mixdog 1.3.5 → 1.4.0

package/src/session-runtime/boot/apis.mjs

@@ -107,8 +107,17 @@ export function wireApis(boot) {
     try {
       boot.resourceApi.migratePluginMcpCopies();
     } catch (error) {
+      console.warn(`[mcp] adopting plugin MCP copies failed: ${error?.message || error}`);
       bootProfile('plugin-mcp:adopt-failed', { error: error?.message || String(error) });
     }
+    // One server per multi-account connector: `gmail`, `gmail-2`… merge into
+    // `gmail` holding the accounts (their sign-ins and app passwords stay).
+    try {
+      boot.resourceApi.migrateConnectorAccounts();
+    } catch (error) {
+      console.warn(`[connectors] merging connector accounts failed: ${error?.message || error}`);
+      bootProfile('connector-accounts:merge-failed', { error: error?.message || String(error) });
+    }
   }
   boot.disposeGlobalExtensionSubscription = () => {
     boot.disposeConfigSync?.();

package/src/session-runtime/boot/infrastructure.mjs

@@ -20,6 +20,7 @@ import { listProjectsStrict } from '../../runtime/shared/projects.mjs';
 import { isWithin } from '../../runtime/shared/worktrees/paths.mjs';
 import { standaloneDataDir } from '../runtime-paths.mjs';
 import { SessionAddressError, isAdmissionOpen, ownerLifecycle } from '../session-address.mjs';
+import { syncSessionCompaction, usesInjectedConfig } from '../session-compaction-sync.mjs';
 import { dataDirOf } from './shared.mjs';
 
 export function wireInfrastructure(boot) {
@@ -187,6 +188,9 @@ export function sessionAdopter(boot) {
       }
     }
     rt.session = v;
+    // A resumed or swapped-in session keeps the compaction it was saved with
+    // unless it follows the current global settings (not on an injected config).
+    if (v?.id && !usesInjectedConfig(boot.params)) syncSessionCompaction(v, rt.config);
     // The PreToolUse/PostToolUse bridge is a non-enumerable property that
     // neither the store nor a resumed record carries: every session installed
     // here (create, resume, route swap, clear, the manager's copy) gets it, so

package/src/session-runtime/boot/providers.mjs

@@ -31,6 +31,7 @@ import {
 } from '../model-recency.mjs';
 import { createNativeWebSearch } from '../native-web-search.mjs';
 import { createConfigLifecycle } from '../config-lifecycle.mjs';
+import { usesInjectedConfig } from '../session-compaction-sync.mjs';
 import { createQuickModelRows } from '../quick-model-rows.mjs';
 import { createProviderModels } from '../provider-models.mjs';
 import { createProviderUsage } from '../provider-usage.mjs';
@@ -66,6 +67,8 @@ function wireConfigLifecycle(boot) {
       rt.configHasSecrets = next;
     },
     getRoute: () => rt.route,
+    getSession: () => rt.session,
+    fixedSessionCompaction: usesInjectedConfig(boot.params),
     setRouteState: (next) => {
       rt.route = next;
     },

package/src/session-runtime/boot/tools.mjs

@@ -9,6 +9,7 @@ import {
   channelNotificationSessionId,
 } from '../../runtime/shared/channel-notification-routing.mjs';
 import { CHANNEL_NOTIFICATION_METHOD } from '../services/channel-session-router.mjs';
+import { PROMPT_ORIGIN_CHANNEL } from '../../runtime/agent/orchestrator/session/manager/pending-message-entry.mjs';
 import { envFlag } from '../../runtime/shared/env.mjs';
 // Desktop-app bridges: tiny fs/fetch clients, so a static import adds no
 // meaningful boot cost. The tools themselves are gated per session by the
@@ -144,7 +145,9 @@ function wireChannels(boot) {
       const meta = p.meta && typeof p.meta === 'object' ? p.meta : {};
       const content = channelNotificationModelContent(p);
       if (!content) return;
-      notifySession(channelNotificationSessionId(rt.session, rt.reservedSessionId), content, meta);
+      notifySession(channelNotificationSessionId(rt.session, rt.reservedSessionId), content, meta, {
+        origin: PROMPT_ORIGIN_CHANNEL,
+      });
     },
   });
   bootProfile('channels:worker-ready', { ms: (performance.now() - channelsStartedAt).toFixed(1) });
@@ -234,6 +237,8 @@ function wireInternalTools(boot) {
     getCallerSession: (sessionId) =>
       sessionId === rt.session?.id ? rt.session : boot.mgr?.getSession?.(sessionId) || null,
     flushSettings: () => boot.flushAllConfigSavesAsync({ requireSaved: true }),
+    // Another session's route and quota actions (daemon-session-control.mjs); null without a daemon.
+    executeSessionControl: boot.params.executeSessionControl || null,
   });
   const disposeInternalTools = internalTools.setInternalToolsProvider({
     scopeId: rt.mcpScopeId,

package/src/session-runtime/config-lifecycle.mjs

@@ -17,6 +17,7 @@ import {
   stripStoredRouteDefaults,
   withDefaultPresets,
 } from '../runtime/agent/orchestrator/config-presets.mjs';
+import { syncSessionCompaction } from './session-compaction-sync.mjs';
 import { createConfigWriters } from './config-lifecycle/config-writers.mjs';
 import { createLeadRouteSync } from './config-lifecycle/lead-route-sync.mjs';
 import { createOutputStyleStatusCache } from './config-lifecycle/output-style-cache.mjs';
@@ -134,6 +135,10 @@ export function createConfigLifecycle({
   getConfigHasSecrets,
   setConfigHasSecrets,
   getRoute,
+  // The live session follows the reloaded global compaction settings, unless
+  // the runtime runs on an injected (headless) config.
+  getSession,
+  fixedSessionCompaction = false,
   // Main route sync on reload (both optional: a lifecycle without them never syncs)
   setRouteState,
   resolveRoute,
@@ -222,6 +227,7 @@ export function createConfigLifecycle({
     const adopted = adoptConfig(next, { hasSecrets: true });
     configSaveBaseline = structuredClone(adopted);
     leadRoute.syncEmptyMainRoute(adopted);
+    if (!fixedSessionCompaction) syncSessionCompaction(getSession?.(), adopted);
     return adopted;
   }
 

package/src/session-runtime/connector-merge-migration.mjs

@@ -0,0 +1,305 @@
+// After the multi-account connector merge (connector-catalog.mjs
+// mergeConnectorAccountServers) `gmail-2`, `google-calendar-2`… are accounts of
+// one server, no longer servers. Every store of ours that keys a setting by
+// MCP server name must name the surviving server instead:
+//   agents/<id>/agent.json, bots/<id>/agent.json   connectors.off / connectors.tools
+//                                                  (a legacy allow list too)
+//   <data>/project-connectors.json                 projects.<root>.off
+//   <data>/hooks.json, <data>/hooks/hooks.json     mcp_tool `server`, tool matchers
+// (extension scopes are the config's and are dropped by migrateConnectorAccounts;
+// an approval's "always allow" is the agent's connectors.tools; agent routes
+// name models, not servers.) Project and plugin hook files are the user's or
+// the plugin's own and are never rewritten here.
+//
+// Rule: the merged connector is OFF for an agent/project only when EVERY
+// merged server was off (the same rule as the merged server's `enabled`: one
+// working account keeps the connector usable). Per-tool permissions move to
+// the surviving name; where two merged servers disagree on a tool the MORE
+// PERMISSIVE permission wins, as "on beats off" does at server level. Entries
+// of a server that was off are dormant and are dropped when the connector
+// stays on, so they never become live. A setting that names no merged-away
+// server is never touched, which makes every run after the first a no-op.
+//
+// The merge is saved to the config once, so the rename mapping outlives it:
+// `<data>/connector-merge-pending.json` ({ merged: [{ name, from }] }) is
+// written before any store is touched and deleted only when every store
+// migrated. A store that fails (unreadable, malformed, not writable) is
+// reported and the others still go on; the next start retries them all.
+//
+// Hooks: only tool identifiers are rewritten — an `mcp_tool` handler's
+// `server`, and a matcher / tool-name field (or the tool part of an `if`
+// before its `(`) that is an `mcp__<server>__…` identifier or an
+// alternative of a pattern. Argument conditions such as `Bash(mcp__x__*)`
+// and any other data are never touched.
+import { readdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { normalizeRules, standardConfigReport } from './services/hook-bus/config.mjs';
+import {
+  PERMISSION_RANK,
+  PROJECT_CONNECTORS_FILE,
+  connectorEnabled,
+  parseConnectorPolicy,
+  storedConnectorPolicy,
+} from '../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
+import { parseJsonText, withFileLockSync, writeJsonAtomicSync } from '../runtime/shared/atomic-file.mjs';
+
+const unique = (list) => [...new Set(list)].sort();
+
+/** The policy `{ off, tools }` (or a legacy `{ allow, off, tools }`) with every
+ *  merged-away server of `merged` mapped onto its surviving one; null when it
+ *  names none. `merged` is mergeConnectorAccountServers' `merged`. */
+function mapMergedConnectorPolicy(policy, merged) {
+  let current = policy;
+  for (const { name, from } of merged) {
+    const gone = from.filter((server) => server !== name);
+    const named = (server) =>
+      current.off.includes(server) || current.allow?.includes(server) || Object.hasOwn(current.tools, server);
+    if (!gone.some(named)) continue;
+    const live = from.filter((server) => connectorEnabled(current, server));
+    const on = live.length > 0;
+    const off = current.off.filter((server) => !from.includes(server));
+    const allow = current.allow?.filter((server) => !from.includes(server));
+    if (allow && on) allow.push(name);
+    if (!allow && !on) off.push(name);
+    const tools = { ...current.tools };
+    for (const server of from) delete tools[server];
+    const moved = {};
+    for (const server of on ? live : from) {
+      for (const [tool, permission] of Object.entries(current.tools[server] || {})) {
+        if (!(tool in moved) || PERMISSION_RANK[permission] > PERMISSION_RANK[moved[tool]]) moved[tool] = permission;
+      }
+    }
+    if (Object.keys(moved).length) tools[name] = moved;
+    current = { ...(allow ? { allow: unique(allow) } : {}), off: unique(off), tools };
+  }
+  return current === policy ? null : current;
+}
+
+/** A mapped policy as the value the agent.json `connectors` field stores
+ *  (undefined: the field goes). */
+function storedValue(policy) {
+  if (!policy.allow) return storedConnectorPolicy(policy) ?? undefined;
+  const ids = unique([...policy.allow, ...Object.keys(policy.tools)]);
+  return ids.map((id) => ({
+    id,
+    enabled: policy.allow.includes(id),
+    ...(policy.tools[id] ? { tools: policy.tools[id] } : {}),
+  }));
+}
+
+export const PENDING_MERGE_FILE = 'connector-merge-pending.json';
+
+const warn = (file, error) => process.stderr.write(`[connectors] ${file} not migrated (${error?.message || error})\n`);
+
+/** The JSON at `file`; null when it does not exist. Any other failure throws. */
+function readJsonFile(file) {
+  try {
+    return parseJsonText(readFileSync(file, 'utf8'));
+  } catch (error) {
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null;
+    throw error;
+  }
+}
+
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+/** Runs `step` for one store; a failure is reported and returned, never thrown. */
+function attempt(file, step, outcome) {
+  try {
+    step();
+  } catch (error) {
+    warn(file, error);
+    outcome.failed.push(file);
+  }
+}
+
+function migrateAgentFiles(dataDir, merged, outcome, readdir) {
+  for (const store of ['agents', 'bots']) {
+    const dir = join(dataDir, store);
+    let entries;
+    try {
+      entries = readdir(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory());
+    } catch (error) {
+      // A store that does not exist has nothing to migrate; any other failure
+      // leaves its agents unprocessed, so the mapping must stay pending.
+      if (error?.code !== 'ENOENT') {
+        warn(dir, error);
+        outcome.failed.push(dir);
+      }
+      continue;
+    }
+    for (const entry of entries) {
+      const file = join(dataDir, store, entry.name, 'agent.json');
+      attempt(
+        file,
+        () => {
+          const manifest = readJsonFile(file);
+          if (!isRecord(manifest) || manifest.connectors == null) return;
+          const next = mapMergedConnectorPolicy(parseConnectorPolicy(manifest.connectors), merged);
+          if (!next) return;
+          const value = storedValue(next);
+          if (value) manifest.connectors = value;
+          else delete manifest.connectors;
+          writeJsonAtomicSync(file, manifest, { backup: true });
+          outcome.agents.push(`${store}/${entry.name}`);
+        },
+        outcome
+      );
+    }
+  }
+}
+
+function migrateProjectFile(dataDir, merged, outcome) {
+  const file = join(dataDir, PROJECT_CONNECTORS_FILE);
+  attempt(
+    file,
+    () => {
+      withFileLockSync(`${file}.lock`, () => {
+        const document = readJsonFile(file);
+        const projects = document?.projects;
+        if (!isRecord(projects)) return;
+        const changed = [];
+        for (const [root, entry] of Object.entries(projects)) {
+          if (!isRecord(entry) || !Array.isArray(entry.off)) continue;
+          const next = mapMergedConnectorPolicy({ off: entry.off.map(String), tools: {} }, merged);
+          if (!next) continue;
+          if (next.off.length) projects[root] = { ...entry, off: next.off };
+          else delete projects[root];
+          changed.push(root);
+        }
+        if (!changed.length) return;
+        writeJsonAtomicSync(file, document, { lock: false, backup: true });
+        outcome.projects.push(...changed);
+      });
+    },
+    outcome
+  );
+}
+
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/** A tool identifier or pattern (`mcp__a__x`, `^mcp__a__.*$`, `Bash|mcp__a__x`)
+ *  with each `mcp__<merged-away>` alternative renamed. */
+function renameToolPattern(value, renames) {
+  let next = value;
+  for (const [gone, name] of renames) {
+    const identifier = new RegExp(`(^|\\|)(\\^?)mcp__${escapeRegExp(gone)}(?=__|(?![A-Za-z0-9_-]))`, 'g');
+    next = next.replace(identifier, (_all, lead, anchor) => `${lead}${anchor}mcp__${name}`);
+  }
+  return next;
+}
+
+/** A condition `Tool(arguments)`: only the tool part is an identifier. */
+function renameCondition(value, renames) {
+  const open = value.indexOf('(');
+  return open < 0
+    ? renameToolPattern(value, renames)
+    : renameToolPattern(value.slice(0, open), renames) + value.slice(open);
+}
+
+/** Renames in the hook structures of `document` (in place); true when any changed. */
+function renameInHooks(document, renames) {
+  let changed = false;
+  const set = (owner, key, rename) => {
+    if (typeof owner[key] !== 'string') return;
+    const next = rename(owner[key], renames);
+    if (next === owner[key]) return;
+    owner[key] = next;
+    changed = true;
+  };
+  const handler = (hook) => {
+    if (!isRecord(hook)) return;
+    if (hook.type === 'mcp_tool') {
+      if (typeof hook.server === 'string' && renames.has(hook.server.trim())) {
+        hook.server = renames.get(hook.server.trim());
+        changed = true;
+      }
+      set(hook, 'tool', renameToolPattern);
+    }
+    set(hook, 'if', renameCondition);
+  };
+  if (standardConfigReport(document).standard) {
+    for (const groups of Object.values(document.hooks)) {
+      for (const group of Array.isArray(groups) ? groups : []) {
+        if (!isRecord(group)) continue;
+        set(group, 'matcher', renameToolPattern);
+        set(group, 'if', renameCondition);
+        for (const hook of Array.isArray(group.hooks) ? group.hooks : []) handler(hook);
+      }
+    }
+  } else {
+    for (const rule of normalizeRules(document)) {
+      if (!isRecord(rule)) continue;
+      set(rule, 'tool', renameToolPattern);
+      set(rule, 'name', renameToolPattern);
+      set(rule, 'if', renameCondition);
+    }
+  }
+  return changed;
+}
+
+function migrateHookFiles(dataDir, merged, outcome) {
+  const renames = new Map(
+    merged.flatMap(({ name, from }) => from.filter((server) => server !== name).map((gone) => [gone, name]))
+  );
+  for (const file of [join(dataDir, 'hooks.json'), join(dataDir, 'hooks', 'hooks.json')]) {
+    attempt(
+      file,
+      () => {
+        const document = readJsonFile(file);
+        if (!isRecord(document) && !Array.isArray(document)) return;
+        if (!renameInHooks(document, renames)) return;
+        writeJsonAtomicSync(file, document, { backup: true });
+        outcome.hooks.push(file);
+      },
+      outcome
+    );
+  }
+}
+
+const validGroup = (group) =>
+  isRecord(group) &&
+  typeof group.name === 'string' &&
+  Array.isArray(group.from) &&
+  group.from.every((n) => typeof n === 'string');
+
+/** Maps every per-server setting of `dataDir` onto the surviving servers of
+ *  `merged` (this start's merge, [] to only retry) plus any still pending from
+ *  an earlier start. Returns what it rewrote and the files that failed:
+ *  `{ agents, projects, hooks, failed, unrecorded? }`. The pending record is
+ *  removed only when `failed` is empty; `unrecorded` says it could not be
+ *  written, so the caller must not save the merge. `readdir` lists the agent
+ *  and bot directories. */
+export function migrateMergedConnectorServers(dataDir, merged, { readdir = readdirSync } = {}) {
+  const outcome = { agents: [], projects: [], hooks: [], failed: [] };
+  if (!dataDir) return outcome;
+  const pendingFile = join(dataDir, PENDING_MERGE_FILE);
+  let pending = [];
+  try {
+    const stored = readJsonFile(pendingFile)?.merged;
+    pending = Array.isArray(stored) ? stored.filter(validGroup).map(({ name, from }) => ({ name, from })) : [];
+  } catch (error) {
+    warn(pendingFile, error);
+  }
+  const groups = [...pending];
+  for (const { name, from } of merged) {
+    if (!groups.some((group) => group.name === name && JSON.stringify(group.from) === JSON.stringify(from))) {
+      groups.push({ name, from });
+    }
+  }
+  if (!groups.length) return outcome;
+  if (groups.length !== pending.length) {
+    try {
+      writeJsonAtomicSync(pendingFile, { merged: groups }, { backup: false });
+    } catch (error) {
+      warn(pendingFile, error);
+      // Nothing records the mapping: a failed store must keep the merge unsaved.
+      outcome.unrecorded = true;
+    }
+  }
+  migrateAgentFiles(dataDir, groups, outcome, readdir);
+  migrateProjectFile(dataDir, groups, outcome);
+  migrateHookFiles(dataDir, groups, outcome);
+  if (!outcome.failed.length) rmSync(pendingFile, { force: true });
+  return outcome;
+}

package/src/session-runtime/internal-tool-executor/ask-user-tool.mjs

@@ -8,29 +8,73 @@ import {
 } from '../../runtime/agent/orchestrator/runtime-core/ask-user-tool-defs.mjs';
 import { createCallerContextResolvers } from './caller-context.mjs';
 import { runAbortable } from '../../runtime/shared/abort-race.mjs';
-import { SECRET_REQUEST_TIMEOUT_MS } from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import {
+  HANDOFF_OUTCOMES as AGENT_OUTCOMES,
+  SECRET_REQUEST_TIMEOUT_MS,
+} from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
 import {
   agentIdForSession,
   recordHumanDecision,
   unattendedApprovalPort,
 } from '../../runtime/agent/orchestrator/session/human-gate/gate.mjs';
-import { browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
-import { computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+import { browserHandoffPage, browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
+import { computerSecretBind, computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+
+/** The settle reason of a takeover that expired (desktop takeover-gate.ts
+ *  TAKEOVER_EXPIRED_REASON). */
+const TAKEOVER_EXPIRED_REASON = 'expired';
+
+/**
+ * The agent's result of a secret request, from the card's answer and the
+ * desktop's fill: one of requests.mjs HANDOFF_OUTCOMES. `fill` runs only for a provided
+ * value and answers 'entered' / 'no_field' / 'page_changed' / 'blocked' /
+ * 'expired'.
+ */
+export async function secretOutcome(result, fill) {
+  if (result?.timedOut === true || result?.reason === TAKEOVER_EXPIRED_REASON) return 'expired';
+  if (result?.approved !== true || result.response !== 'provide-secret') return 'user_skipped';
+  const filled = await fill();
+  return AGENT_OUTCOMES.includes(filled) && filled !== 'user_skipped' ? filled : 'blocked';
+}
+
+/** A page address as the agent may see it: origin and path, no query or
+ *  fragment (a sign-in redirect can carry a code or token there). */
+function factUrl(value) {
+  try {
+    const url = new URL(String(value || ''));
+    return url.protocol === 'http:' || url.protocol === 'https:' ? `${url.origin}${url.pathname}` : '';
+  } catch {
+    return '';
+  }
+}
+
+/** The agent's result of a takeover: what the user did and where the page is
+ *  now, never "signed in" (the agent checks the page). */
+export function takeoverOutcome(result, pageUrl = '') {
+  if (result?.timedOut === true || result?.reason === TAKEOVER_EXPIRED_REASON) return 'expired';
+  if (result?.approved !== true) return 'user_skipped';
+  const url = factUrl(pageUrl);
+  const did = result.reason === 'saved_login' ? 'User chose a saved login; it was filled in' : 'User pressed Done';
+  return url ? `${did}; page now at ${url}` : did;
+}
 
 /**
- * A secret or takeover handoff. Secret: the card collects the value on the
- * desktop, which holds it for `requestId` and fills it into the target field
- * (isolated-world fill for the browser, one-shot typed input for computer
- * use); here only the verdict travels, and the result is exactly 'provided',
- * 'skipped' or 'timeout'. Takeover: the run waits until the user says done
- * (computer and browser actions stay blocked meanwhile, desktop
- * main/takeover-gate.ts); the result is 'done' or 'denied'.
+ * A secret or takeover handoff. Secret: at request time the desktop binds the
+ * request to its page ({pageId, origin}) or, for computer use, it is bound to
+ * {window_id, ref}; the card collects the value on the desktop, which holds it
+ * for `requestId` and fills only that page, only while its origin is
+ * unchanged. Here only the outcome travels (secretOutcome). Takeover: the run
+ * waits until the user says done (that session's actions stay blocked
+ * meanwhile, desktop main/takeover-gate.ts); the result is takeoverOutcome's.
  */
 export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId, signal, inputs = {} }) {
   const secretInput = {
     browser: inputs.browser || browserSecretInput,
     computer: inputs.computer || computerSecretInput,
   };
+  const page = inputs.page || browserHandoffPage;
+  const bindComputer = inputs.computerBind || computerSecretBind;
+  const identity = handoff.identity || {};
   const gate = {
     agentId: agentIdForSession(sessionId),
     kind: handoff.kind,
@@ -47,32 +91,84 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
     return UNATTENDED_TAKEOVER;
   }
   if (typeof hook !== 'function') {
-    // Nobody can take over here: blocked, never "proceed".
+    // Nobody can take over or type here: blocked, never "proceed".
     if (handoff.kind === 'takeover') return NO_TAKEOVER;
-    await recordHumanDecision(gate, { response: 'skipped' });
-    return 'skipped';
+    await recordHumanDecision(gate, { response: 'blocked' });
+    return 'blocked';
   }
   if (handoff.kind === 'secret') {
     const requestId = `secret_${randomUUID()}`;
+    // Bound now: the page (and its origin) the value may go to, and what its
+    // field is. A browser page that cannot be bound, or has no such field,
+    // never asks the user for a value it could not place.
+    let bound = {};
+    if (handoff.surface === 'browser') {
+      const facts = await page(
+        sessionId,
+        'secret_bind',
+        { request_id: requestId, ...(identity.tab ? { tab: identity.tab } : {}), field: handoff.field },
+        { signal }
+      );
+      let outcome = '';
+      if (!facts?.origin) outcome = 'blocked';
+      else if (!facts.form) outcome = 'no_field';
+      if (outcome) {
+        await recordHumanDecision(gate, { response: outcome });
+        return outcome;
+      }
+      bound = { origin: facts.origin, form: facts.form, ...(facts.length ? { length: facts.length } : {}) };
+    } else {
+      // Computer Use: bound to the exact window and field ref the agent named
+      // (from snapshot/find). Without both there is no field to confirm, and
+      // none is made up (never the focused field or the front window).
+      const outcome =
+        identity.windowId && identity.ref
+          ? await bindComputer(sessionId, requestId, { windowId: identity.windowId, ref: identity.ref, signal })
+          : 'no_field';
+      if (outcome !== 'bound') {
+        const refused = outcome === 'no_field' ? 'no_field' : 'blocked';
+        await recordHumanDecision(gate, { response: refused });
+        return refused;
+      }
+    }
     const result = await runAbortable(signal, () =>
       hook({
         name: 'ask_user',
         kind: 'secret',
-        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field },
+        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field, ...bound },
         reason: '',
         timeoutMs: SECRET_REQUEST_TIMEOUT_MS,
         sessionId,
         toolCallId,
       })
     );
-    let verdict = 'skipped';
-    if (result?.timedOut === true) verdict = 'timeout';
-    else if (result?.approved === true && result.response === 'provide-secret') {
-      verdict = await secretInput[handoff.surface](sessionId, requestId, { signal });
-    }
-    await recordHumanDecision(gate, { response: verdict, device: result?.device });
-    return verdict;
+    const computerTarget = {
+      ...(identity.ref ? { ref: identity.ref } : {}),
+      ...(identity.windowId ? { windowId: identity.windowId } : {}),
+    };
+    const outcome = await secretOutcome(result, () =>
+      secretInput[handoff.surface](sessionId, requestId, {
+        signal,
+        ...(handoff.surface === 'computer' ? computerTarget : {}),
+      })
+    );
+    await recordHumanDecision(gate, { response: outcome, device: result?.device });
+    return outcome;
   }
+  // A sign-in page's saved logins (masked) let the card fill one for the
+  // user: the desktop offers them only for a page on that origin, bound now
+  // under `fillId` so the fill reaches that page alone (host-agent.ts fillBoundLogin).
+  const fillId = handoff.login ? `secret_${randomUUID()}` : '';
+  const accounts = handoff.login
+    ? (
+        await page(
+          sessionId,
+          'login_accounts',
+          { url: handoff.login.url, request_id: fillId, ...(identity.tab ? { tab: identity.tab } : {}) },
+          { signal }
+        )
+      )?.accounts
+    : null;
   const result = await runAbortable(signal, () =>
     hook({
       name: 'ask_user',
@@ -81,9 +177,10 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
         surface: handoff.surface,
         instructions: handoff.instructions,
         target: handoff.target,
-        ...handoff.identity,
+        ...identity,
         // A login takeover: the desktop opens its sign-in window on this page.
         ...(handoff.login ? { purpose: 'login', url: handoff.login.url } : {}),
+        ...(Array.isArray(accounts) && accounts.length ? { accounts, fillId } : {}),
       },
       args: { surface: handoff.surface, instructions: handoff.instructions },
       reason: '',
@@ -92,8 +189,15 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
       toolCallId,
     })
   );
-  const answer = result?.approved === true ? 'done' : 'denied';
-  await recordHumanDecision(gate, { response: answer, device: result?.device });
+  const pageUrl =
+    result?.approved === true && handoff.surface === 'browser'
+      ? (await page(sessionId, 'page_url', identity.tab ? { tab: identity.tab } : {}, { signal }))?.url
+      : '';
+  const answer = takeoverOutcome(result, pageUrl);
+  await recordHumanDecision(gate, {
+    response: answer.startsWith('User ') ? 'done' : answer,
+    device: result?.device,
+  });
   return answer;
 }
 
@@ -125,7 +229,7 @@ const DISMISSED =
   'User closed the questions without answering. Proceed with your best judgment; ask again only if something new depends on it.';
 
 /** Wire answers -> array aligned with questions; invalid entries become null. */
-export function normalizeAskUserAnswers(answers, questions) {
+function normalizeAskUserAnswers(answers, questions) {
   const list = Array.isArray(answers) ? answers.slice(0, 4) : [];
   return questions.map((q, i) => {
     const entry = list[i];
@@ -143,7 +247,7 @@ export function normalizeAskUserAnswers(answers, questions) {
 
 // Strings are JSON-quoted so a quote inside one cannot end it early; typed
 // text stays apart from the picked labels (`"picked" + "typed" (typed)`).
-export function formatAskUserAnswers(questions, answers) {
+function formatAskUserAnswers(questions, answers) {
   const quote = (text) => JSON.stringify(text);
   const parts = questions.map((q, i) => {
     const a = answers[i];
@@ -157,14 +261,14 @@ export function formatAskUserAnswers(questions, answers) {
 
 /** A composer message sent instead of (or with) picking: kept when it is a
  *  non-empty string within the typed-answer limit, else dropped. */
-export function normalizeAskUserReply(reply) {
+function normalizeAskUserReply(reply) {
   if (typeof reply !== 'string' || reply.length > ASK_USER_MAX_TEXT) return '';
   return reply.trim();
 }
 
 // `User replied in chat: "<reply>". ` leads, then the usual picks sentence
 // when any question was answered, else just the closing sentence.
-export function formatAskUserResult(questions, answers, reply) {
+function formatAskUserResult(questions, answers, reply) {
   if (!reply) return formatAskUserAnswers(questions, answers);
   const lead = `User replied in chat: ${JSON.stringify(reply)}. `;
   if (answers.some(Boolean)) return `${lead}${formatAskUserAnswers(questions, answers)}`;

package/src/session-runtime/internal-tool-executor/bridge-tools.mjs

@@ -45,6 +45,8 @@ export function createBridgeToolHandlers({ rt }) {
       cwd: callerCwd,
       requestApproval: callerCtx?.toolApprovalHook,
       toolCallId: callerCtx?.toolCallId || null,
+      // The agent turn, as for the browser: it scopes a saved-login fill's protection.
+      turnId: callerCtx?.turnId || rt.session?.usageMetricsTurnId,
       signal: signalFor(callerCtx),
     });
   };