mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/context/skill-catalog.mjs

@@ -304,6 +304,31 @@ export function skillOutsideScopeError(name) {
   return `Error: skill "${name}" is not available in this project (its project scope excludes the current folder)`;
 }
 
+/** Why the Skill tool refuses `name` at `cwd` now (missing feature, switched
+ *  off, outside the project scope), or null when nothing refuses it. `config`
+ *  and `skills` let a batch of checks share one config read and one scan. */
+export function skillLoadRefusal(name, cwd, config = null, skills = null) {
+  const missing = skillMissingFeature(name, config, skills);
+  if (missing) {
+    return `Error: skill "${name}" needs the ${missing} built-in feature, which is not installed or is switched off in Extensions → Plugin → Built-in`;
+  }
+  if (isSkillDisabled(name, config, skills)) return `Error: skill "${name}" is disabled`;
+  if (skillOutsideScope(name, cwd, config, skills)) return skillOutsideScopeError(name);
+  return null;
+}
+
+/**
+ * What the Skill tool would deliver for `name` at `cwd` now: the injected
+ * `<skill>` body and the resource it came from, or null when the skill no
+ * longer loads there (refused by skillLoadRefusal, or removed).
+ */
+export function currentSkillDelivery(name, cwd, config = null, skills = null) {
+  if (skillLoadRefusal(name, cwd, config, skills)) return null;
+  const resource = loadSkillResource(name, cwd);
+  if (!resource) return null;
+  return { body: buildSkillResultEnvelope(name, resource.content, resource.dir), resource };
+}
+
 /**
  * Skills a session may see: not switched off, feature available, and — when
  * `cwd` is given — inside the skill's (or its plugin's) project scope. Without
@@ -348,11 +373,16 @@ const _skillsCache = new Map();
 // every plain-file gate path are stat'ed on every call as before.
 const _ROOT_WATCH_LIMIT = 64;
 const _rootWatches = new Map(); // root -> { watcher, dirty, text, settled }
+// Bumped by every closed root watch; part of each cached SKILL.md text stamp.
+let _skillTextGeneration = 0;
 
 function _closeRootWatch(root) {
   const watch = _rootWatches.get(root);
   if (!watch) return;
   _rootWatches.delete(root);
+  // Any change under a skill root (or a lost watcher, or an invalidation)
+  // makes the next load re-read SKILL.md text, whatever the file stamps say.
+  _skillTextGeneration += 1;
   try {
     watch.watcher.close();
   } catch {
@@ -452,6 +482,26 @@ export function skillExecutionDir(dir, source) {
   return String(dir).replace(/([\\/])runtime\.asar(?=[\\/]|$)/, '$1runtime.asar.unpacked');
 }
 
+// SKILL.md text per catalog entry, with the stamp it was read at: the
+// file's own mtime and size (any depth) plus the skills watcher generation
+// (an edit that keeps both, e.g. inside one timestamp tick).
+const _skillFileText = new WeakMap();
+
+function skillFileText(skill) {
+  let stamp;
+  try {
+    const stat = statSync(skill.filePath);
+    stamp = `${_skillTextGeneration}:${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return null;
+  }
+  const cached = _skillFileText.get(skill);
+  if (cached?.stamp === stamp) return cached.text;
+  const text = readSafe(skill.filePath);
+  _skillFileText.set(skill, { stamp, text });
+  return text;
+}
+
 /**
  * Load full skill content plus its on-disk directory (for base-dir + ${MIXDOG_SKILL_DIR};
  * ${MIXDOG_SKILL_NODE} is resolved at render time in buildSkillResultEnvelope).
@@ -462,7 +512,10 @@ export function loadSkillResource(name, cwd) {
   const skills = collectSkillsCached(cwd);
   const skill = skills.find((s) => s.name === skillName);
   if (!skill) return null;
-  const content = readSafe(skill.filePath);
+  // The catalog's freshness signature does not see every nested SKILL.md, so
+  // the text follows the file itself: one stat per load, re-read only when
+  // that file's own mtime or size moved.
+  const content = skillFileText(skill);
   if (content == null) return null;
   try {
     return {

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -203,7 +203,7 @@ export function readProjectConnectorsFile(path) {
   });
 }
 
-export function projectConnectorPolicies(dataDir = resolvePluginData()) {
+function projectConnectorPolicies(dataDir = resolvePluginData()) {
   return cachedRead(join(dataDir, PROJECT_CONNECTORS_FILE), readProjectConnectorsFile);
 }
 
@@ -219,7 +219,7 @@ export function connectorToolPermission(policy, toolOrName) {
   return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
-const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+export const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
 export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
 
 /** Whether replacing the stored policy `before` (a stored value, a parsed
@@ -229,7 +229,7 @@ export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do wit
  *  default, which is `needs_approval` for a catalog connector's high-risk
  *  tools and `auto` otherwise). A legacy allow list or an unreadable policy is
  *  not compared: it counts as widening. */
-export function connectorPolicyWidens(before, after) {
+function connectorPolicyWidens(before, after) {
   let old;
   try {
     old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);

package/src/runtime/agent/orchestrator/mcp/client-transport.mjs

@@ -5,9 +5,16 @@
  */
 import { readServicePort } from '../../../shared/service-discovery.mjs';
 import { createMcpOAuth } from './oauth.mjs';
-import { mcpOAuthClientFor } from './oauth-client.mjs';
+import { mcpOAuthClientFor, mcpOAuthDisplayName } from './oauth-client.mjs';
 import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
 import { gmailAppPasswordService, withGmailAppPasswordMcp } from '../../../connectors/gmail-app-password.mjs';
+import { connectorAccountRequest, withConnectorAccountsMcp } from '../../../connectors/connector-accounts-mcp.mjs';
+import {
+  connectorAccountsOf,
+  connectorLiveAccountServers,
+  gmailAppPasswordAccount,
+} from '../../../shared/connector-catalog.mjs';
+import { isMcpOAuthReauthenticationRequired } from './oauth.mjs';
 import {
   AUTO_DETECT_PORTS,
   expandEnvVars,
@@ -63,10 +70,65 @@ export function hasConfiguredMcpAuth(cfg) {
   return (
     Boolean(String(cfg.bearer_token_env_var || '').trim()) ||
     configured(cfg.headers) ||
-    configured(cfg.env_http_headers)
+    configured(cfg.env_http_headers) ||
+    // A multi-account connector's server: each account authenticates itself.
+    connectorAccountsOf(cfg).length > 0
   );
 }
 
+/** One account of a multi-account connector server (connector-catalog.mjs
+ *  connectorAccountServer) as connector-accounts-mcp.mjs calls it: through
+ *  the transport the account had as a server of its own — its app-password
+ *  header, or its own non-interactive OAuth sign-in (refreshed as needed; a
+ *  new sign-in goes through 계정 바꾸기, never through a tool call). */
+function connectorAccountClient(serverName, accountCfg, oauthOptions) {
+  const base = { name: accountCfg.name, email: '', appPassword: false, close() {} };
+  let url;
+  try {
+    url = resolveMcpOAuthUrl(accountCfg);
+    if (hasConfiguredMcpAuth(accountCfg)) {
+      const email = gmailAppPasswordAccount(accountCfg);
+      const fetchImpl = gmailAppPasswordService(url) ? withGmailAppPasswordMcp() : fetch;
+      return {
+        ...base,
+        email,
+        appPassword: Boolean(email),
+        request: connectorAccountRequest(url, fetchImpl, resolveMcpHttpHeaders(accountCfg)),
+      };
+    }
+    const oauth = createMcpOAuth({
+      url,
+      serverName: mcpOAuthDisplayName(accountCfg, serverName),
+      oauthClient: mcpOAuthClientFor(accountCfg, url),
+      ...(oauthOptions?.fetchImpl ? { fetchImpl: oauthOptions.fetchImpl } : {}),
+      ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
+    });
+    const send = connectorAccountRequest(url, (input, init) => oauth.fetch(input, init));
+    return {
+      ...base,
+      async request(message, options) {
+        try {
+          return await send(message, options);
+        } catch (error) {
+          const reason = scrubMcpConnectionMessage(error?.message || String(error), accountCfg);
+          const scrubbed = new Error(
+            isMcpOAuthReauthenticationRequired(error)
+              ? 'Sign-in required; sign this account in again in Connectors.'
+              : reason
+          );
+          if (isMcpOAuthReauthenticationRequired(error)) scrubbed.authRequired = true;
+          throw scrubbed;
+        }
+      },
+      close: () => oauth.close(),
+    };
+  } catch (error) {
+    // A broken account (no sign-in client, an invalid address) stays listed with why.
+    const failed = new Error(error?.message || String(error));
+    return { ...base, request: async () => Promise.reject(failed) };
+  }
+}
+
 // The SDK's WebSocket transport opens its socket without a way to set request
 // headers. This subclass changes only socket creation: Node's WebSocket takes
 // `{ protocols, headers }`; the guard and event wiring match the stock start().
@@ -101,24 +163,115 @@ function createHeaderWebSocketTransport(Base, messageSchema, url, headers) {
     }
   })(url);
 }
+// Unset variables a config references: a failure under `strictEnv`,
+// otherwise warnings (names only), each logged.
+function missingEnvWarnings(name, cfg, strictEnv, log) {
+  const warnings = [];
+  const missing = findMissingMcpEnvVars(cfg);
+  if (missing.length) {
+    const message = `missing environment variable(s): ${missing.join(', ')}`;
+    if (strictEnv === true) throw new Error(message);
+    warnings.push(message);
+    log(`[mcp-client] "${name}": ${message}\n`);
+  }
+  return warnings;
+}
+
+// A multi-account connector: one server, every account behind it; closing the
+// transport closes every account client.
+function connectorAccountsTransport({ name, cfg, Transport, url, accountServers, oauthOptions, log }) {
+  const accounts = accountServers.map((accountCfg) => connectorAccountClient(name, accountCfg, oauthOptions));
+  const transport = new Transport(new URL(url), {
+    fetch: withConnectorAccountsMcp({ connector: cfg.connector, accounts }),
+  });
+  const close = transport.close.bind(transport);
+  transport.close = async () => {
+    for (const account of accounts) account.close();
+    await close();
+  };
+  log(`[mcp-client] Connecting "${name}" with ${accounts.length} account(s)\n`);
+  return transport;
+}
+
+// A streamable HTTP or SSE server: its configured authentication, or else an
+// OAuth sign-in the transport owns (and closes with it).
+function remoteHttpTransport({ name, cfg, kind, Transport, url, oauthOptions, log }) {
+  const opts = requestInitFor(cfg);
+  // Explicit authentication remains authoritative (including custom API-key
+  // headers). Never forward those credentials to OAuth discovery endpoints.
+  let transport;
+  let oauth = null;
+  if (!hasConfiguredMcpAuth(cfg)) {
+    oauth = createMcpOAuth({
+      url,
+      serverName: mcpOAuthDisplayName(cfg, name),
+      oauthClient: mcpOAuthClientFor(cfg, url),
+      ...oauthOptions,
+      // A built-in Google connector is answered in-process.
+      ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
+      // SSE advertises its POST endpoint on the authenticated event stream.
+      // No other path on the origin is allowed to receive this server's token.
+      isTransportEndpoint: (input) => kind === 'sse' && transport?._endpoint?.href === new URL(input).href,
+    });
+  }
+  // Gmail with an app password is answered in-process too (its account
+  // header is the configured authentication; the password is in the keychain).
+  const local = !oauth && gmailAppPasswordService(url) ? { ...opts, fetch: withGmailAppPasswordMcp() } : opts;
+  transport = new Transport(new URL(url), oauth ? { fetch: oauth.fetch } : local);
+  if (oauth) {
+    transport.oauth = oauth;
+    const close = transport.close.bind(transport);
+    transport.close = async () => {
+      oauth.close();
+      await close();
+    };
+  }
+  log(`[mcp-client] Connecting "${name}" via ${kind.toUpperCase()}: ${mcpUrlForLog(url)}\n`);
+  return transport;
+}
+
+function webSocketTransport(name, cfg, sdk, log) {
+  const { WebSocketClientTransport } = sdk;
+  const url = normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), 'ws');
+  const opts = requestInitFor(cfg);
+  log(`[mcp-client] Connecting "${name}" via WebSocket: ${mcpUrlForLog(url)}\n`);
+  return opts
+    ? createHeaderWebSocketTransport(
+        WebSocketClientTransport,
+        sdk.JSONRPCMessageSchema,
+        new URL(url),
+        opts.requestInit.headers
+      )
+    : new WebSocketClientTransport(new URL(url));
+}
+
+// A stdio child, its stderr logged and its bounded (scrubbed) tail kept.
+function stdioTransport(name, cfg, StdioClientTransport, log) {
+  const transport = new StdioClientTransport({
+    command: expandEnvVars(String(cfg.command ?? '')),
+    args: Array.isArray(cfg.args) ? expandEnvVars(cfg.args) : cfg.args,
+    cwd: cfg.cwd == null ? cfg.cwd : expandEnvVars(String(cfg.cwd)),
+    env: resolveMcpStdioEnvironment(cfg),
+    stderr: cfg.stderr ?? 'pipe',
+  });
+  let tail = '';
+  transport.stderr?.on?.('data', (chunk) => {
+    const text = scrubMcpConnectionMessage(chunk, cfg);
+    tail = (tail + text).slice(-MCP_STDERR_TAIL_CHARS);
+    log(`[mcp:${name}:stderr] ${text}`);
+  });
+  return { transport, stderrTail: () => tail.trim() };
+}
+
 /** Returns { transport, autoDetectAdvert, stderrTail, warnings } — stderrTail()
  *  is the last ~4 KB of a stdio server's (scrubbed) stderr, '' for remote
  *  transports. `strictEnv` (the caller passes it for plugin-declared servers)
  *  makes unset variables without a default fail the server; otherwise they
  *  expand to empty and are reported in `warnings` (names only). */
 export function createMcpTransport({ name, cfg, sdk, log, strictEnv, oauthOptions }) {
-  const { StdioClientTransport, StreamableHTTPClientTransport, SSEClientTransport, WebSocketClientTransport } = sdk;
+  const { StdioClientTransport, StreamableHTTPClientTransport, SSEClientTransport } = sdk;
   const kind = resolveMcpTransportKind(cfg);
-  const warnings = [];
-  if (kind !== 'autoDetect') {
-    const missing = findMissingMcpEnvVars(cfg);
-    if (missing.length) {
-      const message = `missing environment variable(s): ${missing.join(', ')}`;
-      if (strictEnv === true) throw new Error(message);
-      warnings.push(message);
-      log(`[mcp-client] "${name}": ${message}\n`);
-    }
-  }
+  const warnings = kind !== 'autoDetect' ? missingEnvWarnings(name, cfg, strictEnv, log) : [];
   if (kind === 'autoDetect') {
     const { url, advert } = resolveAutoDetectUrl(name, cfg);
     log(`[mcp-client] Connecting "${name}" via autoDetect HTTP: ${url}\n`);
@@ -132,72 +285,23 @@ export function createMcpTransport({ name, cfg, sdk, log, strictEnv, oauthOption
   if (kind === 'http' || kind === 'sse') {
     const Transport = kind === 'http' ? StreamableHTTPClientTransport : SSEClientTransport;
     const url = resolveMcpOAuthUrl(cfg);
-    const opts = requestInitFor(cfg);
-    // Explicit authentication remains authoritative (including custom API-key
-    // headers). Never forward those credentials to OAuth discovery endpoints.
-    let transport;
-    const oauth = hasConfiguredMcpAuth(cfg)
-      ? null
-      : createMcpOAuth({
-          url,
-          serverName: name,
-          oauthClient: mcpOAuthClientFor(cfg, url),
-          ...oauthOptions,
-          // A built-in Google connector is answered in-process.
-          ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
-          // SSE advertises its POST endpoint on the authenticated event stream.
-          // No other path on the origin is allowed to receive this server's token.
-          isTransportEndpoint: (input) => kind === 'sse' && transport?._endpoint?.href === new URL(input).href,
-        });
-    // Gmail with an app password is answered in-process too (its account
-    // header is the configured authentication; the password is in the keychain).
-    const local = !oauth && gmailAppPasswordService(url) ? { ...opts, fetch: withGmailAppPasswordMcp() } : opts;
-    transport = new Transport(new URL(url), oauth ? { fetch: oauth.fetch } : local);
-    if (oauth) {
-      transport.oauth = oauth;
-      const close = transport.close.bind(transport);
-      transport.close = async () => {
-        oauth.close();
-        await close();
-      };
+    // A disabled account is neither connected nor routed to.
+    const accountServers = connectorLiveAccountServers(cfg);
+    if (!accountServers.length && connectorAccountsOf(cfg).length) {
+      throw new Error(`Every account of "${name}" is disabled`);
     }
-    log(`[mcp-client] Connecting "${name}" via ${kind.toUpperCase()}: ${mcpUrlForLog(url)}\n`);
-    return {
-      transport,
-      autoDetectAdvert: null,
-      stderrTail: noStderrTail,
-      warnings,
-    };
+    const transport = accountServers.length
+      ? connectorAccountsTransport({ name, cfg, Transport, url, accountServers, oauthOptions, log })
+      : remoteHttpTransport({ name, cfg, kind, Transport, url, oauthOptions, log });
+    return { transport, autoDetectAdvert: null, stderrTail: noStderrTail, warnings };
   }
   if (kind === 'ws') {
-    const url = normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), 'ws');
-    const opts = requestInitFor(cfg);
-    log(`[mcp-client] Connecting "${name}" via WebSocket: ${mcpUrlForLog(url)}\n`);
-    const transport = opts
-      ? createHeaderWebSocketTransport(
-          WebSocketClientTransport,
-          sdk.JSONRPCMessageSchema,
-          new URL(url),
-          opts.requestInit.headers
-        )
-      : new WebSocketClientTransport(new URL(url));
+    const transport = webSocketTransport(name, cfg, sdk, log);
     return { transport, autoDetectAdvert: null, stderrTail: noStderrTail, warnings };
   }
   if (kind === 'stdio') {
-    const transport = new StdioClientTransport({
-      command: expandEnvVars(String(cfg.command ?? '')),
-      args: Array.isArray(cfg.args) ? expandEnvVars(cfg.args) : cfg.args,
-      cwd: cfg.cwd == null ? cfg.cwd : expandEnvVars(String(cfg.cwd)),
-      env: resolveMcpStdioEnvironment(cfg),
-      stderr: cfg.stderr ?? 'pipe',
-    });
-    let tail = '';
-    transport.stderr?.on?.('data', (chunk) => {
-      const text = scrubMcpConnectionMessage(chunk, cfg);
-      tail = (tail + text).slice(-MCP_STDERR_TAIL_CHARS);
-      log(`[mcp:${name}:stderr] ${text}`);
-    });
-    return { transport, autoDetectAdvert: null, stderrTail: () => tail.trim(), warnings };
+    const { transport, stderrTail } = stdioTransport(name, cfg, StdioClientTransport, log);
+    return { transport, autoDetectAdvert: null, stderrTail, warnings };
   }
   throw new Error(
     `Invalid config for "${name}": need autoDetect, type (stdio/http/sse/ws), url (http), or command (stdio)`

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -35,13 +35,16 @@ import { createLazyOutputValidator } from './lazy-output-validator.mjs';
 import { appendMcpStderrTail, createMcpTransport, hasConfiguredMcpAuth } from './client-transport.mjs';
 import { listAllMcpTools, MCP_CONNECT_CANCELLED, runBoundedHandshake } from './client-handshake.mjs';
 import { rememberServerConnector } from './server-connectors.mjs';
-import { mcpOAuthClientFor } from './oauth-client.mjs';
+import { mcpOAuthClientFor, mcpOAuthDisplayName } from './oauth-client.mjs';
 import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
+import { gmailAppPasswordService } from '../../../connectors/gmail-app-password.mjs';
+import { connectorLiveAccountServers } from '../../../shared/connector-catalog.mjs';
 import {
   clearMcpOAuth,
   commitMcpOAuthSwitch,
   hasStoredMcpOAuthTokens,
   isMcpOAuthReauthenticationRequired,
+  isMcpOAuthScopeNotGranted,
   MCP_OAUTH_CALLBACK_NOT_PENDING,
   startMcpOAuthSwitch,
   storedMcpOAuthIdentity,
@@ -1116,6 +1119,23 @@ export function isMcpTool(name) {
 export function isRegisteredMcpTool(name, scopeId = DEFAULT_MCP_SCOPE_ID) {
   return Boolean(resolveMcpToolTarget(scopeId, name)?.definition);
 }
+/** True when the prefixed name is `read_email` of a server whose every
+ *  endpoint Mixdog answers in-process (the Gmail app-password connector,
+ *  alone or behind the multi-account server): its result is a mail as the
+ *  mailbox holds it, never another server's text (browser-bridge/mail-links.mjs). */
+export function isBuiltinMailRead(name, scopeId = DEFAULT_MCP_SCOPE_ID) {
+  const target = resolveMcpToolTarget(normalizeMcpScopeId(scopeId), name);
+  if (!target || (target.definition?.mcpToolName || MCP_TOOL_NAME_RE.exec(name)?.[2]) !== 'read_email') return false;
+  const accounts = connectorLiveAccountServers(target.server.cfg);
+  return (accounts.length ? accounts : [target.server.cfg]).every((cfg) => {
+    try {
+      const url = resolveMcpOAuthUrl(cfg);
+      return Boolean(gmailAppPasswordService(url) || googleMcpService(url));
+    } catch {
+      return false;
+    }
+  });
+}
 /**
  * Check whether the inputSchema for an MCP tool declares the given top-level
  * property. Used to decide if the orchestrator should auto-inject context
@@ -1279,7 +1299,7 @@ export function startMcpServerOAuthSwitch(cfg, launch, serverName) {
   return startMcpOAuthSwitch({
     url,
     launch,
-    serverName,
+    serverName: mcpOAuthDisplayName(cfg, serverName),
     oauthClient: mcpOAuthClientFor(cfg, url),
     ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp() } : {}),
   });
@@ -1464,8 +1484,11 @@ async function connectServer(
     // sign-in was required, or an explicit one did not complete (cancelled,
     // denied, timed out or a failed exchange after it started, or cancelled
     // before it could). A failure after the sign-in obtained tokens is real.
+    // A sign-in Google (or another provider) answered without a requested
+    // scope is reported as its own error: the status row carries the message.
     const signInIncomplete =
       transport.oauth &&
+      !isMcpOAuthScopeNotGranted(error) &&
       (isMcpOAuthReauthenticationRequired(error) ||
         (transport.oauth.loginStarted && !transport.oauth.loginCompleted) ||
         (transport.oauth.interactive && error?.code === MCP_CONNECT_CANCELLED));

package/src/runtime/agent/orchestrator/mcp/oauth-callback.mjs

@@ -97,6 +97,35 @@ export function answerOAuthCallback(req, res, { redirectUrl, state, finish, serv
     finish(undefined);
     return;
   }
-  page(200, oauthSuccessHtml(server));
-  finish(target.searchParams.get('code'));
+  // The code is only the start: the page stays open until the login reports
+  // its outcome through `respond` (after the code exchange and scope check).
+  finish(target.searchParams.get('code'), (failure) => {
+    // Resolves once the page is flushed (bounded), so the caller may close the listener.
+    const flushed = new Promise((resolve) => {
+      const timer = setTimeout(resolve, 1000);
+      timer.unref?.();
+      const done = () => {
+        clearTimeout(timer);
+        resolve();
+      };
+      res.once('finish', done);
+      res.once('close', done);
+    });
+    if (!failure) page(200, oauthSuccessHtml(server));
+    else if (failure.stale) invalid();
+    else page(400, oauthErrorHtml(failurePageReason(server, failure.code)));
+    return flushed;
+  });
+}
+
+// Fixed bilingual texts by error code: SDK/server error text and tokens are
+// never put on the page.
+function failurePageReason(server, code) {
+  if (code === 'scopeNotGranted') {
+    return (
+      `${server} 접근 권한이 허용되지 않았습니다. Mixdog로 돌아가 다시 연결하고, 권한 확인란을 체크해 주세요. (Google은 확인란이 처음에 해제되어 있습니다.)\n` +
+      `Access to ${server} was not granted. Return to Mixdog and connect again with the access box checked (Google starts it unchecked).`
+    );
+  }
+  return `${server} 로그인을 완료하지 못했습니다.\nSign-in to ${server} could not be completed.`;
 }

package/src/runtime/agent/orchestrator/mcp/oauth-client.mjs

@@ -7,7 +7,7 @@
 //     its scopes and the provider's offline-access parameter.
 import { createHash } from 'node:crypto';
 import keychain from '../../../../lib/keychain-cjs.cjs';
-import { connectorById, connectorOfServer } from '../../../shared/connector-catalog.mjs';
+import { connectorById, connectorOfServer, gmailAppPasswordAccount } from '../../../shared/connector-catalog.mjs';
 import { GOOGLE_AUTH_PARAMS, googleOAuthClient } from '../../../shared/google-oauth-client.mjs';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 
@@ -31,6 +31,12 @@ export async function saveMcpOAuthClientSecret(url, secret, credentialStore = ke
   else await credentialStore.deleteSecretAsync(account);
 }
 
+/** What the sign-in page calls server `name` configured as `cfg`: a catalog
+ *  connector's display name ("Google Drive"), else the server name. */
+export function mcpOAuthDisplayName(cfg, name) {
+  return connectorById(connectorOfServer(cfg))?.name || name;
+}
+
 /**
  * `{ clientId, clientSecret?, secretAccount?, scopes?, authParams? }` for
  * server config `cfg` at `url`, or null to register a client dynamically.
@@ -44,6 +50,13 @@ export function mcpOAuthClientFor(cfg, url) {
     const authParams = catalog?.oauthClient === 'google' ? GOOGLE_AUTH_PARAMS : undefined;
     return { clientId: own, secretAccount: mcpOAuthClientSecretAccount(url), scopes, authParams };
   }
-  const builtIn = catalog?.oauthClient ? BUILT_IN_CLIENTS[catalog.oauthClient]?.() : null;
-  return builtIn ? { ...builtIn, scopes } : null;
+  if (!catalog?.oauthClient || gmailAppPasswordAccount(cfg)) return null;
+  const builtIn = BUILT_IN_CLIENTS[catalog.oauthClient]?.();
+  // Google offers no dynamic client registration: never fall back to it.
+  if (!builtIn) {
+    throw new Error(
+      `MCP OAuth clientUnavailable: this build has no built-in ${catalog.oauthClient} sign-in client; use your own ${catalog.oauthClient} client.`
+    );
+  }
+  return { ...builtIn, scopes };
 }

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -3,7 +3,7 @@ import { randomBytes } from 'node:crypto';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 import { identityFromTokenResponse } from './oauth-account.mjs';
 import { answerOAuthCallback } from './oauth-callback.mjs';
-import { anySignal, loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
+import { anySignal, loginFailed, reauthenticationRequired, scopeNotGranted } from './oauth-shared.mjs';
 
 /**
  * The browser login of one connection over its credential `cache` and login
@@ -12,10 +12,15 @@ import { anySignal, loginFailed, reauthenticationRequired } from './oauth-shared
  */
 export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, openBrowser, fetchImpl, timeoutMs }) {
   const { creds } = cache;
+  // The flush of the browser page being answered (see `settle`): connections
+  // are dropped only after it, so the page is never cut off by a reset.
+  let flushing;
   function stopListening() {
-    flow.listener?.close();
-    flow.listener?.closeAllConnections();
+    const listener = flow.listener;
     flow.listener = undefined;
+    listener?.close();
+    if (flushing) flushing.then(() => listener?.closeAllConnections());
+    else listener?.closeAllConnections();
   }
   function closeListener() {
     stopListening();
@@ -23,10 +28,13 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     flow.state = undefined;
   }
   // The login's callback is answered once, by the loopback or a paste.
-  function answerCallback(code) {
+  // `respond` (loopback only) answers the browser page once the outcome is
+  // known; a callback nobody is waiting for gets the invalid-link page.
+  function answerCallback(code, respond) {
     const finish = flow.finishCallback;
     flow.finishCallback = undefined;
-    finish?.(code);
+    if (finish) finish(code, respond);
+    else respond?.({ stale: true });
   }
   async function listenForCallback(serverName) {
     flow.listener = createServer((req, res) =>
@@ -53,6 +61,7 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     // Who this login's tokens belong to (oauth-account.mjs): the SDK keeps only
     // the token fields, so the token endpoint's answer is read here.
     flow.identity = undefined;
+    flow.signal = signal;
     const safeFetch = async (input, init = {}) => {
       const response = await fetchImpl(normalizeMcpTransportUrl(input), {
         ...init,
@@ -79,10 +88,31 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       }
     };
     let abort;
+    // The browser page held open for the loopback callback until the code
+    // exchange and scope check end: `settle()` is success, `settle({ code })`
+    // a failure. Bounded by `signal`, like the exchange itself.
+    let respond;
+    const settle = (failure) => {
+      const answer = respond;
+      respond = undefined;
+      if (!answer) return undefined;
+      flushing = answer(failure);
+      return flushing;
+    };
     const callback = new Promise((resolve, reject) => {
-      const finish = (code) => (code ? resolve(code) : reject(loginFailed()));
+      const finish = (code, page) => {
+        if (page) respond = page;
+        return code ? resolve(code) : reject(loginFailed());
+      };
       flow.finishCallback = finish;
-      abort = () => finish();
+      // Timeout, cancel or abort: the held page gets the generic failure now
+      // (the exchange or a credential write may be stalled past the deadline),
+      // and the listener closes once it is flushed.
+      abort = () => {
+        finish();
+        settle({});
+        stopListening();
+      };
       signal.addEventListener('abort', abort, { once: true });
     });
     // A discovery/registration error can precede waiting for the callback.
@@ -121,12 +151,17 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       }
       progress('onAuthorized');
       signal.throwIfAborted();
+      await settle();
     } catch (error) {
+      await settle({ code: error?.code });
       // SDK errors may contain authorization server response bodies/secrets.
       if (error?.code === 'reauthenticationRequired' || !interactive) throw reauthenticationRequired();
+      // Our own error names scopes only (no token data): the one to pass on.
+      if (error?.code === 'scopeNotGranted') throw scopeNotGranted(error.missingScopes);
       throw loginFailed();
     } finally {
       flow.allowBrowser = false;
+      flow.signal = undefined;
       signal.removeEventListener('abort', abort);
       closeListener();
       flow.finishCallback = undefined;