mixdog 1.2.6 → 1.3.1

package/src/session-runtime/services/provider-admin.mjs

@@ -367,6 +367,7 @@ function oauthAuthFields(p, auth) {
     status: auth.status || (authenticated ? 'Set' : 'Not Set'),
     detail: auth.detail || p.desc,
     expiresAt: auth.expiresAt || null,
+    plan: auth.plan || null,
     usable: auth.usable === true || (auth.usable == null && authenticated),
     refreshable: auth.refreshable === true,
     reauthRequired: auth.reauthRequired === true,
@@ -958,8 +959,8 @@ async function withTimeout(run, ms, label) {
   }
 }
 
-function existingCustomEntry(cfgMod, id) {
-  const entry = cfgMod.loadConfig().providers?.[id];
+function existingCustomEntry(config, id) {
+  const entry = config.providers?.[id];
   if (!isCustomProviderId(id) || !isCustomProviderConfig(entry)) throw new Error(`unknown custom provider "${id}"`);
   return entry;
 }
@@ -1021,16 +1022,15 @@ function withStoredSettings(input, entry) {
   return out;
 }
 
-// Validated, secret-free config for `input`; the key (typed, else stored for an
-// existing provider) is resolved separately and never enters the config.
-async function resolveCustomInput(cfgMod, rawInput, options) {
-  let input = inputObject(rawInput);
-  validateCustomTransportFields(input);
+// Validated, secret-free config for `input` over one config snapshot (the
+// stored entry supplies an edit's omitted settings); the key (typed, else
+// stored for an existing provider) is resolved separately and never enters
+// the config. Synchronous, so a caller can merge and commit one snapshot.
+function customInputAt(snapshot, input, normalizeCustomProviderConfig, options) {
   const id = input.id === undefined ? null : input.id;
-  if (id) input = withStoredSettings(input, existingCustomEntry(cfgMod, id));
-  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
-  const config = normalizeCustomProviderConfig(input, options);
-  const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
+  const merged = id ? withStoredSettings(input, existingCustomEntry(snapshot, id)) : input;
+  const config = normalizeCustomProviderConfig(merged, options);
+  const typed = typeof merged.apiKey === 'string' ? merged.apiKey.trim() : '';
   const keyless = config.auth === 'none';
   const envName = keyless ? '' : config.apiKeyEnv || '';
   let apiKey = '';
@@ -1039,36 +1039,71 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   return { id, config, typed: keyless || envName ? '' : typed, apiKey, keyless, envName };
 }
 
+async function resolveCustomInput(cfgMod, rawInput, options) {
+  const input = inputObject(rawInput);
+  validateCustomTransportFields(input);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  return customInputAt(cfgMod.loadConfig(), input, normalizeCustomProviderConfig, options);
+}
+
+function requireCustomKey({ apiKey, keyless, envName }) {
+  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
+}
+
+// One key transaction per provider, from reading the rollback key to the
+// config commit or rollback: a failed save restores the key the preceding
+// save committed and never one a newer save wrote. Settings-only saves and
+// other providers never wait.
+const customKeySaves = new Map();
+
+function serializeCustomKeySave(id, run) {
+  const result = (customKeySaves.get(id) || Promise.resolve()).then(run);
+  const settled = result.then(
+    () => {},
+    () => {}
+  );
+  customKeySaves.set(id, settled);
+  settled.then(() => {
+    if (customKeySaves.get(id) === settled) customKeySaves.delete(id);
+  });
+  return result;
+}
+
 export async function saveCustomProvider(cfgMod, rawInput) {
   requireLocalProviderManagement();
-  const {
-    id: existingId,
-    config,
-    typed,
-    apiKey,
-    keyless,
-    envName,
-  } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
-  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
+  // Early verdict: an invalid save never touches the keychain.
+  const resolved = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
+  requireCustomKey(resolved);
+  const { id: existingId, typed } = resolved;
   const id = existingId || `custom-${randomUUID()}`;
-  const entry = { ...config, type: 'custom', enabled: config.enabled !== false };
-  const account = SECRET_ACCOUNTS.agentApiKey(id);
-  const previousKey = typed && existingId ? getAgentApiKey(id) : null;
-  if (typed) await saveSecretAsync(account, typed);
-  try {
-    const current = cfgMod.loadConfig();
-    cfgMod.saveConfig(
-      { ...current, providers: { ...(current.providers || {}), [id]: entry } },
-      { baseConfig: current }
-    );
-  } catch (error) {
-    if (typed) {
-      if (previousKey) await saveSecretAsync(account, previousKey);
-      else await deleteSecretAsync(account);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  const commit = async () => {
+    const account = SECRET_ACCOUNTS.agentApiKey(id);
+    const previousKey = typed && existingId ? getAgentApiKey(id) : null;
+    if (typed) await saveSecretAsync(account, typed);
+    let entry;
+    try {
+      // Synchronous from here: omitted settings come from the config this
+      // save commits over, so an edit that landed during the awaits above (a
+      // model's visibility, a peer save, a removal) is never reverted.
+      const current = cfgMod.loadConfig();
+      const latest = customInputAt(current, rawInput, normalizeCustomProviderConfig, { requireModels: false });
+      requireCustomKey(latest);
+      entry = { ...latest.config, type: 'custom', enabled: latest.config.enabled !== false };
+      cfgMod.saveConfig(
+        { ...current, providers: { ...(current.providers || {}), [id]: entry } },
+        { baseConfig: current }
+      );
+    } catch (error) {
+      if (typed) {
+        if (previousKey) await saveSecretAsync(account, previousKey);
+        else await deleteSecretAsync(account);
+      }
+      throw error;
     }
-    throw error;
-  }
-  return customProviderRow(id, entry);
+    return customProviderRow(id, entry);
+  };
+  return typed ? serializeCustomKeySave(id, commit) : commit();
 }
 
 const MODEL_PATCH_KEYS = new Set(['manual', 'hidden', 'name', 'contextWindow', 'maxOutputTokens', 'reasoning']);
@@ -1104,7 +1139,7 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   // Everything below is synchronous: the provider is read, patched and saved
   // without yielding, so a concurrent update can never be overwritten by a
   // provider object read before the await above.
-  const entry = existingCustomEntry(cfgMod, id);
+  const entry = existingCustomEntry(cfgMod.loadConfig(), id);
   const current = normalizeCustomProviderConfig(entry, { requireModels: false });
   const overrides = new Map(Object.entries(current.modelOverrides || {}));
   if (patch === null) {
@@ -1241,7 +1276,7 @@ function withoutProviderReferences(config, id) {
 export async function removeCustomProvider(cfgMod, rawId) {
   requireLocalProviderManagement();
   const id = String(rawId || '').trim();
-  existingCustomEntry(cfgMod, id);
+  existingCustomEntry(cfgMod.loadConfig(), id);
   // Secret first: a real keychain failure (locked, permission) leaves the
   // provider registered so the removal can be retried. A missing secret
   // (keyless provider) is not an error.

package/src/session-runtime/services/schedule-access.mjs

@@ -0,0 +1,91 @@
+// Who may manage automations (schedules and webhooks) from a chat, by the
+// calling session's provenance. Enforced by every setup automation action
+// (setup-tool/extended-actions.mjs), the chat-facing door of channel-admin:
+// - the human's own sessions (an ordinary Lead session, Mixy's home) manage
+//   every automation and may move one to an agent that exists;
+// - another agent's home thread manages only the automations it owns and can
+//   never give one away;
+// - a headless run (schedule, webhook, delegated agent, or a session that
+//   cannot be resolved) manages none — nor does it change any other setting
+//   (setup-tool/executor.mjs refuses every mutating setup action for it).
+// - a group-room member session is no background run, but it speaks for the
+//   room, not for the user: it creates or changes no agent, automation or
+//   other setting either.
+// The app's own panels call channel-admin directly and act for the human.
+import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
+import { mixyDisplayName } from '../../runtime/agent/orchestrator/session/mixy-name.mjs';
+import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+
+const INTERACTIVE_SOURCE_TYPES = new Set(['', 'lead', 'cli']);
+
+/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId? }` of a session record. */
+export function scheduleCallerScope(session) {
+  const id = String(session?.id || '');
+  const member = roomMemberOfSession(id);
+  if (member) return { kind: 'room-member', agentId: member.agentId };
+  const homeAgent = agentIdOfHomeSession(id);
+  if (homeAgent) return homeAgent === MIXY_AGENT_ID ? { kind: 'human' } : { kind: 'agent', agentId: homeAgent };
+  const headless =
+    !id ||
+    isAgentOwner(session) ||
+    Boolean(session.parentSessionId) ||
+    Boolean(session.ownerSessionId && session.ownerSessionId !== id) ||
+    !INTERACTIVE_SOURCE_TYPES.has(String(session.sourceType || '').toLowerCase());
+  return headless ? { kind: 'headless' } : { kind: 'human' };
+}
+
+/** Throws unless `scope` may `action` the `kind` ('schedule' | 'webhook')
+ *  automation `current` (null when creating) with `owner` the requested owner
+ *  ('' keeps the saved one). `agentIds` are the agents a transfer may name;
+ *  Mixy always counts. */
+export function assertAutomationAccess(
+  scope,
+  { kind = 'schedule', action, current = null, owner = '', agentIds = [] }
+) {
+  if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot ${action} ${kind}s`);
+  if (scope?.kind !== 'human' && scope?.kind !== 'agent') {
+    throw new Error(`A background run cannot ${action} ${kind}s`);
+  }
+  const requested = String(owner ?? '').trim();
+  const saved = current ? current.owner || MIXY_AGENT_ID : '';
+  if (scope.kind === 'agent') {
+    if (current && saved !== scope.agentId) {
+      throw new Error(
+        `${kind === 'webhook' ? 'Webhook' : 'Schedule'} "${current.name}" belongs to another agent; this thread manages only its own ${kind}s`
+      );
+    }
+    if (requested && requested !== scope.agentId) throw new Error(`This thread cannot give a ${kind} to another agent`);
+    return;
+  }
+  if (requested && requested !== saved && requested !== MIXY_AGENT_ID && !agentIds.includes(requested)) {
+    throw new Error(`Agent "${requested}" does not exist`);
+  }
+}
+
+/** Throws unless `caller` (scope `scope`) is Mixy — its home thread or an
+ *  ordinary Lead session acting as 'lead': only Mixy creates, edits or
+ *  deletes agent definitions from a chat. The app's own panels call the agent
+ *  editor directly and act for the human. */
+export function assertAgentEditorAccess(scope, caller, action) {
+  const acting = String(caller?.agent || '').trim();
+  if (scope?.kind === 'human' && (!acting || acting === MIXY_AGENT_ID)) return;
+  const name = mixyDisplayName();
+  throw new Error(
+    `Only ${name} (the representative agent) can create, edit or delete agents (setup ${action}); ask the user to do it with ${name} or in the Agents settings`
+  );
+}
+
+/** Throws when an agent's home thread changes another agent's settings. */
+export function assertOwnAgentSettings(scope, agentId, action) {
+  if (scope?.kind === 'agent' && String(agentId || '').trim() !== scope.agentId) {
+    throw new Error(`This thread manages only its own agent's settings (setup ${action})`);
+  }
+}
+
+/** Throws when `scope` is a headless run: it reads settings, never changes them. */
+export function assertInteractiveCaller(scope, action) {
+  if (scope?.kind === 'human' || scope?.kind === 'agent') return;
+  if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot change settings (setup ${action})`);
+  throw new Error(`A background run cannot change settings (setup ${action})`);
+}

package/src/session-runtime/session-create/session-options.mjs

@@ -2,11 +2,14 @@
 // the current runtime state: route, tool spec, ownership/lane, workflow pack,
 // memory context and compaction.
 import { normalizeCompactionConfig } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
-import { hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { toolSpecForMode } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
-import { pluginDataDir } from '../runtime-paths.mjs';
+import { STANDALONE_ROOT, pluginDataDir } from '../runtime-paths.mjs';
+import { readAgentFrontmatterPermission } from '../services/agent-tool/helpers.mjs';
 import { LEAD_DISALLOWED_TOOLS } from '../../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { HEADLESS_TOOL_PROFILE } from '../../runtime/agent/orchestrator/runtime-core/tool-profile.mjs';
+import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { MIXY_AGENT_ID } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 
 // Ownership and permission fields an agent-owned session inherits from its profile.
 function agentOwnedSessionFields(sessionProfile) {
@@ -31,14 +34,30 @@ export function sessionOptions(deps, coreMemoryContext) {
   // Load the active WORKFLOW.md pack once for both summary + context block.
   const {
     summary: workflow,
-    context: leadWorkflowContext,
+    leadPromptParts,
     packContext,
     orchestrationMode,
   } = activeWorkflowContext(rt.config, dataDir);
   const sessionProfile = rt.sessionProfile && typeof rt.sessionProfile === 'object' ? rt.sessionProfile : null;
   const agentOwned = sessionProfile?.owner === 'agent' || sessionProfile?.visibility === 'agent-only';
-  // Agent-owned sessions keep the Active Workflow block only.
-  const workflowContext = agentOwned ? packContext : leadWorkflowContext;
+  // Agent or coding mode, from the one resolver (agent-mode.mjs).
+  const { mode: sessionMode, agentId: actingAgent } = resolveSessionMode({
+    sessionId: rt.reservedSessionId,
+    profile: sessionProfile,
+  });
+  // An agent's home thread: a user conversation that runs AS that agent (its
+  // AGENT.md role and permission); route comes with the create call.
+  const homeAgent = agentOwned ? '' : clean(sessionProfile?.homeAgent);
+  const homePermission = homeAgent ? readAgentFrontmatterPermission(homeAgent, dataDir, STANDALONE_ROOT) : null;
+  // A coding task session an agent created (session create): the user's own
+  // Lead, tagged with its origin; `sourceName` lets the Agents list file it.
+  const taskOrigin = agentOwned ? null : sessionProfile?.taskOrigin || null;
+  // Every session leads BP3 with the Active Workflow block; a Lead adds its
+  // orchestration and catalog slices (coding, agent mode or Mixy's).
+  const workflowContext = packContext;
+  const leadWorkflowParts = agentOwned
+    ? undefined
+    : leadPromptParts({ agentMode: sessionMode === AGENT_MODE, mixy: actingAgent === MIXY_AGENT_ID });
   const callerDisallowedTools = [
     ...(agentOwned ? [] : LEAD_DISALLOWED_TOOLS),
     ...(!agentOwned && rt.disallowDelegation ? ['agent'] : []),
@@ -51,7 +70,8 @@ export function sessionOptions(deps, coreMemoryContext) {
     tools: toolSpecForMode(rt.mode),
     ...(Array.isArray(schemaAllowedTools) ? { schemaAllowedTools } : {}),
     owner: agentOwned ? 'agent' : 'cli',
-    agent: agentOwned ? sessionProfile?.agent || 'worker' : 'lead',
+    agent: agentOwned ? sessionProfile?.agent || 'worker' : homeAgent || 'lead',
+    ...(homePermission ? { permission: homePermission } : {}),
     lane: agentOwned ? 'agent' : 'cli',
     // One-shot `mixdog exec` runs carry their own source so session catalogs
     // can keep them out of the user's resumable list.
@@ -60,7 +80,12 @@ export function sessionOptions(deps, coreMemoryContext) {
       : rt.toolProfile === HEADLESS_TOOL_PROFILE
         ? 'exec'
         : 'lead',
-    sourceName: agentOwned ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent' : 'main',
+    sourceName: agentOwned
+      ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent'
+      : taskOrigin
+        ? `agent:${taskOrigin.agentId}`
+        : 'main',
+    ...(taskOrigin ? { taskOrigin } : {}),
     ...(rt.approvalMode ? { approvalMode: rt.approvalMode } : {}),
     clientHostPid: sessionProfile?.clientHostPid || process.pid,
     mcpScopeId: rt.mcpScopeId,
@@ -71,6 +96,8 @@ export function sessionOptions(deps, coreMemoryContext) {
     coreMemoryContext,
     workflow,
     workflowContext,
+    ...(leadWorkflowParts ? { leadWorkflowParts } : {}),
+    sessionMode,
     orchestrationMode,
     fast: rt.route.fast === true,
     autoEffort: rt.route.autoEffort !== false,

package/src/session-runtime/session-hooks.mjs

@@ -5,6 +5,8 @@
 // facade's hookCommonPayload / currentCwd accessor + the session itself. All
 // properties are non-enumerable/configurable/writable so the loop/manager can
 // read them by name without changing session enumeration.
+import { roomMemberOfSession } from '../runtime/agent/orchestrator/session/agent-room.mjs';
+import { roomMemberToolDecision } from './room-member-gate.mjs';
 
 export function attachSessionHooks(session, { hooks, hookCommonPayload, getCwd }) {
   const identity = (input) => ({
@@ -26,20 +28,26 @@ export function attachSessionHooks(session, { hooks, hookCommonPayload, getCwd }
   // rejection cannot escape the tool loop or the compaction flow.
   const dispatcher = (event, payload) => (input) => hooks.dispatch(event, hookCommonPayload(payload(input)));
 
-  // PreToolUse bridge.
-  define('beforeToolHook', (input, options = {}) =>
-    hooks.beforeTool(
+  // PreToolUse bridge. A group-room member's mutating calls always ask the
+  // user (room-member-gate.mjs), whatever the hooks decided short of a deny.
+  define('beforeToolHook', async (input, options = {}) => {
+    const name = input?.name || input?.tool_name;
+    const args = input?.args || input?.tool_input;
+    const cwd = input?.cwd || getCwd();
+    const decision = await hooks.beforeTool(
       hookCommonPayload({
         ...input,
         session_id: input?.sessionId || input?.session_id || session?.id,
-        tool_name: input?.name || input?.tool_name,
-        tool_input: input?.args || input?.tool_input,
+        tool_name: name,
+        tool_input: args,
         tool_use_id: input?.toolCallId || input?.tool_use_id,
-        cwd: input?.cwd || getCwd(),
+        cwd,
       }),
       options
-    )
-  );
+    );
+    if (!roomMemberOfSession(session?.id)) return decision;
+    return roomMemberToolDecision({ name, args, cwd }, decision);
+  });
   // PostToolUse: bridge runtime tool completions to the standard hook bus.
   define('afterToolHook', dispatcher('PostToolUse', toolPayload));
   // PostToolUseFailure: dispatched by loop.mjs only when a tool execution

package/src/session-runtime/setup-tool/executor.mjs

@@ -9,6 +9,12 @@ import { INSTRUCTION_FILES_MODES } from '../../runtime/shared/instruction-files-
 import { MEDIA_KINDS } from '../../runtime/media/tool-defs.mjs';
 import { SETUP_DESKTOP_DOMAINS, SETUP_HANDOFFS } from './settings-contract.mjs';
 import { executeExtendedSetupAction, publicAutomation, publicHookRule, validateMcpInput } from './extended-actions.mjs';
+import {
+  assertAgentEditorAccess,
+  assertInteractiveCaller,
+  assertOwnAgentSettings,
+  scheduleCallerScope,
+} from '../services/schedule-access.mjs';
 import { SETUP_DESKTOP_UNCLAIMED, createSetupUiRequests } from './ui-requests.mjs';
 import {
   SETUP_ACTIONS,
@@ -20,8 +26,11 @@ import {
 } from './tool-defs.mjs';
 import { schemaValueError } from '../../runtime/shared/schema-value-error.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { CONNECTOR_IDS, connectorById } from '../../runtime/shared/connector-catalog.mjs';
 import profileConfig from '../../runtime/shared/profile-config.cjs';
 
+const AGENT_DEFINITION_ACTIONS = new Set(['create_definition', 'save_definition', 'delete_definition']);
+
 const PROFILE_VALUE_IDS = Object.freeze({
   language: profileConfig.PROFILE_LANGUAGES.map((entry) => entry.id),
   experienceLevel: ['', ...profileConfig.PROFILE_EXPERIENCE_LEVELS.map((entry) => entry.id)],
@@ -35,6 +44,7 @@ const ACTION_APPLIES_TO = {
   save_automation: 'the automation worker; scheduled runs follow the saved timing',
   delete_automation: 'future automation runs',
   set_automation_enabled: 'future automation runs',
+  run_automation: "one run now; its result posts into the owning agent's thread",
   set_webhook_config: 'the webhook worker after configuration reload',
   add_hook_rule: 'subsequent tool calls; no restart required',
   set_hook_rule_enabled: 'subsequent tool calls; no restart required',
@@ -55,9 +65,10 @@ const OPEN_TARGET_HINTS = Object.freeze({
   autoclear: 'Desktop: Settings → Context · TUI: /autoclear',
   memory:
     'Desktop: Extensions → Plugin → Built-in (Memory); core memories under Projects → project → Memories · TUI: /memory',
-  mcp: 'Desktop: Extensions → Skill tab → MCP · TUI: /mcp',
-  skills: 'Desktop: Extensions → Skill tab → Skills · TUI: /skills',
-  plugins: 'Desktop: Extensions → Plugin tab → Plugins · TUI: /plugins',
+  mcp: 'Desktop: Extensions → Connectors tab · TUI: /mcp',
+  skills: 'Desktop: Skills (activity rail) · TUI: /skills',
+  plugins:
+    'Desktop: Extensions → Extensions tab (plugins that bring MCP servers: Connectors tab → Custom connectors) · TUI: /plugins',
   update: 'Desktop: Settings → System → Update · TUI: /update',
   usage: 'Desktop: /usage in the composer · TUI: /usage',
   doctor: 'Desktop: Settings → System → Doctor, or /doctor in the composer · TUI: /doctor',
@@ -133,6 +144,7 @@ function publicProviderRows(setup) {
       pick(row, {
         reauthRequired: row.reauthRequired === true,
         expiresAt: row.expiresAt || null,
+        plan: row.plan || null,
       })
     ),
     local: (setup?.local || []).map((row) =>
@@ -167,6 +179,7 @@ function configuredProviderRows(rows, accountCount) {
         kind,
         authenticated: row.authenticated,
         status: row.status,
+        ...(kind === 'oauth' ? { plan: row.plan || null } : {}),
         ...(row.reauthRequired ? { reauthRequired: true } : {}),
         ...accounts,
       });
@@ -364,6 +377,17 @@ const SETUP_STATUS_READERS = {
 // schema, the per-action field list and the route/object-argument minimums.
 function validateSetupInput(args) {
   const action = requireEnum(args?.action, SETUP_ACTIONS, 'action');
+  // Old callers still ask to connect GitHub: it is the signed-in GitHub CLI, not a catalog connector.
+  if (
+    action === 'connect_connector' &&
+    String(args.connector ?? '')
+      .trim()
+      .toLowerCase() === 'github'
+  ) {
+    throw new Error(
+      'GitHub uses the signed-in GitHub CLI; no connector needed. Use the github tool or Settings → Git.'
+    );
+  }
   const validationError = schemaValueError({ ...args, action }, SETUP_TOOL_DEFS[0].inputSchema, 'setup');
   if (validationError) throw new Error(`[tool-input-validation] ${validationError}`);
   const fields = SETUP_ACTION_FIELDS[action].split(' ').filter(Boolean);
@@ -627,6 +651,25 @@ const SETUP_ACTION_HANDLERS = {
   remove_plugin: async (rt, args) => ({
     plugin: (await rt.removePlugin(requireText(args.name, 'name')))?.plugin || null,
   }),
+  // The chat path of the one-click connect: the attached Desktop renders this
+  // call as a connect card (agent-chat connector card) that runs the same flow
+  // as Extensions → 커넥터. Nothing is connected here.
+  connect_connector: async (rt, args) => {
+    const entry = connectorById(requireText(args.connector, 'connector'));
+    if (!entry || entry.ownKey) throw new Error(`connector must be one of ${CONNECTOR_IDS.join(', ')}`);
+    const server = (rt.mcpStatus?.()?.servers || []).find((row) => row.connector === entry.id) || null;
+    const connected = server?.connected === true;
+    return {
+      connector: entry.id,
+      name: entry.name,
+      backend: entry.backend.kind,
+      ...(server ? { server: server.name } : {}),
+      connected,
+      note: connected
+        ? `${entry.name} is already connected.`
+        : `A connect card for ${entry.name} is shown in this conversation; the user presses it (Desktop: Extensions → 커넥터). Check status mcp afterwards.`,
+    };
+  },
   enable_plugin_mcp: async (rt, args) => {
     const name = requireText(args.name, 'name');
     const plugin = ((await rt.pluginsStatus())?.plugins || []).find((row) => row.name === name || row.id === name);
@@ -645,6 +688,7 @@ const READ_ONLY_SETUP_ACTIONS = new Set([
   'open',
   'list_models',
   'get_mcp_server',
+  'connect_connector',
   'read_definition',
   'search_local_models',
   'inspect_hf_model',
@@ -656,6 +700,7 @@ const BACKGROUND_SETUP_ACTIONS = new Set([
   'maintain_local_model',
   'cancel_local_installation',
   'reconnect_mcp',
+  'run_automation',
 ]);
 
 function setupMutationReceipt(action, result) {
@@ -671,7 +716,16 @@ function setupMutationReceipt(action, result) {
   );
 }
 
-export function createSetupToolExecutor({ getApi, getConfig, notifySessionUi, getSessionId, flushSettings }) {
+/** `getCallerSession(id)` returns the calling session's record (null when it
+ *  cannot be resolved): automation actions authorize by its provenance. */
+export function createSetupToolExecutor({
+  getApi,
+  getConfig,
+  notifySessionUi,
+  getSessionId,
+  getCallerSession,
+  flushSettings,
+}) {
   const desktop = createSetupUiRequests({ notifySessionUi, getSessionId });
   const api = () => {
     const facade = getApi?.();
@@ -701,12 +755,31 @@ export function createSetupToolExecutor({ getApi, getConfig, notifySessionUi, ge
     };
   }
 
-  async function execute(args, { signal }) {
+  async function execute(args, { signal, callerSessionId }) {
     signal?.throwIfAborted();
     const requestDesktop = (request) => desktop.request(request, { signal });
     const action = validateSetupInput(args);
+    // The session that made this call, not just the runtime's own Lead.
+    const sessionId = clean(callerSessionId) || clean(getSessionId?.());
+    const caller = (sessionId && getCallerSession?.(sessionId)) || null;
+    // A headless run (schedule, webhook, delegated agent) only reads settings:
+    // it never creates agents, definitions or automations, nor changes any
+    // other setting. Hosts without session provenance (no getCallerSession)
+    // skip this gate; automation actions still refuse an unknown caller.
+    if (getCallerSession && !READ_ONLY_SETUP_ACTIONS.has(action)) {
+      const scope = scheduleCallerScope(caller);
+      assertInteractiveCaller(scope, action);
+      // Agent definitions (contacts) change only from Mixy; another agent's
+      // home changes only its own agent settings.
+      if (AGENT_DEFINITION_ACTIONS.has(action) && args.definitionKind === 'agent') {
+        assertAgentEditorAccess(scope, caller, action);
+      }
+      if (action === 'set_agent_route') assertOwnAgentSettings(scope, args.agent, action);
+    }
     const rt = action === 'status' || action === 'open' ? null : api();
-    if (!Object.hasOwn(SETUP_ACTION_HANDLERS, action)) return executeExtendedSetupAction(rt, args, requestDesktop);
+    if (!Object.hasOwn(SETUP_ACTION_HANDLERS, action)) {
+      return executeExtendedSetupAction(rt, args, requestDesktop, { sessionId, caller });
+    }
     return SETUP_ACTION_HANDLERS[action](rt, args, { requestDesktop, readStatus, openSurface });
   }