mixdog 1.3.4 → 1.4.0

package/src/runtime/shared/connector-catalog.d.mts

@@ -25,10 +25,10 @@ export interface ConnectorCatalogEntry {
   id: string;
   name: string;
   backend: ConnectorBackend;
-  /** Offered only after the user enters their own Google OAuth client. */
-  ownKey?: boolean;
   /** Curated deferred-tool manifest line (connector-triggers.mjs). */
   trigger: string;
+  /** New connections go by app password only (Gmail). */
+  appPasswordOnly?: boolean;
 }
 
 export const CONNECTOR_CATALOG: readonly ConnectorCatalogEntry[];
@@ -43,9 +43,40 @@ export function connectorServerInput(
   key?: string,
   options?: { extraAccount?: boolean }
 ): Record<string, unknown>;
+export function connectorAppPasswordOnly(entry: ConnectorCatalogEntry | null | undefined): boolean;
+export function connectorUsesGoogleClient(entry: ConnectorCatalogEntry | null | undefined): boolean;
 export function connectorMultiAccount(entry: ConnectorCatalogEntry | null | undefined): boolean;
 export const GMAIL_APP_PASSWORD: Readonly<{ url: string; accountHeader: string; helpUrl: string }>;
 export function gmailAddress(value: unknown): string;
 export function gmailAppPasswordValue(value: unknown): string;
 export function gmailAppPasswordAccount(cfg: unknown): string;
 export function gmailAppPasswordServerInput(name: string, email: string, password: string): Record<string, unknown>;
+
+/** One stored account of a multi-account connector server. */
+export interface ConnectorAccountEntry {
+  name: string;
+  url: string;
+  headers?: Record<string, string>;
+  oauthClientId?: string;
+  /** `false`: the account is kept but neither connected nor called. */
+  enabled?: boolean;
+}
+export function connectorAccountsUrl(id: string): string;
+export function connectorAccountsOf(cfg: unknown): ConnectorAccountEntry[];
+export function connectorAccountServer(
+  cfg: Record<string, unknown>,
+  account: ConnectorAccountEntry
+): Record<string, unknown>;
+export function connectorAccountServers(cfg: unknown): Record<string, unknown>[];
+export function connectorAccountEnabled(account: ConnectorAccountEntry): boolean;
+export function connectorLiveAccountServers(cfg: unknown): Record<string, unknown>[];
+export function withConnectorAccountEnabled(
+  cfg: Record<string, unknown>,
+  name: string,
+  enabled: boolean
+): Record<string, unknown>;
+export function connectorAccountEntry(name: string, cfg: Record<string, unknown>): ConnectorAccountEntry;
+export function mergeConnectorAccountServers(servers: Record<string, unknown>): {
+  servers: Record<string, unknown>;
+  merged: { connector: string; name: string; from: string[] }[];
+};

package/src/runtime/shared/connector-catalog.mjs

@@ -53,20 +53,18 @@ export const CONNECTOR_CATALOG = Object.freeze(
       id: 'gmail',
       name: 'Gmail',
       backend: google('gmail', GOOGLE_SCOPES.gmail, ['send_email']),
+      // New Gmail connections use an app password only (GMAIL_APP_PASSWORD);
+      // a Gmail server already on the Google sign-in keeps working.
+      appPasswordOnly: true,
     },
-    // Calendar and Drive are offered only to a user who entered their own
-    // Google OAuth client (Connectors → add custom → 내 Google 키): `ownKey`.
-    // Existing connections keep working; Mixy and the chat cards never offer them.
     {
       id: 'google-calendar',
       name: 'Google Calendar',
-      ownKey: true,
       backend: google('calendar', GOOGLE_SCOPES.calendar, ['delete_event']),
     },
     {
       id: 'google-drive',
       name: 'Google Drive',
-      ownKey: true,
       backend: google('drive', GOOGLE_SCOPES.drive, []),
     },
     {
@@ -113,9 +111,8 @@ export const CONNECTOR_CATALOG = Object.freeze(
   ].map((entry) => Object.freeze({ ...entry, trigger: connectorTrigger(entry.id) }))
 );
 
-/** The ids offered to everyone (the setup tool's `connect_connector`): the
- *  catalog minus the own-key-only Google services. */
-export const CONNECTOR_IDS = Object.freeze(CONNECTOR_CATALOG.filter((entry) => !entry.ownKey).map((entry) => entry.id));
+/** The ids the setup tool's `connect_connector` offers: the whole catalog. */
+export const CONNECTOR_IDS = Object.freeze(CONNECTOR_CATALOG.map((entry) => entry.id));
 
 /** The catalog entry for `id`, or null. */
 export function connectorById(id) {
@@ -193,6 +190,167 @@ export function connectorMultiAccount(entry) {
   return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
 }
 
+// ── One server per multi-account connector ──────────────────────────────────
+// A multi-account connector is ONE MCP server (`gmail`, `google-calendar`,
+// `google-drive`) holding its accounts:
+//   { type: 'http', url: connectorAccountsUrl(id), connector: id,
+//     accounts: [{ name, url, headers?, oauthClientId? }, …] }
+// Each account keeps the transport it had as a server of its own (the Google
+// sign-in URL its tokens are stored under, or the app-password address and
+// account header), so its keychain entries are untouched. Account names share
+// the server-name space (`gmail`, `gmail-2`…): a name-based call (remove, sign
+// in, sign out) that names an account acts on that account. The server is
+// answered in-process (connectors/connector-accounts-mcp.mjs): one tool set
+// with an `account` argument.
+const ACCOUNT_FIELDS = ['url', 'headers', 'oauthClientId'];
+
+/** The reserved (never resolvable) address of connector `id`'s accounts server. */
+export function connectorAccountsUrl(id) {
+  return `https://connectors.mixdog.invalid/${encodeURIComponent(id)}/mcp`;
+}
+
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+/** The stored accounts of a multi-account connector server, [] for any other
+ *  config (a legacy one-account server included). */
+export function connectorAccountsOf(cfg) {
+  if (!isRecord(cfg) || !Array.isArray(cfg.accounts)) return [];
+  if (!connectorMultiAccount(connectorById(connectorOfServer(cfg)))) return [];
+  return cfg.accounts.filter(
+    (account) =>
+      isRecord(account) && typeof account.name === 'string' && account.name && typeof account.url === 'string'
+  );
+}
+
+/** The one-account server config of `account` of server `cfg` (the shape the
+ *  account had as a server of its own), named by the account. */
+export function connectorAccountServer(cfg, account) {
+  const out = { name: account.name, type: 'http' };
+  for (const field of ACCOUNT_FIELDS) if (account[field] !== undefined) out[field] = account[field];
+  out.connector = cfg.connector;
+  return out;
+}
+
+/** Every account of `cfg` as its one-account server config. */
+export function connectorAccountServers(cfg) {
+  return connectorAccountsOf(cfg).map((account) => connectorAccountServer(cfg, account));
+}
+
+/** Whether stored account `account` is switched on (`enabled: false` is off). */
+export const connectorAccountEnabled = (account) => account.enabled !== false;
+
+/** The switched-on accounts of `cfg` as their one-account server configs: the
+ *  ones the server connects and routes calls to. */
+export function connectorLiveAccountServers(cfg) {
+  return connectorAccountsOf(cfg)
+    .filter(connectorAccountEnabled)
+    .map((account) => connectorAccountServer(cfg, account));
+}
+
+/**
+ * Server `cfg` with its account `name` switched on or off. Off flags the
+ * account (`enabled: false`) and switches the server off with its last
+ * switched-on account. On drops the flag (a switched-on account carries none)
+ * and switches the server on. Every other entry stays as stored.
+ */
+export function withConnectorAccountEnabled(cfg, name, enabled) {
+  const accounts = cfg.accounts.map((account) => {
+    if (!isRecord(account) || account.name !== name) return account;
+    const { enabled: _enabled, ...rest } = account;
+    return enabled ? rest : { ...rest, enabled: false };
+  });
+  const next = { ...cfg, accounts };
+  if (enabled) return { ...next, enabled: true };
+  return connectorAccountsOf(next).some(connectorAccountEnabled) ? next : { ...next, enabled: false };
+}
+
+/** The stored account entry of one-account config `cfg` under `name`. */
+export function connectorAccountEntry(name, cfg) {
+  const out = { name };
+  for (const field of ACCOUNT_FIELDS) if (cfg?.[field] !== undefined) out[field] = cfg[field];
+  return out;
+}
+
+const naturalOrder = (a, b) => a.localeCompare(b, 'en', { numeric: true });
+
+/**
+ * Merges every multi-account connector's servers into one server holding the
+ * accounts: legacy one-account servers (`gmail`, `gmail-2`…, Calendar and
+ * Drive alike) and any second accounts server. The server keeps the name of
+ * an existing accounts server, else the connector id when a server has it,
+ * else the first name; its other fields come from that server. Accounts keep
+ * their names, transports and order (that server's first); a second entry
+ * for the same name or app-password address is dropped. The merged server is
+ * off only when every merged one was; otherwise the accounts of a merged
+ * server that was off stay off (`enabled: false` on the account), and an
+ * account's own `enabled: false` is kept. A server left with no switched-on
+ * account is off. Idempotent: `merged` is empty when
+ * nothing changed. Returns `{ servers, merged: [{ connector, name, from }] }`.
+ */
+export function mergeConnectorAccountServers(input) {
+  const servers = isRecord(input) ? { ...input } : {};
+  const merged = [];
+  for (const entry of CONNECTOR_CATALOG.filter(connectorMultiAccount)) {
+    const names = Object.keys(servers)
+      .filter((name) => isRecord(servers[name]) && connectorOfServer(servers[name]) === entry.id)
+      .sort(naturalOrder);
+    if (!names.length) continue;
+    const grouped = names.filter((name) => Array.isArray(servers[name].accounts));
+    if (names.length === 1 && grouped.length === 1) continue;
+    const target = grouped[0] ?? (names.includes(entry.id) ? entry.id : names[0]);
+    const order = [target, ...names.filter((name) => name !== target)];
+    const off = order.every((name) => input[name].enabled === false);
+    const accounts = [];
+    const seenNames = new Set();
+    const seenAddresses = new Set();
+    for (const name of order) {
+      const cfg = servers[name];
+      const own = Array.isArray(cfg.accounts) ? connectorAccountsOf(cfg) : [connectorAccountEntry(name, cfg)];
+      // A merged server that was off keeps its accounts off, unless the whole
+      // connector is off (then re-enabling it brings every account back).
+      const serverOff = !off && cfg.enabled === false;
+      for (const account of own) {
+        const address = gmailAppPasswordAccount(connectorAccountServer(cfg, account));
+        if (seenNames.has(account.name) || (address && seenAddresses.has(address))) continue;
+        seenNames.add(account.name);
+        if (address) seenAddresses.add(address);
+        accounts.push(serverOff ? { ...account, enabled: false } : account);
+      }
+    }
+    const {
+      type: _type,
+      url: _url,
+      headers: _headers,
+      oauthClientId: _client,
+      accounts: _accounts,
+      enabled: _enabled,
+      ...rest
+    } = servers[target];
+    for (const name of order) delete servers[name];
+    servers[target] = {
+      ...rest,
+      type: 'http',
+      url: connectorAccountsUrl(entry.id),
+      connector: entry.id,
+      accounts,
+      ...(off || (accounts.length > 0 && !accounts.some(connectorAccountEnabled)) ? { enabled: false } : {}),
+    };
+    merged.push({ connector: entry.id, name: target, from: order });
+  }
+  return { servers, merged };
+}
+
+/** Whether a new connection of `entry` goes by app password only (Gmail). */
+export function connectorAppPasswordOnly(entry) {
+  return entry?.appPasswordOnly === true;
+}
+
+/** Whether `entry` signs in with Mixdog's built-in Google client (or the
+ *  user's own Google client in its place). */
+export function connectorUsesGoogleClient(entry) {
+  return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
+}
+
 /** The MCP server input that connects catalog entry `entry` under `name`
  *  (oauth / apiKey); `key` fills an apiKey backend; `extraAccount`
  *  makes it one more account of a multi-account connector. */

package/src/runtime/shared/connector-triggers.mjs

@@ -1,30 +1,33 @@
 // Curated selection triggers for catalog connectors (MCP servers). A catalog
 // entry carries its line as `trigger`; the deferred-tool manifest lists each
 // connected server once as `- mcp__<server id>: <trigger>`, so one line must
-// say what the connector is for (plus a close negative where useful), in
-// English, at most CONNECTOR_TRIGGER_MAX_CHARS characters.
+// say WHEN to call the server (the user requests it covers, plus a close
+// negative where useful), not list its capabilities; plain ASCII English, at
+// most CONNECTOR_TRIGGER_MAX_CHARS characters.
 export const CONNECTOR_TRIGGER_MAX_CHARS = 100;
 
 export const CONNECTOR_TRIGGERS = Object.freeze({
   // Not a catalog connector (Mixdog uses the signed-in GitHub CLI), but a
   // user-added `github` MCP server still gets this line.
-  github: 'GitHub repos, issues, pull requests, Actions and code search; not local Git history or diffs.',
-  notion: 'Notion pages, databases and workspace search; create or update team docs and notes.',
-  linear: 'Linear issues, projects, cycles and comments; create, triage or update tickets.',
-  sentry: 'Sentry issues, events, stack traces and releases; triage production errors.',
-  gmail: 'Gmail: send email; with an app password also search, read, archive, label, star, trash.',
-  'google-calendar': 'Google Calendar events on the primary calendar; list, search, create, update or delete.',
-  'google-drive': 'Google Drive files Mixdog created or was given; search, read or create; not local files.',
-  jira: 'Jira issues, projects, sprints and comments; JQL search, create or transition tickets.',
-  confluence: 'Confluence spaces and pages; search, read or edit the team wiki; not Jira tickets.',
-  dropbox: 'Dropbox files and folders; search, read, upload or share cloud files; not local files.',
-  trello: 'Trello boards, lists and cards; create, move or update cards.',
-  airtable: 'Airtable bases, tables and records; query, create or update rows.',
-  stripe: 'Stripe customers, payments, invoices, subscriptions and refunds; billing data and actions.',
-  vercel: 'Vercel projects, deployments, domains and logs; deploy status and build errors.',
-  supabase: 'Supabase projects: Postgres tables and SQL, auth, storage and edge functions.',
-  postgres: 'PostgreSQL schemas, tables and SQL queries on a connected database; not local files.',
-  'hugging-face': 'Hugging Face Hub models, datasets, Spaces and papers; not local GGUF model setup.',
+  github: 'GitHub issues, pull requests, Actions runs and repo code search; not local Git history.',
+  notion: 'Finding, reading or updating Notion pages, databases and team notes.',
+  linear: 'Looking up, creating or triaging Linear issues, projects and cycles.',
+  sentry: 'Investigating production errors, stack traces and releases in Sentry.',
+  // The line never names an account: that arrives with the server's
+  // instructions when its tools are loaded.
+  gmail: 'Gmail email: sending, reading, searching or organizing mail.',
+  'google-calendar': 'Google Calendar: checking, creating or editing events.',
+  'google-drive': 'Google Drive: finding, reading or creating files Mixdog made or was given; not local files.',
+  jira: 'Looking up, creating or transitioning Jira tickets, sprints and JQL searches.',
+  confluence: 'Searching, reading or editing Confluence wiki pages; not Jira tickets.',
+  dropbox: 'Finding, reading, uploading or sharing Dropbox files; not local files.',
+  trello: 'Viewing, creating or moving Trello boards, lists and cards.',
+  airtable: 'Querying or updating Airtable bases, tables and records.',
+  stripe: 'Checking or acting on Stripe payments, invoices, subscriptions and refunds.',
+  vercel: 'Checking Vercel deployments, domains, logs and build errors.',
+  supabase: 'Working with Supabase Postgres tables, SQL, auth, storage or edge functions.',
+  postgres: 'Running SQL or inspecting schemas on a connected PostgreSQL database; not local files.',
+  'hugging-face': 'Finding Hugging Face Hub models, datasets, Spaces or papers; not local GGUF setup.',
 });
 
 // Server ids differ only in separators and case (google_calendar, huggingface).

package/src/runtime/shared/defaults-separation.mjs

@@ -40,13 +40,12 @@ const AGENT_SECTION_DEFAULTS = Object.freeze({
 const MODULE_DEFAULTS = Object.freeze({ enabled: true });
 
 export const CHANNELS_DEFAULTS = Object.freeze({
-  access: Object.freeze({ dmPolicy: 'allowlist', allowFrom: [], channels: {} }),
   webhook: Object.freeze({ enabled: true, port: 3333 }),
 });
 
 // Disabled-agent roster shipped before `advisor` joined the defaults
 // (worker … writer plus the Maintainer). Stored full lists are read against it.
-export const PREVIOUS_DISABLED_AGENT_ROSTER = Object.freeze([
+const PREVIOUS_DISABLED_AGENT_ROSTER = Object.freeze([
   'front-worker',
   'heavy-worker',
   'maintainer',
@@ -168,17 +167,6 @@ function removeLegacyKeys(root, dataDir) {
     if (isPlainObject(agent.agents)) agent.agents = withoutRetiredAgentRoutes(agent.agents, dataDir);
     next.agent = agent;
   }
-  const channelEntries = next.channels?.access?.channels;
-  if (isPlainObject(channelEntries)) {
-    const channels = Object.fromEntries(
-      Object.entries(channelEntries).map(([id, entry]) => {
-        if (!isPlainObject(entry)) return [id, entry];
-        const { requireMention: _retired, ...rest } = entry;
-        return [id, rest];
-      })
-    );
-    next.channels = { ...next.channels, access: { ...next.channels.access, channels } };
-  }
   return next;
 }
 
@@ -188,7 +176,7 @@ function removeLegacyKeys(root, dataDir) {
  * not set the marker. `stripRouteDefaults` drops shipped presets and
  * maintenance routes (their defaults live with the agent config).
  */
-export function separateDefaultsInConfig(
+function separateDefaultsInConfig(
   root,
   { stripRouteDefaults = (agent) => agent, dataDir = resolvePluginData() } = {}
 ) {

package/src/runtime/shared/delegated-approval-host.mjs

@@ -6,14 +6,86 @@
 // owner, and the copy is withdrawn as soon as the owner settles (answered in
 // either place, timed out, its turn ended). Like held-request-host.mjs this
 // registry is process-wide and dependency-free.
+// Hand-offs take the same path: a session chats handed work to (`session`
+// send / create from a bot conversation, agent-task-sessions.mjs) shows its
+// own approvals in EVERY chat whose hand-off to it still owes its report, one
+// copy per chat, all settling the one request. The report watch store
+// (session-runtime/agent-home-delivery.mjs) notes and ends hand-offs as its
+// watches come and go, whatever removes them; a chat
+// whose last hand-off to the session ends loses its copy, the others keep
+// theirs.
 
 const KEY = Symbol.for('mixdog.delegatedApprovalHost.v1');
 
 function registry() {
-  globalThis[KEY] ??= { queues: new Set(), pending: new Map(), opener: null };
+  globalThis[KEY] ??= { queues: new Set(), pending: new Map(), opener: null, handoffs: new Map(), ended: new Set() };
   return globalThis[KEY];
 }
 
+/** The chats with a live hand-off to `sessionId`, each once (in noting order)
+ *  with the name its latest hand-off gave the session: Map chat → `{ title }`. */
+export function handoffChatsOf(sessionId) {
+  const chats = new Map();
+  for (const handoff of registry().handoffs.values()) {
+    if (handoff.sessionId !== sessionId) continue;
+    chats.delete(handoff.surfaceSessionId);
+    chats.set(handoff.surfaceSessionId, { title: handoff.title });
+  }
+  return chats;
+}
+
+/** Bring each pending request of `sessionId` that hand-offs reach to exactly
+ *  the chats now handing it work: a new chat gets its copy, a chat whose
+ *  hand-offs all ended loses only its own. */
+function syncHandoffCopies(sessionId) {
+  const { pending } = registry();
+  const chats = handoffChatsOf(sessionId);
+  for (const asked of pending.values()) {
+    if (!asked.copies || asked.sessionId !== sessionId) continue;
+    for (const [chat, copy] of asked.copies) {
+      if (chats.has(chat)) continue;
+      asked.copies.delete(chat);
+      for (const queue of liveQueuesOf(chat)) queue.withdraw(copy.id, null);
+    }
+    for (const [chat, handoff] of chats) {
+      if (asked.copies.has(chat)) continue;
+      const copy = { id: asked.id, sessionId: chat, request: asked.copyFor(chat, handoff), answer: asked.answer };
+      asked.copies.set(chat, copy);
+      deliver(copy, () => pending.get(asked.id) === asked && asked.copies.get(chat) === copy);
+    }
+  }
+}
+
+// Run ids of hand-offs that ended: never noted again (a watch read before it
+// was removed must not bring it back, however many hand-offs ended since).
+// Run ids are never reused, so an ended id is final for the life of the
+// process and there is nothing to age out: no count decides what is
+// forgotten. One id string is kept per ended hand-off.
+
+/** Chat `homeSessionId` handed session `taskSessionId` work (`title`: the
+ *  target's name in that chat) under report watch `runId`. */
+export function noteHandoff({ runId, taskSessionId, homeSessionId, title }) {
+  if (!runId || !taskSessionId || !homeSessionId || taskSessionId === homeSessionId) return;
+  if (registry().ended.has(String(runId))) return;
+  registry().handoffs.set(String(runId), {
+    sessionId: String(taskSessionId),
+    surfaceSessionId: String(homeSessionId),
+    title: String(title || ''),
+  });
+  syncHandoffCopies(String(taskSessionId));
+}
+
+/** The report watch `runId` is gone (its work reported back, was never
+ *  taken, or the watch was retired): its hand-off ends for good. */
+export function endHandoff(runId) {
+  const { handoffs, ended } = registry();
+  ended.add(String(runId));
+  const handoff = handoffs.get(String(runId));
+  if (!handoff) return;
+  handoffs.delete(String(runId));
+  syncHandoffCopies(handoff.sessionId);
+}
+
 /** `queue`: `{ sessionId() → string, disposed() → boolean, offer(delegated),
  *  withdraw(id, result) }` — one session runtime's approval queue. */
 export function registerApprovalQueue(queue) {
@@ -46,20 +118,36 @@ function offerTo(sessionId, delegated) {
   return live.length > 0;
 }
 
-/** Show `delegated` (`{ id, sessionId, request, answer(...finishArgs) → boolean }`,
- *  `sessionId` being the top-level conversation) there, now or once it loads. */
-export function delegateApproval(delegated) {
-  const { pending, opener } = registry();
-  pending.set(delegated.id, delegated);
-  if (offerTo(delegated.sessionId, delegated) || typeof opener !== 'function') return;
+/** Offer `copy` in its chat now, or once that chat loads while `current()`
+ *  still holds. */
+function deliver(copy, current) {
+  const { opener } = registry();
+  if (offerTo(copy.sessionId, copy) || typeof opener !== 'function') return;
   void Promise.resolve()
-    .then(() => opener(delegated.sessionId))
+    .then(() => opener(copy.sessionId))
     .then(() => {
-      if (pending.get(delegated.id) === delegated) offerTo(delegated.sessionId, delegated);
+      if (current()) offerTo(copy.sessionId, copy);
     })
     .catch(() => {});
 }
 
+/** Show `delegated` (`{ id, sessionId, request, answer(...finishArgs) → boolean }`,
+ *  `sessionId` being the top-level conversation) there, now or once it loads. */
+export function delegateApproval(delegated) {
+  const { pending } = registry();
+  pending.set(delegated.id, delegated);
+  deliver(delegated, () => pending.get(delegated.id) === delegated);
+}
+
+/** A top-level session's request (`{ id, sessionId, request, answer }`,
+ *  `sessionId` being the asking session) that every chat handing it work
+ *  shows too, now and while it waits: `copyFor(chat, { title })` is the
+ *  request as that chat shows it. */
+export function delegateToHandoffs(asked) {
+  registry().pending.set(asked.id, { ...asked, copies: new Map() });
+  syncHandoffCopies(asked.sessionId);
+}
+
 /** The owner settled `id`: every copy goes away. `result` (`{ approved, device }`)
  *  lets the copy say who answered. */
 export function withdrawDelegatedApproval(id, result = null) {
@@ -68,7 +156,11 @@ export function withdrawDelegatedApproval(id, result = null) {
   for (const queue of queues) queue.withdraw(id, result);
 }
 
-/** The pending delegated approvals a top-level session should show. */
+/** The pending delegated approvals (and hand-off copies) a top-level session
+ *  should show. */
 export function delegatedApprovalsFor(sessionId) {
-  return [...registry().pending.values()].filter((delegated) => delegated.sessionId === sessionId);
+  return [...registry().pending.values()].flatMap((delegated) => {
+    if (delegated.copies) return delegated.copies.has(sessionId) ? [delegated.copies.get(sessionId)] : [];
+    return delegated.sessionId === sessionId ? [delegated] : [];
+  });
 }

package/src/runtime/shared/developer-options.mjs

@@ -5,12 +5,25 @@
 // `developer.<optionId>` is true. Default off. An option with a `warning`
 // turns on only after the user confirms that warning; an option with a
 // `provider` gates that dev-only OAuth provider.
-import { readSection } from './config.mjs';
+import { readSection, readSectionStrict } from './config.mjs';
 
 const OAUTH_RISK_WARNING =
   'Using this provider through OAuth carries a high risk of penalties such as account restrictions.';
 
 export const DEVELOPER_SECTIONS = Object.freeze([
+  Object.freeze({
+    id: 'approvals',
+    label: 'Approvals',
+    options: Object.freeze([
+      Object.freeze({
+        id: 'allowAllActions',
+        label: 'Allow all actions',
+        description: 'Skips the approval cards for every action except payments and permanent deletes.',
+        warning:
+          'Turning this on lets agents act without asking you first, except for payments and permanent deletes. Use it only if you accept that risk.',
+      }),
+    ]),
+  }),
   Object.freeze({
     id: 'providers',
     label: 'Providers',
@@ -30,6 +43,13 @@ export const DEVELOPER_SECTIONS = Object.freeze([
         warning: OAUTH_RISK_WARNING,
         provider: 'cursor-oauth',
       }),
+      Object.freeze({
+        id: 'devinOAuth',
+        label: 'Devin',
+        description: 'Show Devin OAuth in Providers and the model picker.',
+        warning: OAUTH_RISK_WARNING,
+        provider: 'devin-oauth',
+      }),
       Object.freeze({
         id: 'mimoOAuth',
         label: 'MiMo',
@@ -74,6 +94,17 @@ export function developerOptionEnabled(id, stored = storedDeveloperConfig()) {
   return developerOption(id) !== null && normalizeDeveloperConfig(stored)[id] === true;
 }
 
+/** `developerOptionEnabled` for a safety bypass: fail-closed. Read straight
+ *  from the config file, so a missing or malformed config is never restored
+ *  from a backup (which may hold a stale `true`); any error means off. */
+export function developerOptionEnabledStrict(id) {
+  try {
+    return developerOption(id) !== null && normalizeDeveloperConfig(readSectionStrict('agent').developer)[id] === true;
+  } catch {
+    return false;
+  }
+}
+
 /** Settings view of every section; `stored` defaults to the on-disk values. */
 export function developerSettingsView(stored = storedDeveloperConfig()) {
   const values = normalizeDeveloperConfig(stored);

package/src/runtime/shared/err-text.mjs

@@ -206,24 +206,25 @@ function hasTypedEvidence(error) {
   );
 }
 
-// The window a provider timeout names (providerTimeoutError's message), or 0.
-const timedOutMs = (text) => Number(/timed out after (\d+)ms/i.exec(text)?.[1]) || 0;
+// The window a provider timeout names (providerTimeoutError's message, or a
+// first-byte watchdog's "within Nms"), or 0.
+const timedOutMs = (text) => Number(/(?:timed out after|within) (\d+)ms/i.exec(text)?.[1]) || 0;
 
 // A provider timeout before the model produced anything (isFirstByteTimeout):
-// the model is slow, not the connection.
-function stillThinkingText(error, text) {
+// the model is slow, not the connection. The provider name comes from the
+// caller's own provider config, never from the error.
+function stillThinkingText(error, text, providerLabel) {
   const ms = Number(error.waitedMs) || timedOutMs(text);
-  const provider =
-    typeof error.providerLabel === 'string' && error.providerLabel ? error.providerLabel : 'the provider';
+  const provider = typeof providerLabel === 'string' && providerLabel ? providerLabel : 'the provider';
   const attempts = Number(error.attempts) > 0 ? `; attempts: ${Math.floor(Number(error.attempts))}` : '';
   return `Model still thinking: no output in ${formatDurationMs(ms)}; ${provider} sent nothing yet${attempts}.`;
 }
 
 // Stamped provider timeout phases and stream cuts. Null when the error names
 // neither, so the text rules below decide.
-function typedStreamFailureText(error, text) {
+function typedStreamFailureText(error, text, providerLabel) {
   if (!error || typeof error !== 'object') return null;
-  if (isFirstByteTimeout(error)) return stillThinkingText(error, text);
+  if (isFirstByteTimeout(error)) return stillThinkingText(error, text, providerLabel);
   if (error.timeoutPhase === TIMEOUT_PHASE.IDLE) {
     const ms = timedOutMs(text);
     return ms > 0 ? `No progress ${formatDurationMs(ms)}.` : 'No progress.';
@@ -267,7 +268,7 @@ export function presentErrorText(error, options = {}) {
   if (embeddedError) text = embeddedError;
   text = oneLine(stripErrorPrefix(text));
   if (!text) return 'Unknown error';
-  const streamFailure = typedStreamFailureText(error, text);
+  const streamFailure = typedStreamFailureText(error, text, options.providerLabel);
   if (streamFailure) return streamFailure;
 
   if (code === 'PROVIDER_PREFIX_MUTATION' || name === 'ProviderPrefixMutationError') {
@@ -369,12 +370,20 @@ export function presentErrorText(error, options = {}) {
   return capText(safeErrorDetails(text) || 'Unknown error', max);
 }
 
-/** Why a provider request is being retried, as one short status phrase. */
-export function retryReasonText(error, options = {}) {
-  return presentErrorText(error, {
-    surface: options.surface || 'request',
-    max: options.max ?? 120,
-  }).replace(/\.$/, '');
+/**
+ * Our own wording for a typed timeout retry (`first_response_timeout` /
+ * `stalled`), built only from the error's stamps and the window in its
+ * message; null for any other class. No error text is ever echoed.
+ */
+export function retryTimeoutText(error, reasonClass, providerLabel = null) {
+  const text = String(error?.message ?? '');
+  const ms = timedOutMs(text);
+  if (reasonClass === 'first_response_timeout') {
+    if (isFirstByteTimeout(error)) return stillThinkingText(error, text, providerLabel).replace(/\.$/, '');
+    return ms > 0 ? `No first response ${formatDurationMs(ms)}` : 'No first response';
+  }
+  if (reasonClass === 'stalled') return ms > 0 ? `No progress ${formatDurationMs(ms)}` : 'No progress';
+  return null;
 }
 
 /** The one retry status line every surface shows: `reason · retry n/max in 15s`. */

package/src/runtime/shared/file-permissions.d.mts

@@ -3,14 +3,6 @@ export function enforceOwnerOnlyAclWin32(targetPath: string, options?: { fresh?:
 /** Test hook: the live per-process ACL helper, or null. */
 export function ownerOnlyAclHelperForTests(): import('node:child_process').ChildProcess | null;
 
-/** Test/diagnostic hook: helper attachment, pending requests, starts in the restart window. */
-export function ownerOnlyAclHelperStats(): {
-  alive: boolean;
-  pid: number | null;
-  pending: number;
-  recentStarts: number;
-};
-
 /** Non-fresh calls verify (and tighten) the real DACL on every call through a shared helper. */
 export function enforceOwnerOnlyAclWin32Async(targetPath: string, options?: { fresh?: boolean }): Promise<void>;