mixdog 1.3.1 → 1.3.3

package/src/session-runtime/turn/turn-run/turn-prepare.mjs

@@ -5,6 +5,68 @@ import {
 } from '../../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 import { throwIfAborted } from '../../../runtime/shared/abort-race.mjs';
 
+function scheduleFirstTitle(sessionTitles, session0, prompt) {
+  let resolve = null;
+  const after = new Promise((done) => {
+    resolve = done;
+  });
+  const release = () => {
+    if (!resolve) return;
+    const done = resolve;
+    resolve = null;
+    done();
+  };
+  try {
+    sessionTitles?.scheduleFirst(session0, prompt, { after });
+  } catch {
+    /* title fallback stays the preview */
+  }
+  return release;
+}
+
+async function foldMcpSurface(turn, session0, scopedMcpTools) {
+  // Slower servers remain available through the late-tool path; a reconnect
+  // in flight gets the same short TTFT grace BEFORE folding the catalog so it
+  // cannot hold the provider request. No reconnect in flight → no-op.
+  const awaitGrace = async (options) => {
+    try {
+      await turn.awaitTurn(() => turn.timing.awaitMcpGrace(options));
+    } catch {
+      /* gate must never break the turn */
+    }
+  };
+  if (session0.deferredInitialRefreshPending) {
+    // FIRST TURN of a FRESH session (session-local gate, NOT the process-wide
+    // firstTurnCompleted): an MCP server may have finished its handshake
+    // BETWEEN session-create and this first send. Re-fold the LIVE registry
+    // into the INITIAL provider-visible surface (sync, in-place, idempotent).
+    // One-shot: cleared before the fold so a throw still never re-runs it,
+    // and a resumed session (flag unset) skips straight to the late path.
+    session0.deferredInitialRefreshPending = false;
+    // A spawned agent runtime owns a fresh MCP scope whose connect starts at
+    // its boot, so the 0 ms default grace would hide every MCP tool from the
+    // agent's first (often only) turn. Agents are not on the user's TTFT
+    // path: wait for the initial connect within the server startup budget.
+    const agentOwned = session0.owner === 'agent' || session0.visibility === 'agent-only';
+    await awaitGrace({ untilConnected: agentOwned });
+    try {
+      refreshInitialDeferredMcpSurface(session0, scopedMcpTools(session0));
+    } catch {
+      /* first-turn MCP fold must never break the turn */
+    }
+    return;
+  }
+  await awaitGrace();
+  try {
+    // Persist a typed world-state delta on the session. askSession attaches
+    // it to THIS real prompt; reconciliation itself never enqueues a
+    // follow-up turn.
+    reconcileDeferredMcpToolCatalog(session0, scopedMcpTools(session0));
+  } catch {
+    /* MCP delta must never break the turn */
+  }
+}
+
 // Session preparation before askSession: route readiness, session creation,
 // transcript user row, first title, the MCP surface fold, and the
 // UserPromptSubmit hook.
@@ -27,68 +89,34 @@ export function createTurnPreparation({
   admitTurnWorkspace,
   applyPendingRoute,
   applyPendingAgentProfile,
+  applyPendingSessionSwitches,
 }) {
-  const scopedMcpTools = (session) => scopedMcpToolsFor(session, getConfig());
-
-  function scheduleFirstTitle(session0, prompt) {
-    let resolve = null;
-    const after = new Promise((done) => {
-      resolve = done;
-    });
-    const release = () => {
-      if (!resolve) return;
-      const done = resolve;
-      resolve = null;
-      done();
-    };
-    try {
-      sessionTitles?.scheduleFirst(session0, prompt, { after });
-    } catch {
-      /* title fallback stays the preview */
-    }
-    return release;
-  }
-
-  async function foldMcpSurface(turn, session0) {
-    // Slower servers remain available through the late-tool path; a reconnect
-    // in flight gets the same short TTFT grace BEFORE folding the catalog so it
-    // cannot hold the provider request. No reconnect in flight → no-op.
-    const awaitGrace = async (options) => {
-      try {
-        await turn.awaitTurn(() => turn.timing.awaitMcpGrace(options));
-      } catch {
-        /* gate must never break the turn */
-      }
-    };
-    if (session0.deferredInitialRefreshPending) {
-      // FIRST TURN of a FRESH session (session-local gate, NOT the process-wide
-      // firstTurnCompleted): an MCP server may have finished its handshake
-      // BETWEEN session-create and this first send. Re-fold the LIVE registry
-      // into the INITIAL provider-visible surface (sync, in-place, idempotent).
-      // One-shot: cleared before the fold so a throw still never re-runs it,
-      // and a resumed session (flag unset) skips straight to the late path.
-      session0.deferredInitialRefreshPending = false;
-      // A spawned agent runtime owns a fresh MCP scope whose connect starts at
-      // its boot, so the 0 ms default grace would hide every MCP tool from the
-      // agent's first (often only) turn. Agents are not on the user's TTFT
-      // path: wait for the initial connect within the server startup budget.
-      const agentOwned = session0.owner === 'agent' || session0.visibility === 'agent-only';
-      await awaitGrace({ untilConnected: agentOwned });
-      try {
-        refreshInitialDeferredMcpSurface(session0, scopedMcpTools(session0));
-      } catch {
-        /* first-turn MCP fold must never break the turn */
-      }
-      return;
+  async function admitWorkspace(turn, prompt, options) {
+    // Turn admission: waits while this session's workspace transitions or
+    // another session changes the checkout this session works in, then holds
+    // the turn registered (released by settleTurn) so no checkout changes
+    // under it.
+    if (typeof admitTurnWorkspace === 'function') {
+      turn.releaseWorkspace = await admitTurnWorkspace({ signal: turn.signal });
+      throwIfAborted(turn.signal);
+      assertSessionAdmission?.();
     }
-    await awaitGrace();
-    try {
-      // Persist a typed world-state delta on the session. askSession attaches
-      // it to THIS real prompt; reconciliation itself never enqueues a
-      // follow-up turn.
-      reconcileDeferredMcpToolCatalog(session0, scopedMcpTools(session0));
-    } catch {
-      /* MCP delta must never break the turn */
+    // Workspace gate: a session in recovery refuses the turn, and a pending
+    // worktree intent is provisioned and applied (cwd, record, prompt context)
+    // BEFORE the user row, the review snapshot, hooks, the provider and any
+    // worker spawn. The submission id is the provisioning transaction id, so a
+    // retried or duplicate send reuses the same worktree.
+    if (typeof prepareTurnWorkspace === 'function') {
+      await turn.awaitTurn(() =>
+        prepareTurnWorkspace({
+          submissionId: String(options.id || '').trim(),
+          prompt,
+          signal: turn.signal,
+          confirmLarge: options.confirmLarge === true,
+        })
+      );
+      throwIfAborted(turn.signal);
+      assertSessionAdmission?.();
     }
   }
 
@@ -116,37 +144,16 @@ export function createTurnPreparation({
     // on the session it runs on (as completeTurn adopts it afterwards).
     const stored = mgr.getSession(getSession().id);
     if (stored && stored !== getSession()) setSession(stored);
-    // Turn admission: waits while this session's workspace transitions or
-    // another session changes the checkout this session works in, then holds
-    // the turn registered (released by settleTurn) so no checkout changes
-    // under it.
-    if (typeof admitTurnWorkspace === 'function') {
-      turn.releaseWorkspace = await admitTurnWorkspace({ signal: turn.signal });
-      throwIfAborted(turn.signal);
-      assertSessionAdmission?.();
-    }
-    // Workspace gate: a session in recovery refuses the turn, and a pending
-    // worktree intent is provisioned and applied (cwd, record, prompt context)
-    // BEFORE the user row, the review snapshot, hooks, the provider and any
-    // worker spawn. The submission id is the provisioning transaction id, so a
-    // retried or duplicate send reuses the same worktree.
-    if (typeof prepareTurnWorkspace === 'function') {
-      await turn.awaitTurn(() =>
-        prepareTurnWorkspace({
-          submissionId: String(options.id || '').trim(),
-          prompt,
-          signal: turn.signal,
-          confirmLarge: options.confirmLarge === true,
-        })
-      );
-      throwIfAborted(turn.signal);
-      assertSessionAdmission?.();
-    }
+    await admitWorkspace(turn, prompt, options);
     const modelSwitch = applyPendingRoute?.();
+    // An orchestration mode or workflow chosen while the previous turn ran
+    // applies from this one (before a cold-cache fold can take it in).
+    const sessionSwitches = applyPendingSessionSwitches?.();
     // An agent profile saved while the previous turn ran applies from this one.
     await applyPendingAgentProfile?.();
     options.onRouteApplied?.(getSession());
     if (modelSwitch) options.onModelSwitch?.(modelSwitch);
+    if (sessionSwitches) options.onSessionSwitches?.(sessionSwitches);
     ensureSessionTranscriptWriter?.();
     transcript.appendUser(prompt);
     const session0 = getSession();
@@ -155,8 +162,8 @@ export function createTurnPreparation({
     // preparation. Worker apply_patch diffs bind to this generation and cannot
     // leak into the next turn/session.
     turn.snapshot.start(session0?.id);
-    turn.releaseFirstTitle = scheduleFirstTitle(session0, prompt);
-    await foldMcpSurface(turn, session0);
+    turn.releaseFirstTitle = scheduleFirstTitle(sessionTitles, session0, prompt);
+    await foldMcpSurface(turn, session0, (session) => scopedMcpToolsFor(session, getConfig()));
     hooks.emit('turn:start', { sessionId: session0.id, prompt, cwd: getCurrentCwd() });
     try {
       agentTool?.upsertLeadSession?.(session0, {

package/src/session-runtime/turn/turn-run/turn-timing.mjs

@@ -2,7 +2,7 @@ import { traceTurnTiming } from '../../../runtime/agent/orchestrator/agent-trace
 
 // TTFT telemetry for one turn: emitted once (first visible progress or
 // settlement), to the in-process event and the durable trace row.
-export function createTurnTimingFactory({ getSession, awaitInitialMcpConnect, mcpTurnGraceMs }) {
+export function createTurnTimingFactory({ getSession, awaitInitialMcpConnect, mcpTurnGraceMs, mcpAgentGraceMs }) {
   return function createTurnTiming(options) {
     const startedAt = performance.now();
     const startedAtEpoch = Date.now();
@@ -39,11 +39,12 @@ export function createTurnTimingFactory({ getSession, awaitInitialMcpConnect, mc
       }
     };
     // Give an in-flight MCP connect only a short TTFT grace. untilConnected
-    // waits for the initial connect bounded only by the server startup budget.
+    // (a spawned agent's first turn) gets the longer, still bounded, agent
+    // grace; the gate additionally never exceeds the server startup budget.
     timing.awaitMcpGrace = async ({ untilConnected = false } = {}) => {
       const graceStartedAt = performance.now();
       try {
-        await awaitInitialMcpConnect?.(untilConnected ? undefined : mcpTurnGraceMs);
+        await awaitInitialMcpConnect?.(untilConnected ? mcpAgentGraceMs : mcpTurnGraceMs);
       } finally {
         timing.mcpWaitMs += performance.now() - graceStartedAt;
       }

package/src/session-runtime/turn/turn-run.mjs

@@ -21,17 +21,19 @@ export function createTurnRunner(deps) {
     getCurrentCwd,
     mgr,
     mcpTurnGraceMs = 0,
+    mcpAgentGraceMs = 3_000,
     endComputerExecution = async () => false,
     deferComputerSessionRelease = () => false,
     beginTurnSnapshotForTurn = beginTurnSnapshot,
     completeTurnSnapshotForTurn = completeTurnSnapshot,
     turnCleanupSettleMs = 2_000,
     getConfig = () => null,
+    currentAgents,
   } = deps;
   const transcript = createTurnTranscript(deps);
   const openTurn = createTurnOpener({
     ...deps,
-    createTiming: createTurnTimingFactory({ ...deps, mcpTurnGraceMs }),
+    createTiming: createTurnTimingFactory({ ...deps, mcpTurnGraceMs, mcpAgentGraceMs }),
     createSnapshot: createSnapshotTrackerFactory({
       getCurrentCwd,
       beginTurnSnapshotForTurn,
@@ -80,7 +82,10 @@ export function createTurnRunner(deps) {
           plannedToolCalls(session0, options),
           getCurrentCwd(),
           options.prefetch || null,
-          callbacks
+          // The agents enabled now (coding Leads), asked for each user turn
+          // the ask prepares, for its agent list reminder
+          // (manager/agent-listing-notice.mjs).
+          { ...callbacks, agentsNow: currentAgents }
         );
       } finally {
         releaseWebSearchUsage?.();

package/src/session-runtime/workflow-agents-api/agent-connectors.mjs

@@ -1,13 +1,16 @@
 import { readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import {
+  assertConnectorPolicyNotWidened,
   CONNECTOR_PERMISSIONS,
   connectorEnabled,
   DENY_ALL_CONNECTORS,
   migrateLegacyConnectorPolicy,
+  NO_WIDEN_MESSAGE,
   PROJECT_CONNECTORS_FILE,
   parseConnectorPolicy,
   readProjectConnectorsFile,
+  setConnectorToolPermissionWriter,
   storedConnectorPolicy,
 } from '../../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
 import {
@@ -88,19 +91,26 @@ export function createAgentConnectorsApi(deps, editor) {
     return switches(editor.getAgentConnectorPolicy(agentId));
   }
 
-  /** Switch one connector on or off for the agent; returns its switches. */
-  async function setAgentConnectorEnabled(agentId, connectorId, enabled) {
+  /** Switch one connector on or off for the agent; returns its switches.
+   *  `options.noWiden` (set by the host for a remote client, never by a caller's
+   *  payload) refuses a change that gives the agent more authority; it is judged
+   *  against the stored policy in the same synchronous stretch as the write, so
+   *  a restriction landing meanwhile is never overwritten. */
+  async function setAgentConnectorEnabled(agentId, connectorId, enabled, options) {
     const id = requireId(connectorId, 'connector id');
     if (typeof enabled !== 'boolean') throw new TypeError('enabled must be a boolean');
     const policy = editablePolicy(agentId);
     const off = enabled ? policy.off.filter((entry) => entry !== id) : [...policy.off, id];
+    if (options?.noWiden) {
+      assertConnectorPolicyNotWidened(editor.getAgentConnectorPolicy(agentId), { off, tools: policy.tools });
+    }
     await editor.setAgentConnectorPolicy(agentId, storedConnectorPolicy({ off, tools: policy.tools }));
     return getAgentConnectors(agentId);
   }
 
   // Older per-tool overrides keep working (the profile no longer shows them):
   // `permission` null drops the tool's entry, so the tool is auto again.
-  async function setAgentConnectorToolPermission(agentId, connectorId, toolName, permission) {
+  async function setAgentConnectorToolPermission(agentId, connectorId, toolName, permission, options) {
     if (permission != null && !CONNECTOR_PERMISSIONS.includes(permission)) {
       throw new Error(`permission must be one of ${CONNECTOR_PERMISSIONS.join(', ')}`);
     }
@@ -110,12 +120,45 @@ export function createAgentConnectorsApi(deps, editor) {
     const own = { ...policy.tools[server] };
     if (permission == null) delete own[tool];
     else own[tool] = permission;
+    if (options?.noWiden) {
+      assertConnectorPolicyNotWidened(editor.getAgentConnectorPolicy(agentId), {
+        off: policy.off,
+        tools: { ...policy.tools, [server]: own },
+      });
+    }
     return editor.setAgentConnectorPolicy(
       agentId,
       storedConnectorPolicy({ off: policy.off, tools: { ...policy.tools, [server]: own } })
     );
   }
 
+  // A card's "항상 허용" for a connector tool saves through this same writer.
+  setConnectorToolPermissionWriter(setAgentConnectorToolPermission);
+
+  /** `[{ connector, tool }]`: the connector tools this agent may run without
+   *  asking (an explicit `auto` entry in its own policy). The profile lists
+   *  them so each can be turned back to asking. */
+  function getAgentAlwaysAllowedTools(agentId) {
+    const tools = editor.getAgentConnectorPolicy(agentId)?.tools || {};
+    return Object.entries(tools)
+      .flatMap(([connector, own]) =>
+        Object.entries(own)
+          .filter(([, permission]) => permission === 'auto')
+          .map(([tool]) => ({ connector, tool }))
+      )
+      .sort((a, b) => a.connector.localeCompare(b.connector) || a.tool.localeCompare(b.tool));
+  }
+
+  /** Replace the agent's connector policy (null removes it). With `options.noWiden`
+   *  the replacement may not give any tool more authority than the stored policy. */
+  async function setAgentConnectors(agentId, connectors, options) {
+    if (options?.noWiden) {
+      const next = connectors == null ? null : parseConnectorPolicy(connectors);
+      assertConnectorPolicyNotWidened(editor.getAgentConnectorPolicy(agentId), next);
+    }
+    return editor.setAgentConnectorPolicy(agentId, connectors);
+  }
+
   /** The registered Project at `projectPath` (its path is the policy key). */
   function registeredProject(projectPath) {
     const path = requireId(projectPath, 'project path');
@@ -157,13 +200,16 @@ export function createAgentConnectorsApi(deps, editor) {
   }
 
   /** Switch one connector on or off for the project; returns its switches. */
-  function setProjectConnectorEnabled(projectPath, connectorId, enabled) {
+  function setProjectConnectorEnabled(projectPath, connectorId, enabled, options) {
     const id = requireId(connectorId, 'connector id');
     if (typeof enabled !== 'boolean') throw new TypeError('enabled must be a boolean');
     const root = registeredProject(projectPath);
     updateProjectPolicies((byRoot) => {
       const key = [...byRoot.keys()].find((entry) => samePath(entry, root)) ?? root;
-      const off = (byRoot.get(key) || []).filter((entry) => entry !== id);
+      const current = byRoot.get(key) || [];
+      // Under the policy file lock, against the file as it is now.
+      if (options?.noWiden && enabled && current.includes(id)) throw new Error(NO_WIDEN_MESSAGE);
+      const off = current.filter((entry) => entry !== id);
       byRoot.set(key, enabled ? off : [...off, id]);
     });
     return getProjectConnectors(root);
@@ -202,7 +248,7 @@ export function createAgentConnectorsApi(deps, editor) {
       );
       if (next) manifest.connectors = next;
       else delete manifest.connectors;
-      writeJsonAtomicSync(file, manifest);
+      writeJsonAtomicSync(file, manifest, { backup: true });
       agents.push(entry.name);
     }
     const config = getConfig?.();
@@ -229,9 +275,10 @@ export function createAgentConnectorsApi(deps, editor) {
     listConnectors,
     listConnectorTools,
     getAgentConnectors,
-    setAgentConnectors: editor.setAgentConnectorPolicy,
+    setAgentConnectors,
     setAgentConnectorEnabled,
     setAgentConnectorToolPermission,
+    getAgentAlwaysAllowedTools,
     getProjectConnectors,
     setProjectConnectorEnabled,
     migrateConnectorPolicies,