mixdog 1.3.5 → 1.4.0

package/src/runtime/memory/lib/runtime-fetcher.mjs

@@ -158,8 +158,9 @@ function runtimePaths(verDir) {
 // Download with retry
 // ---------------------------------------------------------------------------
 
-async function downloadWithRetry(url, destPath, expectedBytes) {
+async function downloadWithRetry(url, destPath, expectedBytes, signal) {
   return downloadToFileWithRetry(url, destPath, {
+    signal,
     maxBytes: expectedBytes,
     expectedBytes,
     label: 'memory runtime download',
@@ -532,11 +533,12 @@ function publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256) {
  * staging lock, ending with the stale-version GC. Returns the installed
  * runtime-{version} directory.
  */
-async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, version, pkey }) {
+async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, version, pkey, signal }) {
   // tar is only required for the download/extract path. Probe here (not at
   // ensureRuntime entry) so a machine without tar can still reuse an
   // already-extracted, sha-matching cached runtime via the fast path.
   await probeTar();
+  signal?.throwIfAborted();
 
   __mixdogMemoryLog(`[runtime-fetcher] downloading runtime ${version} for ${pkey} (~${size} bytes) …\n`);
 
@@ -566,7 +568,7 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
               `[runtime-fetcher] retrying runtime download from fallback release repo — ${candidateUrl}\n`
             );
           }
-          await downloadWithRetry(candidateUrl, tarPath, size);
+          await downloadWithRetry(candidateUrl, tarPath, size, signal);
           await verifySha256(tarPath, sha256);
           downloadOk = true;
           break;
@@ -575,9 +577,12 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
           try {
             rmSync(tarPath, { force: true });
           } catch {}
+          // A cancelled install tries no fallback repository.
+          signal?.throwIfAborted();
         }
       }
       if (!downloadOk && lastDownloadErr) throw lastDownloadErr;
+      signal?.throwIfAborted();
       await _extractRuntimeTarGz(tarPath, stagingDir, stagingDir);
     } finally {
       try {
@@ -591,6 +596,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
       } catch {}
       throw new Error(`[runtime-fetcher] download or verify failed for ${version}`);
     }
+    // Cancelled after the extract: drop the unpublished tree, publish nothing.
+    if (signal?.aborted) {
+      rmSync(stagingDir, { recursive: true, force: true });
+      signal.throwIfAborted();
+    }
 
     // Stamp sha256 inside staging dir.
     writeFileAtomicSync(join(stagingDir, '.version-sha256'), sha256);
@@ -615,6 +625,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
     gcRuntimeDir(runtimeBaseDir, key);
   } finally {
     releaseStagingLock(stagingLock);
+    // Publishing is synchronous past the last cancellation check, so an
+    // aborted signal here means nothing was published.
+    if (signal?.aborted) {
+      __mixdogMemoryLog(`[runtime-fetcher] install of ${version} cancelled; its staging was removed\n`);
+    }
   }
 
   __mixdogMemoryLog(`[runtime-fetcher] runtime ready at ${verDir}\n`);
@@ -631,7 +646,10 @@ export const _runtimeLayoutInternals = {
   runtimeInstallKey,
 };
 
-export async function ensureRuntime(dataDir) {
+/** `signal` cancels a download/install in progress: its retry waits end, its
+ *  partial files and staging lock are removed and nothing is published, so the
+ *  next call starts a fresh install. */
+export async function ensureRuntime(dataDir, { signal = null } = {}) {
   const key = resolve(dataDir);
   if (runtimeCache.has(key)) return runtimeCache.get(key);
 
@@ -655,7 +673,7 @@ export async function ensureRuntime(dataDir) {
 
   const verDir =
     cachedRuntimeDir(runtimeBaseDir, version, sha256) ??
-    (await installRuntimeVersion({ runtimeBaseDir, url, sha256, size, version, pkey }));
+    (await installRuntimeVersion({ runtimeBaseDir, url, sha256, size, version, pkey, signal }));
 
   const result = { runtimeDir: verDir, ...runtimePaths(verDir), version };
   runtimeCache.set(key, result);

package/src/runtime/session-search/session-search-db.mjs

@@ -6,9 +6,12 @@
  *
  * Rows are append-only: compaction may drop old messages from a session file,
  * but their search rows stay, so earlier conversation remains findable until
- * the session itself is deleted.
+ * the session itself is deleted. The one rewrite: a value marked sensitive
+ * replaces the rows that hold it (replaceSessionSearchMessages).
  */
 
+import { randomBytes } from 'node:crypto';
+
 import { ensurePgInstance, withSchemaBootstrapLock } from '../memory/lib/pg/adapter.mjs';
 import { buildFtsPrefixQuery } from '../memory/lib/memory-text-utils.mjs';
 import {
@@ -91,13 +94,9 @@ export function sessionSearchRows(sessionId, messages) {
   return rows;
 }
 
-/** Idempotent append of a transcript's searchable messages; returns the count
- *  of newly stored rows. Re-sending an already stored message is a no-op. */
-export async function appendSessionSearchMessages(sessionId, messages, { dataDir } = {}) {
-  const rows = sessionSearchRows(sessionId, messages);
+async function insertRows(queryable, rows) {
   if (rows.length === 0) return 0;
-  const db = await getDb(dataDir);
-  const result = await db.query(
+  const result = await queryable.query(
     `INSERT INTO session_search.messages (source_ref, session_id, ordinal, role, ts, content)
      SELECT * FROM unnest($1::text[], $2::text[], $3::int[], $4::text[], $5::bigint[], $6::text[])
      ON CONFLICT (source_ref) DO NOTHING`,
@@ -113,8 +112,73 @@ export async function appendSessionSearchMessages(sessionId, messages, { dataDir
   return Number(result?.rowCount) || 0;
 }
 
-export async function deleteSessionSearchMessages(sessionId, { dataDir } = {}) {
-  const db = await getDb(dataDir);
+/** Idempotent append of a transcript's searchable messages; returns the count
+ *  of newly stored rows. Re-sending an already stored message is a no-op. */
+export async function appendSessionSearchMessages(sessionId, messages, { dataDir, signal } = {}) {
+  const rows = sessionSearchRows(sessionId, messages);
+  if (rows.length === 0) return 0;
+  const db = await getDb(dataDir, { signal });
+  return insertRows(db, rows);
+}
+
+/** In one transaction: every stored row of `sessionId` whose content
+ *  `redactText` changes is deleted, the rows of the transcript as stored
+ *  (`redactedMessages`) are written, and a deleted row that is no message of
+ *  the transcript is written again with its content redacted.
+ *
+ *  A row is matched to its message by the row's own identity
+ *  (stableSessionSourceRef: role, original timestamp or else ordinal, tool
+ *  ids, content): the id `plainMessages` — the same transcript before
+ *  redaction — gives that message. Every other deleted row (its message was
+ *  compacted away, or is under an identity the transcript no longer has) has
+ *  no message to derive an identity from; its replacement gets a fresh random
+ *  id, so no two rows ever merge and no id is derived from the plaintext.
+ *  Returns the count of deleted rows.
+ *
+ *  FOR UPDATE locks only the rows that exist: a write of the same session still
+ *  in flight is not seen, so callers must not overlap it with this one
+ *  (session-search-ingest.mjs runs a session's writes one at a time). */
+export async function replaceSessionSearchMessages(
+  sessionId,
+  plainMessages,
+  redactedMessages,
+  redactText,
+  { dataDir, signal } = {}
+) {
+  const rows = sessionSearchRows(sessionId, redactedMessages);
+  const previous = new Set(sessionSearchRows(sessionId, plainMessages).map((row) => row.sourceRef));
+  const db = await getDb(dataDir, { signal });
+  return db.transaction(async (tx) => {
+    const { rows: stored } = await tx.query(
+      `SELECT source_ref, ordinal, role, ts, content FROM session_search.messages
+       WHERE session_id = $1 FOR UPDATE`,
+      [sessionId]
+    );
+    const changed = stored
+      .map((row) => ({ row, content: redactText(String(row.content)) }))
+      .filter(({ row, content }) => content !== row.content);
+    if (changed.length) {
+      await tx.query(`DELETE FROM session_search.messages WHERE source_ref = ANY($1::text[])`, [
+        changed.map(({ row }) => row.source_ref),
+      ]);
+    }
+    const kept = changed
+      .filter(({ row }) => !previous.has(row.source_ref))
+      .map(({ row, content }) => ({
+        sourceRef: `session:${sessionId}:${randomBytes(12).toString('hex')}`,
+        sessionId,
+        ordinal: Number(row.ordinal),
+        role: row.role,
+        ts: row.ts == null ? null : Number(row.ts),
+        content,
+      }));
+    await insertRows(tx, [...rows, ...kept]);
+    return changed.length;
+  });
+}
+
+export async function deleteSessionSearchMessages(sessionId, { dataDir, signal } = {}) {
+  const db = await getDb(dataDir, { signal });
   await db.query(`DELETE FROM session_search.messages WHERE session_id = $1`, [sessionId]);
   await db.query(`DELETE FROM session_search.backfill WHERE session_id = $1`, [sessionId]);
 }

package/src/runtime/session-search/session-search-ingest.mjs

@@ -2,19 +2,32 @@
  * Keeps the PG session-search copy (session-search-db.mjs) in step with the
  * session store: per-turn ingest, a once-per-run backfill of stored sessions,
  * and deletion. Everything is best-effort and never touches the memory runtime.
+ *
+ * A session's writes run one at a time, in the order they were issued
+ * (serialized). That order is what keeps a value marked sensitive out of the
+ * index: the replacement that redacts the stored rows
+ * (replaceSessionSearchMessages) locks only rows that already exist, so an
+ * earlier plaintext append still in flight would otherwise land after it and
+ * bring the value back. A write also redacts with the values known when it
+ * runs, not when it was issued.
  */
 import { readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { isAgentOnlySession } from '../agent/orchestrator/session/store-summary-visibility.mjs';
+import { redactSensitiveText, sensitiveValuesVersion } from '../agent/orchestrator/session/sensitive-values.mjs';
+import { redactSensitiveMessages } from '../agent/orchestrator/session/sensitive-projection.mjs';
 import {
   appendSessionSearchMessages,
   deleteSessionSearchMessages,
   readSessionSearchBackfillStamps,
   readSessionSearchSessionIds,
   recordSessionSearchBackfillStamp,
+  replaceSessionSearchMessages,
 } from './session-search-db.mjs';
 
-const lastIngestedLength = new Map();
+/** sessionId → { length, version }: the transcript length and the
+ *  sensitive-values version (sensitive-values.mjs) of the last stored ingest. */
+const lastIngested = new Map();
 const LAST_INGESTED_LIMIT = 500;
 
 function logFailure(what, error) {
@@ -23,6 +36,87 @@ function logFailure(what, error) {
   } catch {}
 }
 
+/** sessionId → { tail, controller }: the tail of the session's write queue
+ *  (see serialized) and the lifetime its writes run under (closeSessionSearch
+ *  aborts it). Present only while a write of the session is queued or running. */
+const writeQueues = new Map();
+
+/** The reason a closed session's writes stop with; never reported as a failure. */
+class SessionSearchClosedError extends Error {
+  constructor(sessionId) {
+    super(`session search writes of ${sessionId} closed`);
+    this.name = 'AbortError';
+  }
+}
+
+const reportUnlessClosed = (what) => (error) => {
+  if (!(error instanceof SessionSearchClosedError)) logFailure(what, error);
+};
+
+/** Runs `task(signal)` once every earlier task of `sessionId` has settled; the
+ *  task's own promise is returned, so its failure reaches the caller to report.
+ *  The queue moves on past a failed task: that failure is the caller's, not the
+ *  next write's. `signal` is the session's write lifetime. */
+function serialized(sessionId, task) {
+  const queue = writeQueues.get(sessionId);
+  const controller = queue && !queue.controller.signal.aborted ? queue.controller : new AbortController();
+  // A write cancelled while queued never starts (rejects with the close reason).
+  const run = (queue?.tail ?? Promise.resolve()).then(() => {
+    controller.signal.throwIfAborted();
+    return task(controller.signal);
+  });
+  const tail = run.then(
+    () => {},
+    () => {}
+  );
+  const entry = { tail, controller };
+  writeQueues.set(sessionId, entry);
+  tail.then(() => {
+    if (writeQueues.get(sessionId) === entry) writeQueues.delete(sessionId);
+  });
+  return run;
+}
+
+/**
+ * Stops the session's search writes for a runtime close: the queued ones never
+ * start and the running one is cancelled — a PostgreSQL runtime install or
+ * start it is waiting on included, once no other writer still waits on it
+ * (createSharedAbortable). Resolves when the queue has settled, so nothing this
+ * session issued writes into the data dir afterwards. The rows are derived:
+ * the stored-session backfill restores what a cancelled write left out.
+ */
+export async function closeSessionSearch(sessionId) {
+  const queue = writeQueues.get(sessionId);
+  if (!queue) return;
+  queue.controller.abort(new SessionSearchClosedError(sessionId));
+  await queue.tail;
+}
+
+/** Stores `messages`, the transcript as it was when the turn was ingested, as
+ *  the session's search rows; runs in the session's write queue. */
+async function storeTranscript(sessionId, messages, signal) {
+  // A turn always grows the transcript; an unchanged length means nothing
+  // new. This is only a shortcut: the insert itself is idempotent.
+  const length = messages.length;
+  const version = sensitiveValuesVersion(sessionId);
+  const last = lastIngested.get(sessionId);
+  if (last?.length === length && last.version === version) return;
+  // A value a sensitive fill marked is stored as a marker here too. While
+  // the session has values not yet applied to its stored rows (rows made
+  // before the mark, compacted ones included), the rows that hold one are
+  // replaced in one transaction instead of only appending.
+  const redacted = redactSensitiveMessages(sessionId, messages);
+  if (version && last?.version !== version) {
+    await replaceSessionSearchMessages(sessionId, messages, redacted, (text) => redactSensitiveText(sessionId, text), {
+      signal,
+    });
+  } else {
+    await appendSessionSearchMessages(sessionId, redacted, { signal });
+  }
+  if (lastIngested.size >= LAST_INGESTED_LIMIT) lastIngested.clear();
+  lastIngested.set(sessionId, { length, version });
+}
+
 /** Fire-and-forget: store a completed turn's transcript. Never throws. */
 export function ingestSessionTurn(session) {
   try {
@@ -30,30 +124,24 @@ export function ingestSessionTurn(session) {
     const messages = session?.messages;
     if (!sessionId || !Array.isArray(messages) || messages.length === 0) return;
     if (isAgentOnlySession(session)) return;
-    // A turn always grows the transcript; an unchanged length means nothing
-    // new. This is only a shortcut: the insert itself is idempotent.
-    const length = messages.length;
-    if (lastIngestedLength.get(sessionId) === length) return;
-    appendSessionSearchMessages(sessionId, messages).then(
-      () => {
-        if (lastIngestedLength.size >= LAST_INGESTED_LIMIT) lastIngestedLength.clear();
-        lastIngestedLength.set(sessionId, length);
-      },
-      (error) => logFailure(`ingest ${sessionId}`, error)
+    // The write runs after the session's earlier ones, so it keeps the
+    // transcript of this call: compaction may rewrite the live array before then.
+    const transcript = messages.slice();
+    serialized(sessionId, (signal) => storeTranscript(sessionId, transcript, signal)).catch(
+      reportUnlessClosed(`ingest ${sessionId}`)
     );
   } catch (error) {
     logFailure('ingest', error);
   }
 }
 
-/** Best-effort removal of a deleted session's search rows. Never throws. */
+/** Best-effort removal of a deleted session's search rows, after the
+ *  session's pending writes. Never throws. */
 export async function forgetSessionSearch(sessionId) {
-  lastIngestedLength.delete(sessionId);
-  try {
-    await deleteSessionSearchMessages(sessionId);
-  } catch (error) {
-    logFailure(`delete ${sessionId}`, error);
-  }
+  await serialized(sessionId, async (signal) => {
+    lastIngested.delete(sessionId);
+    await deleteSessionSearchMessages(sessionId, { signal });
+  }).catch(reportUnlessClosed(`delete ${sessionId}`));
 }
 
 async function loadStoreDeps() {
@@ -89,8 +177,10 @@ export async function backfillSessionSearch({ deps } = {}) {
       if (stamps.get(sessionId) === stamp) continue;
       const session = readSession(dir, file);
       if (session?.id && !isAgentOnlySession(session)) {
-        await appendSessionSearchMessages(session.id, session.messages);
-        await recordSessionSearchBackfillStamp(session.id, stamp);
+        await serialized(session.id, async () => {
+          await appendSessionSearchMessages(session.id, redactSensitiveMessages(session.id, session.messages));
+          await recordSessionSearchBackfillStamp(session.id, stamp);
+        });
         ingested += 1;
       }
     } catch (error) {

package/src/runtime/shared/abort-race.mjs

@@ -50,6 +50,95 @@ export async function runAbortable(signal, task, fallback) {
   });
 }
 
+/** Resolves after `ms`, or rejects with the abort reason once `signal` aborts. */
+export function sleepUnlessAborted(ms, signal) {
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(abortReason(signal));
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortReason(signal));
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
+/**
+ * One operation that several callers await. `start(signal)` runs once, when
+ * the first caller that still wants it joins — a live signal, or none — so a
+ * caller that is already aborted starts nothing. Its signal aborts only when
+ * every caller that joined with a signal has aborted and no caller joined
+ * without one (such a caller keeps it running). The caller whose abort cancels
+ * the work waits for the work to settle, its cleanup included, so nothing it
+ * started outlives it; any other aborted caller stops waiting at once and
+ * leaves the work to the callers still on it. `onSettled(failed)` runs once
+ * the started work settles; `promise` is that work, null until started.
+ */
+export function createSharedAbortable(start, { onSettled = null } = {}) {
+  const controller = new AbortController();
+  let waiting = 0;
+  let pinned = false;
+  let promise = null;
+  const begin = () => {
+    if (!promise) {
+      promise = Promise.resolve().then(() => start(controller.signal));
+      promise.then(
+        () => onSettled?.(false),
+        () => onSettled?.(true)
+      );
+    }
+    return promise;
+  };
+  return {
+    get promise() {
+      return promise;
+    },
+    join(signal) {
+      if (!signal) {
+        pinned = true;
+        return begin();
+      }
+      if (signal.aborted) return Promise.reject(abortReason(signal));
+      waiting += 1;
+      const work = begin();
+      return new Promise((resolve, reject) => {
+        const onAbort = () => {
+          waiting -= 1;
+          const reason = abortReason(signal);
+          if (waiting > 0 || pinned) {
+            reject(reason);
+            return;
+          }
+          controller.abort(reason);
+          work.then(
+            () => reject(reason),
+            () => reject(reason)
+          );
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        work.then(
+          (value) => {
+            if (signal.aborted) return;
+            signal.removeEventListener('abort', onAbort);
+            waiting -= 1;
+            resolve(value);
+          },
+          (error) => {
+            if (signal.aborted) return;
+            signal.removeEventListener('abort', onAbort);
+            waiting -= 1;
+            reject(error);
+          }
+        );
+      });
+    },
+  };
+}
+
 /**
  * Bound best-effort cleanup without cancelling the underlying work. The
  * detached promise remains observed and may still finish in the background.

package/src/runtime/shared/agent-avatar.d.mts

@@ -42,7 +42,6 @@ export const MASCOT_EXPRESSIONS: readonly string[];
 export const MASCOT_INKS: Readonly<Record<string, string>>;
 export const MIXY_AVATAR: Readonly<MascotAvatar>;
 export const AGENT_AVATAR_STATES: readonly AgentAvatarState[];
-export const AGENT_AVATAR_LATER_STATES: readonly string[];
 export const AGENT_AVATAR_IMAGE_FILE: RegExp;
 export const AGENT_AVATAR_STATE_FILE: RegExp;
 export const AGENT_AVATAR_DIR: string;

package/src/runtime/shared/agent-kind.mjs

@@ -45,8 +45,10 @@ const homeEvidenceCache = new Map();
 
 /** What `agentId`'s home thread (sessions/sess_home_<id>.json) holds:
  *  whether it exists, whether it has the creation greeting, and whether the
- *  user and the agent talked (any user message that is not a runtime turn,
- *  or any assistant message). A missing or unreadable file holds nothing. */
+ *  user talked in it: a message the user wrote (a user message that is not a
+ *  runtime turn or the greeting). The agent's own messages never count: Mixy's
+ *  heartbeat posts its reports there unasked. A missing or unreadable file
+ *  holds nothing. */
 export function homeThreadEvidence(dataDir, agentId) {
   const sessionId = agentHomeSessionId(agentId);
   if (!dataDir || !sessionId) return NO_HOME;
@@ -69,7 +71,6 @@ export function homeThreadEvidence(dataDir, agentId) {
   let greeted = false;
   let chatted = false;
   for (const message of messages) {
-    if (message?.role === 'assistant') chatted = true;
     if (message?.role !== 'user') continue;
     const text = messageText(message.content);
     if (CREATION_GREETING.test(text)) greeted = true;

package/src/runtime/shared/bounded-download.mjs

@@ -1,7 +1,7 @@
 import { createWriteStream, rmSync } from 'node:fs';
 import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { sleep } from './sleep.mjs';
+import { sleepUnlessAborted } from './abort-race.mjs';
 
 export const MAX_NATIVE_BINARY_DOWNLOAD_BYTES = 256 * 1024 * 1024;
 const DEFAULT_RETRY_DELAYS_MS = [1000, 3000, 9000];
@@ -118,13 +118,17 @@ export async function downloadToFileWithRetry(
     timeoutMs = 180_000,
     retryDelaysMs = DEFAULT_RETRY_DELAYS_MS,
     onRetry = null,
+    // Cancels the request, its body and any retry wait; rejects with its reason.
+    signal = null,
   } = {}
 ) {
   const { maximum, expected } = downloadBounds(maxBytes, expectedBytes, label);
   let lastError;
   for (let attempt = 0; attempt <= retryDelaysMs.length; attempt += 1) {
+    signal?.throwIfAborted();
     try {
-      const response = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
+      const timeout = AbortSignal.timeout(timeoutMs);
+      const response = await fetchFn(url, { signal: signal ? AbortSignal.any([signal, timeout]) : timeout });
       try {
         if (!response.ok) throw new DownloadHttpError(response.status, httpLabel, url);
         return await streamResponseToFile(response, destPath, {
@@ -142,12 +146,13 @@ export async function downloadToFileWithRetry(
         }
       }
     } catch (error) {
+      signal?.throwIfAborted();
       lastError = error;
       if (error instanceof DownloadHttpError && error.terminal) throw error;
       const delayMs = retryDelaysMs[attempt];
       if (delayMs === undefined) break;
       onRetry?.({ attempt: attempt + 1, delayMs, error });
-      await sleep(delayMs);
+      await sleepUnlessAborted(delayMs, signal);
     }
   }
   throw lastError;

package/src/runtime/shared/config.mjs

@@ -150,23 +150,12 @@ function readConfigRawCached() {
   return raw;
 }
 
-// Canonical on-disk channel shape. Provider-specific ids are durable. Schedule
-// arrays moved to the scheduler DB and prompt injection moved to runtime hooks,
-// so neither belongs in config anymore.
+// Canonical on-disk channel shape. Schedules live in the scheduler DB and
+// prompt injection moved to runtime hooks, so neither belongs in config.
 export function canonicalizeStoredChannelsConfig(value = {}) {
   const next = isPlainObject(value) ? { ...value } : {};
   delete next.promptInjection;
   delete next.schedules;
-  delete next.nonInteractive;
-  delete next.interactive;
-
-  // Messaging (Discord/Telegram) is retired: scrub the provider selector and
-  // per-provider routing sections from stored config.
-  delete next.backend;
-  delete next.provider;
-  delete next.discord;
-  delete next.telegram;
-  delete next.channel;
   return next;
 }
 

package/src/runtime/shared/connector-accounts.mjs

@@ -1,15 +1,25 @@
 // What a multi-account connector server tells the model about itself (MCP
-// `instructions`): the account it acts for, and to ask which one when the
-// user did not say and several are connected. The deferred-tool manifest
-// (context/deferred-tools.mjs) reads the leading "Account: <address>" back.
+// `instructions`), in one line: the connected accounts, and that each tool
+// takes `account` (asked of the user when several are connected and none was
+// named). An account that cannot be used right now is listed with why.
 
-/** The MCP instructions of a `service` server acting for `account` ('' when unknown). */
-export function accountInstructions(service, account) {
-  if (!account) return undefined;
-  return `Account: ${account}. This server acts only for this ${service} account; other ${service} accounts are separate servers. If several are connected and the user did not name one, ask which account before acting.`;
+/** The MCP instructions naming `accounts` (`{ email, note? }`, `note` a short
+ *  reason it is unusable such as "needs sign-in"; one without an address is
+ *  left out), or undefined when none has one. */
+export function connectorAccountsInstructions(accounts) {
+  const named = (Array.isArray(accounts) ? accounts : []).filter((account) => account?.email);
+  if (!named.length) return undefined;
+  const list = named.map(({ email, note }) => (note ? `${email} (${note})` : email)).join(', ');
+  return named.length === 1
+    ? `Accounts: ${list}. \`account\` may be left out.`
+    : `Accounts: ${list}. Pass \`account\`; if the user named none and there are several, ask which.`;
 }
 
-/** The account a server's instructions name, or ''. */
-export function accountOfInstructions(instructions) {
-  return /^Account: (\S+?)\. /.exec(String(instructions || ''))?.[1] || '';
+/** The account addresses instructions from connectorAccountsInstructions name. */
+export function accountsOfInstructions(instructions) {
+  const list = /^Accounts: (.+?)\. (?:`account`|Pass `account`)/.exec(String(instructions || ''))?.[1] || '';
+  return list
+    .split(', ')
+    .map((part) => part.replace(/ \(.*\)$/, '').trim())
+    .filter(Boolean);
 }

package/src/runtime/shared/connector-catalog.d.mts

@@ -51,3 +51,32 @@ export function gmailAddress(value: unknown): string;
 export function gmailAppPasswordValue(value: unknown): string;
 export function gmailAppPasswordAccount(cfg: unknown): string;
 export function gmailAppPasswordServerInput(name: string, email: string, password: string): Record<string, unknown>;
+
+/** One stored account of a multi-account connector server. */
+export interface ConnectorAccountEntry {
+  name: string;
+  url: string;
+  headers?: Record<string, string>;
+  oauthClientId?: string;
+  /** `false`: the account is kept but neither connected nor called. */
+  enabled?: boolean;
+}
+export function connectorAccountsUrl(id: string): string;
+export function connectorAccountsOf(cfg: unknown): ConnectorAccountEntry[];
+export function connectorAccountServer(
+  cfg: Record<string, unknown>,
+  account: ConnectorAccountEntry
+): Record<string, unknown>;
+export function connectorAccountServers(cfg: unknown): Record<string, unknown>[];
+export function connectorAccountEnabled(account: ConnectorAccountEntry): boolean;
+export function connectorLiveAccountServers(cfg: unknown): Record<string, unknown>[];
+export function withConnectorAccountEnabled(
+  cfg: Record<string, unknown>,
+  name: string,
+  enabled: boolean
+): Record<string, unknown>;
+export function connectorAccountEntry(name: string, cfg: Record<string, unknown>): ConnectorAccountEntry;
+export function mergeConnectorAccountServers(servers: Record<string, unknown>): {
+  servers: Record<string, unknown>;
+  merged: { connector: string; name: string; from: string[] }[];
+};