark it
+ *  'failed' (and arm the retry) when the queue refuses it. */
+async function queueResult(row, item, entry, { deliver, recordDelivery, onDeliveryFailed, announce, log }) {
+  try {
+    await deliver(row, item);
+  } catch (error) {
+    const message = errorText(error);
+    log(`${item.kind} "${row.name}": result could not be queued (${message}); retrying later`);
+    await recordDelivery(row.name, item.runId, { ...entry, state: 'failed', error: message }).catch((recordError) =>
+      log(`${item.kind} "${row.name}": delivery failure not recorded: ${errorText(recordError)}`)
+    );
+    // The home's run row turns into "result not delivered" (retry: retryRoutineDelivery).
+    await announceRun(announce, row, { ...item, state: 'undelivered' }, log);
+    onDeliveryFailed();
+    return false;
+  }
+  // A clear that fails leaves the record 'pending': the next recovery re-queues
+  // it, which the queue's run-id key turns into a no-op.
+  await recordDelivery(row.name, item.runId, null).catch((error) =>
+    log(`${item.kind} "${row.name}": delivered result not cleared: ${errorText(error)}`)
+  );
+  return true;
+}
+
+/**
+ * `row` is `{ name, ownerAgentId }`; `run({ signal })` resolves `{ sessionId,
+ * result }` (`signal` is the caller's cancellation, if any). Resolves the
+ * outcome, or `{ skipped: true, reason: 'owner' | 'overlap' | 'backoff' }`
+ * (an owner skip also names `ownerProblem` and its `message`); a failed run
+ * rejects.
+ */
+export async function runOwnedAutomation(kind, row, run, deps = {}) {
+  if (!row?.name) throw new Error(`${kind} run: a ${kind} row is required`);
+  const {
+    recordSkip = async () => {},
+    active = activeRuns,
+    limits = ROUTINE_LIMITS,
+    attended = false,
+    signal = null,
+    now = Date.now,
+    ownerProblem = routineOwnerProblem,
+    log = defaultLog,
+  } = deps;
+  const name = row.name;
+  const key = `${kind}:${name}`;
+  const skip = async (reason, extra = {}) => {
+    await Promise.resolve()
+      .then(() => recordSkip(name, new Date(now())))
+      .catch((error) => log(`${kind} "${name}": skip record failed: ${errorText(error)}`));
+    return { name, skipped: true, reason, sessionId: null, result: '', ...extra };
+  };
+  // A routine runs only in its own bot's thread: without that bot it waits.
+  const problem = await Promise.resolve()
+    .then(() => ownerProblem(row.ownerAgentId))
+    .catch(() => '');
+  if (problem) {
+    log(`${kind} "${name}": paused, ${ROUTINE_OWNER_PROBLEMS[problem]}`);
+    return skip('owner', { ownerProblem: problem, message: ROUTINE_OWNER_PROBLEMS[problem] });
+  }
+  if (active.has(key)) return skip('overlap');
+  active.add(key);
+  try {
+    if (!attended) {
+      const record = await withRecord(kind, deps);
+      const state = await Promise.resolve()
+        .then(() => record.state(name))
+        .catch(() => null);
+      const wait = routineBackoffRemaining(state, now(), limits);
+      if (wait > 0) {
+        log(`${kind} "${name}": skipped, backing off ${Math.ceil(wait / 1000)}s after failures in a row`);
+        return await skip('backoff');
+      }
+    }
+    return await run({ signal });
+  } finally {
+    active.delete(key);
+  }
+}
+
+/** Re-queue every result `row`'s record still holds, oldest first; resolves
+ *  the errors of the ones the queue still refuses. Never reruns the routine. */
+export async function redeliverRoutine(kind, row, deps = {}) {
+  const {
+    deliver = deliverScheduleResult,
+    onDeliveryFailed = armDeliveryRetry,
+    announce = announceRoutineRun,
+    log = defaultLog,
+  } = deps;
+  const record = await withRecord(kind, deps);
+  const entries = Object.entries(row?.resultDelivery || {}).sort(([, a], [, b]) =>
+    String(a?.at).localeCompare(String(b?.at))
+  );
+  const errors = [];
+  for (const [runId, entry] of entries) {
+    const result = entry?.result || {};
+    const item = {
+      runId,
+      kind,
+      ok: result.ok === true,
+      text: result.text || '',
+      runSessionId: result.runSessionId,
+      reason: result.reason,
+      paused: result.paused,
+    };
+    await queueResult(row, item, entry, {
+      ...record,
+      deliver,
+      announce,
+      log,
+      onDeliveryFailed: () => errors.push(runId),
+    });
+  }
+  if (errors.length) onDeliveryFailed();
+  return errors;
+}
+
+/** Daemon start (and the retry timer): re-queue every undelivered result of
+ *  every schedule and webhook. Resolves how many runs still wait. Without a
+ *  PostgreSQL cluster no routine exists, and none is started for this. */
+export async function recoverRoutineDeliveries(depsByKind = null) {
+  if (!depsByKind) {
+    const [{ pgClusterExists }, { resolvePluginData }] = await Promise.all([
+      import('../runtime/memory/lib/pg/adapter.mjs'),
+      import('../runtime/shared/plugin-paths.mjs'),
+    ]);
+    if (!pgClusterExists(resolvePluginData())) return 0;
+  }
+  let waiting = 0;
+  for (const kind of ['schedule', 'webhook']) {
+    const deps = await withRecord(kind, depsByKind?.[kind] || {});
+    for (const row of await deps.list()) {
+      if (row?.resultDelivery && Object.keys(row.resultDelivery).length) {
+        waiting += (await redeliverRoutine(kind, row, deps)).length;
+      }
+    }
+  }
+  return waiting;
+}
+
+/** The app's "retry" on one routine: rejects with the error when still refused. */
+export async function retryRoutineDelivery(kind, name, deps = {}) {
+  if (kind !== 'schedule' && kind !== 'webhook') throw new Error(`unknown routine kind "${kind}"`);
+  const record = await withRecord(kind, deps);
+  const row = await record.state(name);
+  if (!row) throw new Error(`${kind} "${name}" does not exist`);
+  const failed = await redeliverRoutine(kind, row, { ...deps, ...record });
+  if (failed.length) {
+    const latest = await record.state(name);
+    const error = latest?.resultDelivery?.[failed.at(-1)]?.error;
+    throw new Error(`"${name}": the result still could not be delivered${error ? ` (${error})` : ''}`);
+  }
+  return { name, delivered: Object.keys(row.resultDelivery || {}).length };
+}

package/src/session-runtime/resource-api.mjs

@@ -30,6 +30,11 @@ export function createResourceApi(deps) {
       if (!EXTENSION_SCOPE_KINDS.includes(scopeKind)) {
         throw new Error(`extension scope kind must be one of ${EXTENSION_SCOPE_KINDS.join(', ')}`);
       }
+      // A connector is on in every project unless a project switches it off
+      // (setProjectConnectorEnabled); "only in this project" no longer exists.
+      if (scopeKind === 'mcp') {
+        throw new Error('MCP servers are switched off per project in Project settings (setProjectConnectorEnabled)');
+      }
       let key = clean(name);
       if (!key) throw new Error('extension name is required');
       // Plugin scopes are keyed by registry id; a name must resolve to it.