mixdog 1.3.4 → 1.3.5

package/src/runtime/shared/config.mjs

@@ -35,6 +35,7 @@ const {
   setSecret: _setSecret,
   deleteSecret: _deleteSecret,
   hasSecret: _hasSecret,
+  hasFallbackSecret: _hasFallbackSecret,
   setSecretAsync: _setSecretAsyncImpl,
   deleteSecretAsync: _deleteSecretAsyncImpl,
   keychainStatus: _keychainStatus,
@@ -523,6 +524,18 @@ export function readSection(section) {
   return stripGeneratedMarker(readAll()[section] ?? null) ?? {};
 }
 
+/**
+ * One section straight from the file, read-only: never served from the read
+ * cache, restored from a backup, quarantined or written. A missing, unreadable
+ * or malformed config throws. For checks that must fail closed, where a stale
+ * value restored from a backup must not count (developerOptionEnabledStrict).
+ */
+export function readSectionStrict(section) {
+  const parsed = parseJsonText(readFileSync(configPath(), 'utf8'));
+  if (!isPlainObject(parsed)) throw new SyntaxError('config root must be a JSON object');
+  return stripGeneratedMarker(parsed[section] ?? null) ?? {};
+}
+
 export function readConfig() {
   return stripGeneratedMarker(readAll()) ?? {};
 }
@@ -641,14 +654,17 @@ export function updateSectionAsync(section, updater) {
 }
 
 // ── Secret account names ─────────────────────────────────────────────────────
-// Canonical account strings stored in the OS keychain.
+// Canonical account strings stored in the OS keychain (or, on a Linux host with
+// no usable keychain provider, in the private secrets file behind the same
+// get/set/delete calls: keychain-cjs.cjs "Linux fallback file").
 export const SECRET_ACCOUNTS = Object.freeze({
   agentApiKey: (provider) => `agent.${provider}.apiKey`,
   openaiUsageSessionKey: 'agent.openai.usageSessionKey',
 });
 
 // ── Secret-aware getters ─────────────────────────────────────────────────────
-// Read order: ENV MIXDOG_<UPPER_SNAKE> → OS keychain → null.
+// Read order: ENV MIXDOG_<UPPER_SNAKE> → OS keychain → Linux fallback secrets
+// file (read by _getSecret when the keychain has nothing) → null.
 
 function _envKey(account) {
   // 'agent.openai.apiKey' → 'MIXDOG_AGENT_OPENAI_APIKEY'
@@ -676,7 +692,9 @@ export function getOpenAIUsageSessionKey() {
 }
 
 /**
- * Persist a secret to the OS keychain. Throws on failure.
+ * Persist a secret to the OS keychain; on a Linux host with no keychain provider
+ * (secret-tool/libsecret missing, no Secret Service) to the owner-only secrets
+ * file in the data dir instead. Throws on failure.
  * Never writes to mixdog-config.json.
  */
 export function saveSecret(account, value) {
@@ -697,25 +715,25 @@ export async function saveSecretAsync(account, value) {
 }
 
 function saveSecretError(account, err) {
-  {
-    // On WSL/headless Linux (and any host missing a usable keychain provider,
-    // e.g. secret-tool/libsecret not installed or no running Secret Service) the OS
-    // write throws a cryptic provider error. Surface an actionable message that
-    // points at the env-var read path the getters already honor, instead of
-    // silently writing the plaintext secret to mixdog-config.json.
-    const envKey = _envKey(account);
-    const agentMatch = String(account || '').match(/^agent\.([^.]+)\.apiKey$/);
-    const stdEnv = agentMatch ? AGENT_PROVIDER_ENV[agentMatch[1]] : null;
-    const envHint = stdEnv ? `${stdEnv} (or ${envKey})` : envKey;
-    const e = new Error(
-      `[config] could not save secret to the OS keychain: ${err?.message ? err.message : err}\n` +
-        `  Set the ${envHint} environment variable instead — the runtime reads it directly.`
-    );
-    e.cause = err;
-    return e;
-  }
+  // Reached for a locked keyring, a non-Linux keychain failure, or a Linux host
+  // with no keychain provider whose fallback secrets file could not be written
+  // (keychain-cjs.cjs). Surface an actionable message that points at the
+  // env-var read path the getters already honor, instead of silently writing
+  // the plaintext secret to mixdog-config.json. The fallback is a separate
+  // owner-only file, never the config.
+  const envKey = _envKey(account);
+  const agentMatch = String(account || '').match(/^agent\.([^.]+)\.apiKey$/);
+  const stdEnv = agentMatch ? AGENT_PROVIDER_ENV[agentMatch[1]] : null;
+  const envHint = stdEnv ? `${stdEnv} (or ${envKey})` : envKey;
+  const e = new Error(
+    `[config] could not save secret to the OS keychain: ${err?.message ? err.message : err}\n` +
+      `  Set the ${envHint} environment variable instead — the runtime reads it directly.`
+  );
+  e.cause = err;
+  return e;
 }
 
+/** Remove a secret from the OS keychain (if present) and the Linux fallback file. */
 export function deleteSecret(account) {
   _deleteSecret(account);
 }
@@ -741,13 +759,16 @@ export function onKeychainRecovered(listener) {
   return typeof _onKeychainRecovered === 'function' ? _onKeychainRecovered(listener) : () => {};
 }
 
-/** Keyring health for the UI: { state: ok|locked|missing|error|unknown, message }. */
+/** Keyring health for the UI: { state: ok|locked|missing|unreachable|error|unknown, message, fallback }.
+ *  `fallback` is true when no keychain provider exists on this Linux host and
+ *  secrets live in the private secrets file: working storage, not a failure. */
 export function getKeychainStatus() {
   return typeof _keychainStatus === 'function' ? _keychainStatus() : { state: 'unknown', message: '' };
 }
 
 /**
- * Whether a secret is stored in the OS keychain for `account` (ignores env).
+ * Whether a secret is stored in the OS keychain (or Linux fallback file) for
+ * `account` (ignores env).
  * Lets the setup UI show "Set" WITHOUT ever sending the secret value to the
  * browser.
  */
@@ -760,4 +781,10 @@ export function hasStoredSecret(account) {
   }
 }
 
+/** Whether `account`'s stored secret currently lives in the Linux fallback file
+ *  (never true on Windows/macOS). Lets the UI label where a key is kept. */
+export function isFallbackSecret(account) {
+  return typeof _hasFallbackSecret === 'function' ? !!_hasFallbackSecret(account) : false;
+}
+
 export { configPath };

package/src/runtime/shared/connector-catalog.d.mts

@@ -25,10 +25,10 @@ export interface ConnectorCatalogEntry {
   id: string;
   name: string;
   backend: ConnectorBackend;
-  /** Offered only after the user enters their own Google OAuth client. */
-  ownKey?: boolean;
   /** Curated deferred-tool manifest line (connector-triggers.mjs). */
   trigger: string;
+  /** New connections go by app password only (Gmail). */
+  appPasswordOnly?: boolean;
 }
 
 export const CONNECTOR_CATALOG: readonly ConnectorCatalogEntry[];
@@ -43,6 +43,8 @@ export function connectorServerInput(
   key?: string,
   options?: { extraAccount?: boolean }
 ): Record<string, unknown>;
+export function connectorAppPasswordOnly(entry: ConnectorCatalogEntry | null | undefined): boolean;
+export function connectorUsesGoogleClient(entry: ConnectorCatalogEntry | null | undefined): boolean;
 export function connectorMultiAccount(entry: ConnectorCatalogEntry | null | undefined): boolean;
 export const GMAIL_APP_PASSWORD: Readonly<{ url: string; accountHeader: string; helpUrl: string }>;
 export function gmailAddress(value: unknown): string;

package/src/runtime/shared/connector-catalog.mjs

@@ -53,20 +53,18 @@ export const CONNECTOR_CATALOG = Object.freeze(
       id: 'gmail',
       name: 'Gmail',
       backend: google('gmail', GOOGLE_SCOPES.gmail, ['send_email']),
+      // New Gmail connections use an app password only (GMAIL_APP_PASSWORD);
+      // a Gmail server already on the Google sign-in keeps working.
+      appPasswordOnly: true,
     },
-    // Calendar and Drive are offered only to a user who entered their own
-    // Google OAuth client (Connectors → add custom → 내 Google 키): `ownKey`.
-    // Existing connections keep working; Mixy and the chat cards never offer them.
     {
       id: 'google-calendar',
       name: 'Google Calendar',
-      ownKey: true,
       backend: google('calendar', GOOGLE_SCOPES.calendar, ['delete_event']),
     },
     {
       id: 'google-drive',
       name: 'Google Drive',
-      ownKey: true,
       backend: google('drive', GOOGLE_SCOPES.drive, []),
     },
     {
@@ -113,9 +111,8 @@ export const CONNECTOR_CATALOG = Object.freeze(
   ].map((entry) => Object.freeze({ ...entry, trigger: connectorTrigger(entry.id) }))
 );
 
-/** The ids offered to everyone (the setup tool's `connect_connector`): the
- *  catalog minus the own-key-only Google services. */
-export const CONNECTOR_IDS = Object.freeze(CONNECTOR_CATALOG.filter((entry) => !entry.ownKey).map((entry) => entry.id));
+/** The ids the setup tool's `connect_connector` offers: the whole catalog. */
+export const CONNECTOR_IDS = Object.freeze(CONNECTOR_CATALOG.map((entry) => entry.id));
 
 /** The catalog entry for `id`, or null. */
 export function connectorById(id) {
@@ -193,6 +190,17 @@ export function connectorMultiAccount(entry) {
   return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
 }
 
+/** Whether a new connection of `entry` goes by app password only (Gmail). */
+export function connectorAppPasswordOnly(entry) {
+  return entry?.appPasswordOnly === true;
+}
+
+/** Whether `entry` signs in with Mixdog's built-in Google client (or the
+ *  user's own Google client in its place). */
+export function connectorUsesGoogleClient(entry) {
+  return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
+}
+
 /** The MCP server input that connects catalog entry `entry` under `name`
  *  (oauth / apiKey); `key` fills an apiKey backend; `extraAccount`
  *  makes it one more account of a multi-account connector. */

package/src/runtime/shared/developer-options.mjs

@@ -5,12 +5,25 @@
 // `developer.<optionId>` is true. Default off. An option with a `warning`
 // turns on only after the user confirms that warning; an option with a
 // `provider` gates that dev-only OAuth provider.
-import { readSection } from './config.mjs';
+import { readSection, readSectionStrict } from './config.mjs';
 
 const OAUTH_RISK_WARNING =
   'Using this provider through OAuth carries a high risk of penalties such as account restrictions.';
 
 export const DEVELOPER_SECTIONS = Object.freeze([
+  Object.freeze({
+    id: 'approvals',
+    label: 'Approvals',
+    options: Object.freeze([
+      Object.freeze({
+        id: 'allowAllActions',
+        label: 'Allow all actions',
+        description: 'Skips the approval cards for every action except payments and permanent deletes.',
+        warning:
+          'Turning this on lets agents act without asking you first, except for payments and permanent deletes. Use it only if you accept that risk.',
+      }),
+    ]),
+  }),
   Object.freeze({
     id: 'providers',
     label: 'Providers',
@@ -30,6 +43,13 @@ export const DEVELOPER_SECTIONS = Object.freeze([
         warning: OAUTH_RISK_WARNING,
         provider: 'cursor-oauth',
       }),
+      Object.freeze({
+        id: 'devinOAuth',
+        label: 'Devin',
+        description: 'Show Devin OAuth in Providers and the model picker.',
+        warning: OAUTH_RISK_WARNING,
+        provider: 'devin-oauth',
+      }),
       Object.freeze({
         id: 'mimoOAuth',
         label: 'MiMo',
@@ -74,6 +94,17 @@ export function developerOptionEnabled(id, stored = storedDeveloperConfig()) {
   return developerOption(id) !== null && normalizeDeveloperConfig(stored)[id] === true;
 }
 
+/** `developerOptionEnabled` for a safety bypass: fail-closed. Read straight
+ *  from the config file, so a missing or malformed config is never restored
+ *  from a backup (which may hold a stale `true`); any error means off. */
+export function developerOptionEnabledStrict(id) {
+  try {
+    return developerOption(id) !== null && normalizeDeveloperConfig(readSectionStrict('agent').developer)[id] === true;
+  } catch {
+    return false;
+  }
+}
+
 /** Settings view of every section; `stored` defaults to the on-disk values. */
 export function developerSettingsView(stored = storedDeveloperConfig()) {
   const values = normalizeDeveloperConfig(stored);

package/src/runtime/shared/google-oauth-client.generated.json

@@ -0,0 +1,4 @@
+{
+  "clientId": "187841207053-o7jhqbnjjh99kfio1fgs7422m540q75m.apps.googleusercontent.com",
+  "clientSecret": "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"
+}

package/src/runtime/shared/google-oauth-client.mjs

@@ -6,18 +6,43 @@
 // uses PKCE (S256), state and a loopback redirect
 // (developers.google.com/identity/protocols/oauth2/native-app).
 //
-// The values come only from the environment; the source ships none, so a
-// build without them offers no built-in Google sign-in (the user's own
-// Google client still works).
+// The source ships no client. The values come from the environment first
+// (MIXDOG_GOOGLE_OAUTH_CLIENT_ID / _SECRET: a developer's override, and what
+// `npm run dev:isolated` passes through), then from the generated, gitignored
+// google-oauth-client.generated.json beside this file. Release packaging
+// writes that file from the repository secrets
+// (scripts/embed-google-oauth-client.mjs) before the npm package and every
+// desktop runtime.asar are built, so each shipped build carries it. A build
+// with neither offers no built-in Google sign-in (the user's own Google
+// client still works).
 
-const value = (name) => String(process.env[name] || '').trim();
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+/** The generated file release packaging writes (see the header). */
+export const GOOGLE_OAUTH_CLIENT_FILE = fileURLToPath(new URL('./google-oauth-client.generated.json', import.meta.url));
+
+const text = (value) => String(value || '').trim();
+
+function embeddedClient(file) {
+  let source;
+  try {
+    source = readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  const { clientId, clientSecret } = JSON.parse(source);
+  return text(clientId) ? { clientId: text(clientId), clientSecret: text(clientSecret) } : null;
+}
 
 /** `{ clientId, clientSecret }` of Mixdog's Google client, or null when this
- *  build has none. */
-export function googleOAuthClient() {
-  const clientId = value('MIXDOG_GOOGLE_OAUTH_CLIENT_ID');
-  if (!clientId) return null;
-  return { clientId, clientSecret: value('MIXDOG_GOOGLE_OAUTH_CLIENT_SECRET') };
+ *  build has none. The environment wins over the generated file as a whole:
+ *  the two are never mixed. */
+export function googleOAuthClient({ env = process.env, file = GOOGLE_OAUTH_CLIENT_FILE } = {}) {
+  const clientId = text(env.MIXDOG_GOOGLE_OAUTH_CLIENT_ID);
+  if (clientId) return { clientId, clientSecret: text(env.MIXDOG_GOOGLE_OAUTH_CLIENT_SECRET) };
+  return embeddedClient(file);
 }
 
 /** Google issues a refresh token only for `access_type=offline`. */

package/src/runtime/shared/llm/anthropic-betas.mjs

@@ -7,6 +7,9 @@ const FAST_MODE_BETA_HEADER = 'fast-mode-2026-02-01';
 const TOOL_SEARCH_BETA_HEADER = 'advanced-tool-use-2025-11-20';
 const THINKING_DISPLAY_UPDATES_BETA_HEADER = 'thinking-display-updates-2026-08-18';
 export const SERVER_SIDE_FALLBACK_BETA_HEADER = 'server-side-fallback-2026-07-01';
+// Turn-scoped mid-conversation system messages (clear_at), sent only when the
+// request body carries one.
+export const TURN_SCOPED_SYSTEM_BETA_HEADER = 'mid-conversation-system-clear-at-2026-08-21';
 
 // Fast mode ships on Opus 5.5, Opus 5 and Opus 4.8 only. Opus 4.7 rejects
 // `speed: "fast"` and Opus 4.6 silently runs at standard speed.
@@ -28,6 +31,7 @@ export function buildAnthropicBetaHeaders({
   effort = false,
   serverFallback = false,
   thinkingDisplayUpdates = false,
+  turnScopedSystem = false,
 } = {}) {
   const headers = String(base || '')
     .split(',')
@@ -48,5 +52,8 @@ export function buildAnthropicBetaHeaders({
   if (thinkingDisplayUpdates && !headers.includes(THINKING_DISPLAY_UPDATES_BETA_HEADER)) {
     headers.push(THINKING_DISPLAY_UPDATES_BETA_HEADER);
   }
+  if (turnScopedSystem && !headers.includes(TURN_SCOPED_SYSTEM_BETA_HEADER)) {
+    headers.push(TURN_SCOPED_SYSTEM_BETA_HEADER);
+  }
   return headers.join(',');
 }

package/src/runtime/shared/llm/anthropic-thinking-contract.mjs

@@ -63,3 +63,15 @@ export function emitsAnthropicProgressUpdates(model) {
   const id = normalizeClaudeModelId(model);
   return /^claude-(?:opus-5-5|sonnet-5-5|fable-5-1|mythos-5-1|fable-5)(?:-\d{8})?$/.test(id);
 }
+
+// Models that accept turn-scoped mid-conversation system messages
+// ({role:'system', clear_at:'next_user_message'}, beta
+// mid-conversation-system-clear-at-2026-08-21). An id list for the same
+// reason as above: a wrong "yes" is a 400 on every request, a wrong "no" only
+// keeps the legacy tail-reminder layout — so unknown ids stay off.
+export function supportsAnthropicTurnScopedSystemMessages(model) {
+  const id = normalizeClaudeModelId(model);
+  return /^claude-(?:fable-5-1|mythos-5-1|fable-5|mythos-5|opus-5-5|opus-5|opus-4-8|sonnet-5-5|haiku-5-5)(?:-\d{8})?$/.test(
+    id
+  );
+}

package/src/runtime/shared/llm/provider-catalog-registry.mjs

@@ -92,6 +92,7 @@ const PROVIDER_CATALOGS = Object.freeze({
     rosterLimitsAuthoritative: true,
   },
   'cursor-oauth': { relay: true },
+  'devin-oauth': { relay: true },
   'cursor-api': { relay: true },
   // The models.dev listing id of the Go gateway: a relay catalog, not a
   // selectable provider (the model lookup needs it flagged as a relay).

package/src/runtime/shared/llm/well-formed.mjs

@@ -0,0 +1,66 @@
+/**
+ * Outgoing-request surrogate sanitizer.
+ *
+ * A lone UTF-16 surrogate (half of an emoji left by a char-count cut, or
+ * carried by tool output / file content) is serialized by JSON.stringify as a
+ * `\ud83d` escape that provider APIs reject ("not valid JSON"). This rewrites
+ * every string value and every object key to well-formed text (lone surrogate
+ * -> U+FFFD) in the request that is about to be sent.
+ *
+ * Copy-on-write: a request that is already well-formed is returned as the very
+ * same object (no allocation, identity kept for caches keyed on messages or
+ * tool lists). Only the containers on the path to a bad string are copied; the
+ * stored transcript is never mutated. Only arrays and plain objects are
+ * walked: Buffer / Uint8Array / ArrayBuffer and any other class instance are
+ * binary or opaque payloads and are returned untouched. Own symbol properties
+ * (e.g. the provider-native tool prefix count on a tool list) survive a copy.
+ */
+function copySymbols(target, source) {
+  for (const symbol of Object.getOwnPropertySymbols(source)) {
+    Object.defineProperty(target, symbol, Object.getOwnPropertyDescriptor(source, symbol));
+  }
+  return target;
+}
+
+function setOwn(target, key, value) {
+  Object.defineProperty(target, key, { value, enumerable: true, writable: true, configurable: true });
+}
+
+function walk(value, active) {
+  if (typeof value === 'string') return value.isWellFormed() ? value : value.toWellFormed();
+  if (value === null || typeof value !== 'object' || active.has(value)) return value;
+  if (Array.isArray(value)) {
+    active.add(value);
+    let out = null;
+    for (let i = 0; i < value.length; i += 1) {
+      const next = walk(value[i], active);
+      if (!out && next !== value[i]) out = value.slice();
+      if (out) out[i] = next;
+    }
+    active.delete(value);
+    return out ? copySymbols(out, value) : value;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return value;
+  active.add(value);
+  const keys = Object.keys(value);
+  let out = null;
+  for (let i = 0; i < keys.length; i += 1) {
+    const key = keys[i];
+    const entry = value[key];
+    const nextKey = key.isWellFormed() ? key : key.toWellFormed();
+    const nextEntry = walk(entry, active);
+    if (!out && (nextKey !== key || nextEntry !== entry)) {
+      out = Object.create(proto);
+      for (let j = 0; j < i; j += 1) setOwn(out, keys[j], value[keys[j]]);
+    }
+    if (out) setOwn(out, nextKey, nextEntry);
+  }
+  active.delete(value);
+  return out ? copySymbols(out, value) : value;
+}
+
+/** `value` with every string and object key made well-formed; `value` itself when it already is. */
+export function sanitizeSurrogates(value) {
+  return walk(value, new WeakSet());
+}