mixdog 1.2.6 → 1.3.1

package/src/session-runtime/turn/session-ops.mjs

@@ -29,15 +29,22 @@ export function createSessionOps(deps) {
     } catch {}
   }
 
+  // `rebuildPrompt` (an agent chat's "대화 초기화"): refused while a turn
+  // runs, and the emptied session's prompt and tool surface are then rebuilt
+  // from the current rules, as a new session's are (refreshEmptySessionToolPolicy).
   async function clear(options = {}) {
     const session = getSession();
     if (!session?.id) return false;
+    const rebuild = options.rebuildPrompt === true;
+    if (rebuild && getActiveTurnCount() > 0) throw new Error('The session is running a turn; wait for it to finish.');
     const cleared = await mgr.clearSessionMessages(session.id, options);
     if (!cleared) return false;
     setSession(typeof cleared === 'object' ? cleared : mgr.getSession(session.id) || session);
     if (options.recoverAgent === true) recoverAgentWorkers();
+    let promptRebuilt = false;
+    if (rebuild) promptRebuilt = (await refreshEmptySessionToolPolicy?.())?.appliedToCurrentSession === true;
     invalidateContextStatusCache();
-    return true;
+    return rebuild ? { promptRebuilt } : true;
   }
 
   // Message-selector rewind: drop the chosen user prompt and everything

package/src/session-runtime/turn/turn-run/ask-callbacks.mjs

@@ -61,11 +61,17 @@ export function createAskCallbacks({ transcript, notifyFnForSession, scheduleSea
 
   // The turn's change-record key rides the caller's transcript metadata (in
   // place: the stream stamps assistantAt on this same object), so the
-  // persisted user row and completion carry it across restore.
+  // persisted user row and completion carry it across restore. A merged
+  // batch also names every submission it delivers, so a queued-input restore
+  // can tell each one delivered.
   function stampCheckpoint(options) {
     const meta = options.transcriptMeta;
+    if (!meta || typeof meta !== 'object') return meta;
     const checkpointId = String(options.id || '').trim();
-    if (checkpointId && meta && typeof meta === 'object') meta.checkpointId = checkpointId;
+    if (checkpointId) meta.checkpointId = checkpointId;
+    if (Array.isArray(options.submissionIds) && options.submissionIds.length > 1) {
+      meta.submissionIds = options.submissionIds.map(String);
+    }
     return meta;
   }
 
@@ -74,6 +80,8 @@ export function createAskCallbacks({ transcript, notifyFnForSession, scheduleSea
       beforeToolExecution: () => turn.snapshot.promise || Promise.resolve(),
       transcriptMeta: stampCheckpoint(options),
       promptSource: options.promptSource,
+      // A routine turn's trusted selection text (its instructions only).
+      ...(typeof options.skillSelection === 'string' ? { skillSelection: options.skillSelection } : {}),
       retryFailedTurn: options.retryFailedTurn === true,
       retryTurnId: options.retryTurnId,
       retryAttemptId: options.retryAttemptId,

package/src/session-runtime/turn/turn-run/turn-prepare.mjs

@@ -10,6 +10,8 @@ import { throwIfAborted } from '../../../runtime/shared/abort-race.mjs';
 // UserPromptSubmit hook.
 export function createTurnPreparation({
   getSession,
+  setSession,
+  mgr,
   getCurrentCwd,
   awaitRoutePreparation,
   createCurrentSession,
@@ -24,6 +26,7 @@ export function createTurnPreparation({
   prepareTurnWorkspace,
   admitTurnWorkspace,
   applyPendingRoute,
+  applyPendingAgentProfile,
 }) {
   const scopedMcpTools = (session) => scopedMcpToolsFor(session, getConfig());
 
@@ -104,6 +107,15 @@ export function createTurnPreparation({
     }
     throwIfAborted(turn.signal);
     assertSessionAdmission?.();
+    // askSession runs the turn on the session the store serves for this id.
+    // While this runtime idled, the store's idle sweep may have released the
+    // snapshot it holds, and the store then serves a fresh parse of the file:
+    // preparing the turn on the held copy would leave its one-shot work (the
+    // first-turn MCP fold, its flag) undone on the turn's session, which then
+    // rewrites the prompt it already sent on the next turn. Prepare the turn
+    // on the session it runs on (as completeTurn adopts it afterwards).
+    const stored = mgr.getSession(getSession().id);
+    if (stored && stored !== getSession()) setSession(stored);
     // Turn admission: waits while this session's workspace transitions or
     // another session changes the checkout this session works in, then holds
     // the turn registered (released by settleTurn) so no checkout changes
@@ -131,6 +143,8 @@ export function createTurnPreparation({
       assertSessionAdmission?.();
     }
     const modelSwitch = applyPendingRoute?.();
+    // An agent profile saved while the previous turn ran applies from this one.
+    await applyPendingAgentProfile?.();
     options.onRouteApplied?.(getSession());
     if (modelSwitch) options.onModelSwitch?.(modelSwitch);
     ensureSessionTranscriptWriter?.();

package/src/session-runtime/webhook-session-run.mjs

@@ -1,83 +1,65 @@
 /**
- * Run an inbound webhook as a VISIBLE Mixdog session (schedules parity, user
- * decision): no Lead-context injection, no channel forward — every fire is a
- * fresh New task with the endpoint's prompt/model/workflow/project, owned by
- * 'user' + sourceType 'webhook' (sidebar Automations section, newest per
- * name). Invoked from the channels worker's webhook dispatch.
+ * Run an inbound webhook: the endpoint's instructions and the fenced event
+ * payload become one turn in its owner bot's home thread
+ * (routine-home-turn.mjs). Invoked from the channels worker's webhook
+ * dispatch and the app's "Run now".
  */
-import { loadConfig } from '../runtime/agent/orchestrator/config.mjs';
-import { createSession } from '../runtime/agent/orchestrator/session/manager/session-lifecycle.mjs';
-import { askSession } from '../runtime/agent/orchestrator/session/manager/ask-session.mjs';
-import { modelRouteFields, parseScheduleModelRef } from '../runtime/shared/schedule-model-ref.mjs';
-import { migrateCodexRoute } from '../runtime/agent/orchestrator/providers/openai-oauth-catalog-store.mjs';
-import { automationWorkflowOpts } from './automation-workflow.mjs';
-import { runAutomationTurns } from './automation-agents.mjs';
-import { automationPromptContent } from '../runtime/shared/automation-attachments.mjs';
+import { markEndpointRun } from '../runtime/channels/lib/webhooks-db.mjs';
+import { runOwnedAutomation } from './owned-automation-run.mjs';
+import { runRoutineTurn } from './routine-home-turn.mjs';
 
-/** Endpoint model ref wins; the maintenance.webhook route is the fallback. */
-function webhookRoute(modelRef) {
-  if (modelRef) {
-    const ref = parseScheduleModelRef(modelRef);
-    // A model the provider catalog superseded runs on its successor.
-    if (ref && typeof ref === 'object') return migrateCodexRoute(ref);
+/**
+ * One run of the endpoint in its owner's thread (Mixy when absent): a run
+ * while the previous one of the same endpoint is still going is skipped (and
+ * stamped), and every outcome is stamped on the endpoint. `prompt` carries the
+ * fenced payload; `skillSelection` only the endpoint's instructions.
+ */
+export async function runWebhookSession({ ownerAgentId = null, ...options }, deps = {}) {
+  const name = String(options.name || '').trim();
+  const { markRun = markEndpointRun, run = runWebhookTurn, ...ownedDeps } = deps;
+  const stamp = (outcome) =>
+    markRun(name, outcome, new Date()).catch((error) =>
+      process.stderr.write(`mixdog webhook: ${name} ${outcome} stamp failed: ${error?.message || error}\n`)
+    );
+  let outcome;
+  try {
+    // The dispatch's cancellation reaches the run as `signal`.
+    outcome = await runOwnedAutomation(
+      'webhook',
+      { name, ownerAgentId },
+      ({ signal }) => run({ ...options, ownerAgentId, signal }),
+      { recordSkip: () => stamp('skipped'), signal: options.signal || null, ...ownedDeps }
+    );
+  } catch (error) {
+    await stamp('failed');
+    throw error;
   }
-  const cfg = loadConfig({ secrets: false });
-  const maintenance = cfg?.maintenance?.webhook;
-  if (maintenance?.provider && maintenance?.model) return modelRouteFields(maintenance);
-  throw new Error('webhook run has no model: set one on the endpoint or configure maintenance.webhook');
+  if (!outcome.skipped) await stamp('success');
+  return outcome;
 }
 
-export async function runWebhookSession({
+/** One turn in the owner's thread; `skillSelection` absent selects nothing. */
+function runWebhookTurn({
   name,
-  model = null,
   prompt,
+  ownerAgentId = null,
   cwd = null,
-  workflow = null,
   attachments = null,
-  signal = null,
-  // Endpoint-authored instructions: the run's ONLY skill-selection input.
-  // `prompt` also carries the fenced external payload, which must never
-  // select a skill; absent means nothing selects.
+  event = '',
   skillSelection = '',
+  signal = null,
 }) {
   const endpoint = String(name || '').trim();
-  const body = String(prompt || '').trim();
   if (!endpoint) throw new Error('runWebhookSession: endpoint name required');
-  if (!body) throw new Error(`webhook "${endpoint}" has no prompt body`);
-  // The dispatcher's cancellation (delivery timeout) has to reach the run
-  // itself: an already-cancelled dispatch must not even create a session.
-  if (signal?.aborted) throw signal.reason ?? new Error('webhook dispatch aborted');
-  const route = webhookRoute(model);
-  const projectCwd = cwd ? String(cwd) : null;
-  const session = createSession({
-    ...modelRouteFields(route),
-    owner: 'user',
-    sourceType: 'webhook',
-    sourceName: endpoint,
-    ...(projectCwd ? { cwd: projectCwd } : {}),
-    desktopSession: projectCwd
-      ? { classification: 'project', projectPath: projectCwd }
-      : { classification: 'task', projectPath: null },
-    ...automationWorkflowOpts(workflow),
+  return runRoutineTurn({
+    kind: 'webhook',
+    name: endpoint,
+    ownerAgentId,
+    prompt,
+    skillSelection: String(skillSelection ?? ''),
+    attachments,
+    cwd,
+    event,
+    signal,
   });
-  // The user message leads with the endpoint's instructions, so Recent titles
-  // read as the user-authored intent rather than payload noise.
-  // Stored attachments ride along as composer-style content parts.
-  const content = automationPromptContent(body, attachments);
-  // askOpts.signal is the parent-abort link: it is cascaded onto the turn
-  // controller, so aborting it stops the in-flight provider/tool work instead
-  // of leaving a timed-out delivery's session running with live side effects.
-  const ask = (turnContent, askOpts) =>
-    askSession(session.id, turnContent, null, null, projectCwd || undefined, undefined, {
-      ...askOpts,
-      ...(signal ? { signal } : {}),
-    });
-  // Agents the run delegates to report back; each result is the next turn
-  // (runAutomationTurns marks those turns as task notifications).
-  const result = await runAutomationTurns(
-    session.id,
-    () => ask(content, { skillSelection: String(skillSelection ?? '') }),
-    ask
-  );
-  return { sessionId: session.id, result: String(result?.content || '') };
 }

package/src/session-runtime/workflow-agents-api/agent-connectors.mjs

@@ -0,0 +1,239 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  CONNECTOR_PERMISSIONS,
+  connectorEnabled,
+  DENY_ALL_CONNECTORS,
+  migrateLegacyConnectorPolicy,
+  PROJECT_CONNECTORS_FILE,
+  parseConnectorPolicy,
+  readProjectConnectorsFile,
+  storedConnectorPolicy,
+} from '../../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
+import {
+  cwdWithinProjects,
+  extensionScopesFromConfig,
+  withExtensionScope,
+} from '../../runtime/shared/extension-scopes.mjs';
+import { withFileLockSync, writeJsonAtomicSync } from '../../runtime/shared/atomic-file.mjs';
+import { listProjectsStrict } from '../../runtime/shared/projects.mjs';
+import { isSelfMcpToolName, parseMcpToolName } from '../../runtime/shared/tool-primitives.mjs';
+import { resolveDataDir } from './shared.mjs';
+
+const samePath = (left, right) => cwdWithinProjects(left, [right]) && cwdWithinProjects(right, [left]);
+const PLUGIN_REGISTRY_WARNING = /^plugin MCP servers unavailable/;
+
+// Host-only surface for the connector switches ("사용할 커넥터"): the global
+// MCP servers (with their sign-in state), and per agent and per project which
+// of them are on. Every installed connector is on unless switched off there.
+// Agent policies go through the agent editor, which keeps every other
+// agent.json key; project policies live in <data>/project-connectors.json,
+// keyed by the registered Project path.
+export function createAgentConnectorsApi(deps, editor) {
+  const {
+    mcpStatus,
+    getMcpTools,
+    getConfig,
+    saveConfigAndAdopt,
+    resolveConfiguredMcpCatalog,
+    listProjects = listProjectsStrict,
+  } = deps;
+  const dataDir = () => resolveDataDir(deps);
+  const projectFile = () => join(dataDir(), PROJECT_CONNECTORS_FILE);
+  const installedIds = () => listConnectors().map(({ id }) => id);
+  const switches = (policy) => installedIds().map((id) => ({ id, enabled: connectorEnabled(policy, id) }));
+  // A legacy list or an unreadable policy becomes its deny-list equivalent
+  // over today's connectors before any edit, so an edit never widens it.
+  const editablePolicy = (agentId) =>
+    migrateLegacyConnectorPolicy(editor.getAgentConnectorPolicy(agentId), installedIds()) || { off: [], tools: {} };
+
+  function listConnectors() {
+    return (mcpStatus()?.servers || []).map((row) => ({
+      id: row.name,
+      enabled: row.enabled !== false,
+      status: row.status,
+      connected: row.connected === true,
+      authRequired: row.authRequired === true,
+      signedIn: row.oauth ? row.oauth.signedIn === true : null,
+      transport: row.transport,
+      toolCount: row.toolCount || 0,
+      source: row.source,
+      ...(row.error ? { error: row.error } : {}),
+    }));
+  }
+
+  // `readOnly` is the server's own `readOnlyHint` (null when it gives none).
+  function listConnectorTools(connectorId) {
+    return (getMcpTools() || [])
+      .filter((tool) => !isSelfMcpToolName(tool) && parseMcpToolName(tool)?.server === connectorId)
+      .map((tool) => {
+        const annotations = tool.annotations && typeof tool.annotations === 'object' ? tool.annotations : {};
+        return {
+          name: parseMcpToolName(tool).tool,
+          description: tool.description || '',
+          annotations,
+          readOnly: typeof annotations.readOnlyHint === 'boolean' ? annotations.readOnlyHint : null,
+        };
+      });
+  }
+
+  const requireId = (value, label) => {
+    const id = typeof value === 'string' ? value.trim() : '';
+    if (!id) throw new Error(`${label} is required`);
+    return id;
+  };
+
+  /** `[{ id, enabled }]`: each installed connector and whether the agent may use it. */
+  function getAgentConnectors(agentId) {
+    return switches(editor.getAgentConnectorPolicy(agentId));
+  }
+
+  /** Switch one connector on or off for the agent; returns its switches. */
+  async function setAgentConnectorEnabled(agentId, connectorId, enabled) {
+    const id = requireId(connectorId, 'connector id');
+    if (typeof enabled !== 'boolean') throw new TypeError('enabled must be a boolean');
+    const policy = editablePolicy(agentId);
+    const off = enabled ? policy.off.filter((entry) => entry !== id) : [...policy.off, id];
+    await editor.setAgentConnectorPolicy(agentId, storedConnectorPolicy({ off, tools: policy.tools }));
+    return getAgentConnectors(agentId);
+  }
+
+  // Older per-tool overrides keep working (the profile no longer shows them):
+  // `permission` null drops the tool's entry, so the tool is auto again.
+  async function setAgentConnectorToolPermission(agentId, connectorId, toolName, permission) {
+    if (permission != null && !CONNECTOR_PERMISSIONS.includes(permission)) {
+      throw new Error(`permission must be one of ${CONNECTOR_PERMISSIONS.join(', ')}`);
+    }
+    const server = requireId(connectorId, 'connector id');
+    const tool = requireId(toolName, 'tool name');
+    const policy = editablePolicy(agentId);
+    const own = { ...policy.tools[server] };
+    if (permission == null) delete own[tool];
+    else own[tool] = permission;
+    return editor.setAgentConnectorPolicy(
+      agentId,
+      storedConnectorPolicy({ off: policy.off, tools: { ...policy.tools, [server]: own } })
+    );
+  }
+
+  /** The registered Project at `projectPath` (its path is the policy key). */
+  function registeredProject(projectPath) {
+    const path = requireId(projectPath, 'project path');
+    const project = listProjects().find((entry) => samePath(entry.path, path));
+    if (!project) throw new Error(`project not registered: ${path}`);
+    return project.path;
+  }
+
+  function projectPolicies() {
+    const policies = readProjectConnectorsFile(projectFile());
+    if (policies === DENY_ALL_CONNECTORS) return policies;
+    return policies || [];
+  }
+
+  /** `[{ id, enabled }]`: each installed connector and whether the project allows it. */
+  function getProjectConnectors(projectPath) {
+    const root = registeredProject(projectPath);
+    const policies = projectPolicies();
+    if (policies === DENY_ALL_CONNECTORS) return switches(DENY_ALL_CONNECTORS);
+    const off = policies.filter((entry) => samePath(entry.root, root)).flatMap((entry) => entry.off);
+    return switches({ off, tools: {} });
+  }
+
+  /** Rewrite the project policy file under its lock; `edit` maps root → off list. */
+  function updateProjectPolicies(edit) {
+    const path = projectFile();
+    withFileLockSync(`${path}.lock`, () => {
+      const policies = projectPolicies();
+      // A file that cannot be read is never overwritten: it may hold switches.
+      if (policies === DENY_ALL_CONNECTORS) {
+        throw new Error(`${PROJECT_CONNECTORS_FILE} cannot be read; fix or remove it first`);
+      }
+      const byRoot = new Map(policies.map(({ root, off }) => [root, off]));
+      edit(byRoot);
+      const projects = {};
+      for (const [root, off] of byRoot) if (off.length) projects[root] = { off: [...new Set(off)].sort() };
+      writeJsonAtomicSync(path, { projects }, { lock: false });
+    });
+  }
+
+  /** Switch one connector on or off for the project; returns its switches. */
+  function setProjectConnectorEnabled(projectPath, connectorId, enabled) {
+    const id = requireId(connectorId, 'connector id');
+    if (typeof enabled !== 'boolean') throw new TypeError('enabled must be a boolean');
+    const root = registeredProject(projectPath);
+    updateProjectPolicies((byRoot) => {
+      const key = [...byRoot.keys()].find((entry) => samePath(entry, root)) ?? root;
+      const off = (byRoot.get(key) || []).filter((entry) => entry !== id);
+      byRoot.set(key, enabled ? off : [...off, id]);
+    });
+    return getProjectConnectors(root);
+  }
+
+  /** One-time, idempotent: legacy allow lists become deny lists. Agent lists
+   *  (agent.json arrays) switch off each configured connector they did not
+   *  enable; MCP project scopes (`extensionScopes.mcp`, "only in these
+   *  projects") switch the server off in every other registered Project.
+   *  Skipped while the configured connector set is not fully known. */
+  function migrateConnectorPolicies() {
+    const catalog = resolveConfiguredMcpCatalog?.();
+    if (!catalog || (catalog.warnings || []).some((warning) => PLUGIN_REGISTRY_WARNING.test(warning?.message || ''))) {
+      return { skipped: true, agents: [], scopes: [] };
+    }
+    const installed = Object.keys(catalog.servers || {});
+    const agents = [];
+    const agentsDir = join(dataDir(), 'agents');
+    let entries = [];
+    try {
+      entries = readdirSync(agentsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory());
+    } catch {
+      entries = [];
+    }
+    for (const entry of entries) {
+      const file = join(agentsDir, entry.name, 'agent.json');
+      let manifest;
+      try {
+        manifest = JSON.parse(readFileSync(file, 'utf8'));
+      } catch {
+        continue; // missing or unreadable: the runtime already denies or allows as before
+      }
+      if (!Array.isArray(manifest?.connectors)) continue;
+      const next = storedConnectorPolicy(
+        migrateLegacyConnectorPolicy(parseConnectorPolicy(manifest.connectors), installed)
+      );
+      if (next) manifest.connectors = next;
+      else delete manifest.connectors;
+      writeJsonAtomicSync(file, manifest);
+      agents.push(entry.name);
+    }
+    const config = getConfig?.();
+    const scoped = Object.entries(extensionScopesFromConfig(config).mcp);
+    if (scoped.length) {
+      const projects = listProjects();
+      updateProjectPolicies((byRoot) => {
+        for (const [server, roots] of scoped) {
+          for (const { path } of projects) {
+            if (cwdWithinProjects(path, roots)) continue;
+            const key = [...byRoot.keys()].find((root) => samePath(root, path)) ?? path;
+            byRoot.set(key, [...(byRoot.get(key) || []), server]);
+          }
+        }
+      });
+      let next = config;
+      for (const [server] of scoped) next = withExtensionScope(next, 'mcp', server, null);
+      saveConfigAndAdopt(next);
+    }
+    return { skipped: false, agents, scopes: scoped.map(([server]) => server) };
+  }
+
+  return {
+    listConnectors,
+    listConnectorTools,
+    getAgentConnectors,
+    setAgentConnectors: editor.setAgentConnectorPolicy,
+    setAgentConnectorEnabled,
+    setAgentConnectorToolPermission,
+    getProjectConnectors,
+    setProjectConnectorEnabled,
+    migrateConnectorPolicies,
+  };
+}