mixdog 1.3.5 → 1.4.1

package/src/runtime/session-search/session-search-ingest.mjs

@@ -2,19 +2,32 @@
  * Keeps the PG session-search copy (session-search-db.mjs) in step with the
  * session store: per-turn ingest, a once-per-run backfill of stored sessions,
  * and deletion. Everything is best-effort and never touches the memory runtime.
+ *
+ * A session's writes run one at a time, in the order they were issued
+ * (serialized). That order is what keeps a value marked sensitive out of the
+ * index: the replacement that redacts the stored rows
+ * (replaceSessionSearchMessages) locks only rows that already exist, so an
+ * earlier plaintext append still in flight would otherwise land after it and
+ * bring the value back. A write also redacts with the values known when it
+ * runs, not when it was issued.
  */
 import { readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { isAgentOnlySession } from '../agent/orchestrator/session/store-summary-visibility.mjs';
+import { redactSensitiveText, sensitiveValuesVersion } from '../agent/orchestrator/session/sensitive-values.mjs';
+import { redactSensitiveMessages } from '../agent/orchestrator/session/sensitive-projection.mjs';
 import {
   appendSessionSearchMessages,
   deleteSessionSearchMessages,
   readSessionSearchBackfillStamps,
   readSessionSearchSessionIds,
   recordSessionSearchBackfillStamp,
+  replaceSessionSearchMessages,
 } from './session-search-db.mjs';
 
-const lastIngestedLength = new Map();
+/** sessionId → { length, version }: the transcript length and the
+ *  sensitive-values version (sensitive-values.mjs) of the last stored ingest. */
+const lastIngested = new Map();
 const LAST_INGESTED_LIMIT = 500;
 
 function logFailure(what, error) {
@@ -23,6 +36,87 @@ function logFailure(what, error) {
   } catch {}
 }
 
+/** sessionId → { tail, controller }: the tail of the session's write queue
+ *  (see serialized) and the lifetime its writes run under (closeSessionSearch
+ *  aborts it). Present only while a write of the session is queued or running. */
+const writeQueues = new Map();
+
+/** The reason a closed session's writes stop with; never reported as a failure. */
+class SessionSearchClosedError extends Error {
+  constructor(sessionId) {
+    super(`session search writes of ${sessionId} closed`);
+    this.name = 'AbortError';
+  }
+}
+
+const reportUnlessClosed = (what) => (error) => {
+  if (!(error instanceof SessionSearchClosedError)) logFailure(what, error);
+};
+
+/** Runs `task(signal)` once every earlier task of `sessionId` has settled; the
+ *  task's own promise is returned, so its failure reaches the caller to report.
+ *  The queue moves on past a failed task: that failure is the caller's, not the
+ *  next write's. `signal` is the session's write lifetime. */
+function serialized(sessionId, task) {
+  const queue = writeQueues.get(sessionId);
+  const controller = queue && !queue.controller.signal.aborted ? queue.controller : new AbortController();
+  // A write cancelled while queued never starts (rejects with the close reason).
+  const run = (queue?.tail ?? Promise.resolve()).then(() => {
+    controller.signal.throwIfAborted();
+    return task(controller.signal);
+  });
+  const tail = run.then(
+    () => {},
+    () => {}
+  );
+  const entry = { tail, controller };
+  writeQueues.set(sessionId, entry);
+  tail.then(() => {
+    if (writeQueues.get(sessionId) === entry) writeQueues.delete(sessionId);
+  });
+  return run;
+}
+
+/**
+ * Stops the session's search writes for a runtime close: the queued ones never
+ * start and the running one is cancelled — a PostgreSQL runtime install or
+ * start it is waiting on included, once no other writer still waits on it
+ * (createSharedAbortable). Resolves when the queue has settled, so nothing this
+ * session issued writes into the data dir afterwards. The rows are derived:
+ * the stored-session backfill restores what a cancelled write left out.
+ */
+export async function closeSessionSearch(sessionId) {
+  const queue = writeQueues.get(sessionId);
+  if (!queue) return;
+  queue.controller.abort(new SessionSearchClosedError(sessionId));
+  await queue.tail;
+}
+
+/** Stores `messages`, the transcript as it was when the turn was ingested, as
+ *  the session's search rows; runs in the session's write queue. */
+async function storeTranscript(sessionId, messages, signal) {
+  // A turn always grows the transcript; an unchanged length means nothing
+  // new. This is only a shortcut: the insert itself is idempotent.
+  const length = messages.length;
+  const version = sensitiveValuesVersion(sessionId);
+  const last = lastIngested.get(sessionId);
+  if (last?.length === length && last.version === version) return;
+  // A value a sensitive fill marked is stored as a marker here too. While
+  // the session has values not yet applied to its stored rows (rows made
+  // before the mark, compacted ones included), the rows that hold one are
+  // replaced in one transaction instead of only appending.
+  const redacted = redactSensitiveMessages(sessionId, messages);
+  if (version && last?.version !== version) {
+    await replaceSessionSearchMessages(sessionId, messages, redacted, (text) => redactSensitiveText(sessionId, text), {
+      signal,
+    });
+  } else {
+    await appendSessionSearchMessages(sessionId, redacted, { signal });
+  }
+  if (lastIngested.size >= LAST_INGESTED_LIMIT) lastIngested.clear();
+  lastIngested.set(sessionId, { length, version });
+}
+
 /** Fire-and-forget: store a completed turn's transcript. Never throws. */
 export function ingestSessionTurn(session) {
   try {
@@ -30,30 +124,24 @@ export function ingestSessionTurn(session) {
     const messages = session?.messages;
     if (!sessionId || !Array.isArray(messages) || messages.length === 0) return;
     if (isAgentOnlySession(session)) return;
-    // A turn always grows the transcript; an unchanged length means nothing
-    // new. This is only a shortcut: the insert itself is idempotent.
-    const length = messages.length;
-    if (lastIngestedLength.get(sessionId) === length) return;
-    appendSessionSearchMessages(sessionId, messages).then(
-      () => {
-        if (lastIngestedLength.size >= LAST_INGESTED_LIMIT) lastIngestedLength.clear();
-        lastIngestedLength.set(sessionId, length);
-      },
-      (error) => logFailure(`ingest ${sessionId}`, error)
+    // The write runs after the session's earlier ones, so it keeps the
+    // transcript of this call: compaction may rewrite the live array before then.
+    const transcript = messages.slice();
+    serialized(sessionId, (signal) => storeTranscript(sessionId, transcript, signal)).catch(
+      reportUnlessClosed(`ingest ${sessionId}`)
     );
   } catch (error) {
     logFailure('ingest', error);
   }
 }
 
-/** Best-effort removal of a deleted session's search rows. Never throws. */
+/** Best-effort removal of a deleted session's search rows, after the
+ *  session's pending writes. Never throws. */
 export async function forgetSessionSearch(sessionId) {
-  lastIngestedLength.delete(sessionId);
-  try {
-    await deleteSessionSearchMessages(sessionId);
-  } catch (error) {
-    logFailure(`delete ${sessionId}`, error);
-  }
+  await serialized(sessionId, async (signal) => {
+    lastIngested.delete(sessionId);
+    await deleteSessionSearchMessages(sessionId, { signal });
+  }).catch(reportUnlessClosed(`delete ${sessionId}`));
 }
 
 async function loadStoreDeps() {
@@ -89,8 +177,10 @@ export async function backfillSessionSearch({ deps } = {}) {
       if (stamps.get(sessionId) === stamp) continue;
       const session = readSession(dir, file);
       if (session?.id && !isAgentOnlySession(session)) {
-        await appendSessionSearchMessages(session.id, session.messages);
-        await recordSessionSearchBackfillStamp(session.id, stamp);
+        await serialized(session.id, async () => {
+          await appendSessionSearchMessages(session.id, redactSensitiveMessages(session.id, session.messages));
+          await recordSessionSearchBackfillStamp(session.id, stamp);
+        });
         ingested += 1;
       }
     } catch (error) {

package/src/runtime/shared/abort-race.mjs

@@ -50,6 +50,95 @@ export async function runAbortable(signal, task, fallback) {
   });
 }
 
+/** Resolves after `ms`, or rejects with the abort reason once `signal` aborts. */
+export function sleepUnlessAborted(ms, signal) {
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(abortReason(signal));
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortReason(signal));
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
+/**
+ * One operation that several callers await. `start(signal)` runs once, when
+ * the first caller that still wants it joins — a live signal, or none — so a
+ * caller that is already aborted starts nothing. Its signal aborts only when
+ * every caller that joined with a signal has aborted and no caller joined
+ * without one (such a caller keeps it running). The caller whose abort cancels
+ * the work waits for the work to settle, its cleanup included, so nothing it
+ * started outlives it; any other aborted caller stops waiting at once and
+ * leaves the work to the callers still on it. `onSettled(failed)` runs once
+ * the started work settles; `promise` is that work, null until started.
+ */
+export function createSharedAbortable(start, { onSettled = null } = {}) {
+  const controller = new AbortController();
+  let waiting = 0;
+  let pinned = false;
+  let promise = null;
+  const begin = () => {
+    if (!promise) {
+      promise = Promise.resolve().then(() => start(controller.signal));
+      promise.then(
+        () => onSettled?.(false),
+        () => onSettled?.(true)
+      );
+    }
+    return promise;
+  };
+  return {
+    get promise() {
+      return promise;
+    },
+    join(signal) {
+      if (!signal) {
+        pinned = true;
+        return begin();
+      }
+      if (signal.aborted) return Promise.reject(abortReason(signal));
+      waiting += 1;
+      const work = begin();
+      return new Promise((resolve, reject) => {
+        const onAbort = () => {
+          waiting -= 1;
+          const reason = abortReason(signal);
+          if (waiting > 0 || pinned) {
+            reject(reason);
+            return;
+          }
+          controller.abort(reason);
+          work.then(
+            () => reject(reason),
+            () => reject(reason)
+          );
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        work.then(
+          (value) => {
+            if (signal.aborted) return;
+            signal.removeEventListener('abort', onAbort);
+            waiting -= 1;
+            resolve(value);
+          },
+          (error) => {
+            if (signal.aborted) return;
+            signal.removeEventListener('abort', onAbort);
+            waiting -= 1;
+            reject(error);
+          }
+        );
+      });
+    },
+  };
+}
+
 /**
  * Bound best-effort cleanup without cancelling the underlying work. The
  * detached promise remains observed and may still finish in the background.

package/src/runtime/shared/agent-avatar.d.mts

@@ -42,7 +42,6 @@ export const MASCOT_EXPRESSIONS: readonly string[];
 export const MASCOT_INKS: Readonly<Record<string, string>>;
 export const MIXY_AVATAR: Readonly<MascotAvatar>;
 export const AGENT_AVATAR_STATES: readonly AgentAvatarState[];
-export const AGENT_AVATAR_LATER_STATES: readonly string[];
 export const AGENT_AVATAR_IMAGE_FILE: RegExp;
 export const AGENT_AVATAR_STATE_FILE: RegExp;
 export const AGENT_AVATAR_DIR: string;

package/src/runtime/shared/agent-kind.mjs

@@ -45,8 +45,10 @@ const homeEvidenceCache = new Map();
 
 /** What `agentId`'s home thread (sessions/sess_home_<id>.json) holds:
  *  whether it exists, whether it has the creation greeting, and whether the
- *  user and the agent talked (any user message that is not a runtime turn,
- *  or any assistant message). A missing or unreadable file holds nothing. */
+ *  user talked in it: a message the user wrote (a user message that is not a
+ *  runtime turn or the greeting). The agent's own messages never count: Mixy's
+ *  heartbeat posts its reports there unasked. A missing or unreadable file
+ *  holds nothing. */
 export function homeThreadEvidence(dataDir, agentId) {
   const sessionId = agentHomeSessionId(agentId);
   if (!dataDir || !sessionId) return NO_HOME;
@@ -69,7 +71,6 @@ export function homeThreadEvidence(dataDir, agentId) {
   let greeted = false;
   let chatted = false;
   for (const message of messages) {
-    if (message?.role === 'assistant') chatted = true;
     if (message?.role !== 'user') continue;
     const text = messageText(message.content);
     if (CREATION_GREETING.test(text)) greeted = true;

package/src/runtime/shared/bot-owned-work.mjs

@@ -0,0 +1,56 @@
+// Bot-owned work: the live work in a session that a bot sent. A bot's accepted
+// `session` send or create (session-runtime/agent-task-sessions.mjs) is the
+// bot's work in that session from its acceptance until it settles or is
+// cancelled — whether or not it reports back (`notify: false`, a report watch
+// that could not be stored). A turn nobody sent (the user typed it in the
+// task session) is owned by no bot, so it never reads as a bot being busy.
+// Process-wide and dependency-free like delegated-approval-host.mjs. The
+// registry is only this process's cache: what keeps the work owned across a
+// restart is stored apart (a reporting send's watch, any other send's record
+// of its work, both in agent-home-delivery.mjs) and re-noted by
+// agent-task-sessions.mjs recover. A change of which bots own a session's work
+// is announced (session-activity-signal.mjs onSessionBotWorkChange), so the
+// session catalog, which stamps them on each row, re-lists.
+import { emitSessionBotWorkChange } from './session-activity-signal.mjs';
+
+const KEY = Symbol.for('mixdog.botOwnedWork.v1');
+
+/** Map run id → `{ sessionId, agentId }`. */
+function registry() {
+  globalThis[KEY] ??= new Map();
+  return globalThis[KEY];
+}
+
+/** How many owned works of `agentId` run in `sessionId`. */
+function worksOf(sessionId, agentId) {
+  let count = 0;
+  for (const work of registry().values()) if (work.sessionId === sessionId && work.agentId === agentId) count += 1;
+  return count;
+}
+
+/** Every session with owned work and the bots owning it (each once, in noting
+ *  order): Map session → agent ids. */
+export function botWorkBySession() {
+  const bySession = new Map();
+  for (const { sessionId, agentId } of registry().values()) {
+    const agents = bySession.get(sessionId) ?? [];
+    if (!agents.includes(agentId)) agents.push(agentId);
+    bySession.set(sessionId, agents);
+  }
+  return bySession;
+}
+
+/** Agent `agentId`'s submission `runId` to `sessionId` was accepted. */
+export function noteBotWork({ runId, sessionId, agentId }) {
+  if (!runId || !sessionId || !agentId || registry().has(String(runId))) return;
+  registry().set(String(runId), { sessionId: String(sessionId), agentId: String(agentId) });
+  if (worksOf(String(sessionId), String(agentId)) === 1) emitSessionBotWorkChange(sessionId);
+}
+
+/** Submission `runId` settled or was cancelled: its work is nobody's now. */
+export function endBotWork(runId) {
+  const work = registry().get(String(runId));
+  if (!work) return;
+  registry().delete(String(runId));
+  if (worksOf(work.sessionId, work.agentId) === 0) emitSessionBotWorkChange(work.sessionId);
+}

package/src/runtime/shared/bounded-download.mjs

@@ -1,7 +1,7 @@
 import { createWriteStream, rmSync } from 'node:fs';
 import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { sleep } from './sleep.mjs';
+import { sleepUnlessAborted } from './abort-race.mjs';
 
 export const MAX_NATIVE_BINARY_DOWNLOAD_BYTES = 256 * 1024 * 1024;
 const DEFAULT_RETRY_DELAYS_MS = [1000, 3000, 9000];
@@ -118,13 +118,17 @@ export async function downloadToFileWithRetry(
     timeoutMs = 180_000,
     retryDelaysMs = DEFAULT_RETRY_DELAYS_MS,
     onRetry = null,
+    // Cancels the request, its body and any retry wait; rejects with its reason.
+    signal = null,
   } = {}
 ) {
   const { maximum, expected } = downloadBounds(maxBytes, expectedBytes, label);
   let lastError;
   for (let attempt = 0; attempt <= retryDelaysMs.length; attempt += 1) {
+    signal?.throwIfAborted();
     try {
-      const response = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
+      const timeout = AbortSignal.timeout(timeoutMs);
+      const response = await fetchFn(url, { signal: signal ? AbortSignal.any([signal, timeout]) : timeout });
       try {
         if (!response.ok) throw new DownloadHttpError(response.status, httpLabel, url);
         return await streamResponseToFile(response, destPath, {
@@ -142,12 +146,13 @@ export async function downloadToFileWithRetry(
         }
       }
     } catch (error) {
+      signal?.throwIfAborted();
       lastError = error;
       if (error instanceof DownloadHttpError && error.terminal) throw error;
       const delayMs = retryDelaysMs[attempt];
       if (delayMs === undefined) break;
       onRetry?.({ attempt: attempt + 1, delayMs, error });
-      await sleep(delayMs);
+      await sleepUnlessAborted(delayMs, signal);
     }
   }
   throw lastError;

package/src/runtime/shared/config.mjs

@@ -150,23 +150,12 @@ function readConfigRawCached() {
   return raw;
 }
 
-// Canonical on-disk channel shape. Provider-specific ids are durable. Schedule
-// arrays moved to the scheduler DB and prompt injection moved to runtime hooks,
-// so neither belongs in config anymore.
+// Canonical on-disk channel shape. Schedules live in the scheduler DB and
+// prompt injection moved to runtime hooks, so neither belongs in config.
 export function canonicalizeStoredChannelsConfig(value = {}) {
   const next = isPlainObject(value) ? { ...value } : {};
   delete next.promptInjection;
   delete next.schedules;
-  delete next.nonInteractive;
-  delete next.interactive;
-
-  // Messaging (Discord/Telegram) is retired: scrub the provider selector and
-  // per-provider routing sections from stored config.
-  delete next.backend;
-  delete next.provider;
-  delete next.discord;
-  delete next.telegram;
-  delete next.channel;
   return next;
 }
 

package/src/runtime/shared/connector-accounts.mjs

@@ -1,15 +1,25 @@
 // What a multi-account connector server tells the model about itself (MCP
-// `instructions`): the account it acts for, and to ask which one when the
-// user did not say and several are connected. The deferred-tool manifest
-// (context/deferred-tools.mjs) reads the leading "Account: <address>" back.
+// `instructions`), in one line: the connected accounts, and that each tool
+// takes `account` (asked of the user when several are connected and none was
+// named). An account that cannot be used right now is listed with why.
 
-/** The MCP instructions of a `service` server acting for `account` ('' when unknown). */
-export function accountInstructions(service, account) {
-  if (!account) return undefined;
-  return `Account: ${account}. This server acts only for this ${service} account; other ${service} accounts are separate servers. If several are connected and the user did not name one, ask which account before acting.`;
+/** The MCP instructions naming `accounts` (`{ email, note? }`, `note` a short
+ *  reason it is unusable such as "needs sign-in"; one without an address is
+ *  left out), or undefined when none has one. */
+export function connectorAccountsInstructions(accounts) {
+  const named = (Array.isArray(accounts) ? accounts : []).filter((account) => account?.email);
+  if (!named.length) return undefined;
+  const list = named.map(({ email, note }) => (note ? `${email} (${note})` : email)).join(', ');
+  return named.length === 1
+    ? `Accounts: ${list}. \`account\` may be left out.`
+    : `Accounts: ${list}. Pass \`account\`; if the user named none and there are several, ask which.`;
 }
 
-/** The account a server's instructions name, or ''. */
-export function accountOfInstructions(instructions) {
-  return /^Account: (\S+?)\. /.exec(String(instructions || ''))?.[1] || '';
+/** The account addresses instructions from connectorAccountsInstructions name. */
+export function accountsOfInstructions(instructions) {
+  const list = /^Accounts: (.+?)\. (?:`account`|Pass `account`)/.exec(String(instructions || ''))?.[1] || '';
+  return list
+    .split(', ')
+    .map((part) => part.replace(/ \(.*\)$/, '').trim())
+    .filter(Boolean);
 }

package/src/runtime/shared/connector-catalog.d.mts

@@ -51,3 +51,32 @@ export function gmailAddress(value: unknown): string;
 export function gmailAppPasswordValue(value: unknown): string;
 export function gmailAppPasswordAccount(cfg: unknown): string;
 export function gmailAppPasswordServerInput(name: string, email: string, password: string): Record<string, unknown>;
+
+/** One stored account of a multi-account connector server. */
+export interface ConnectorAccountEntry {
+  name: string;
+  url: string;
+  headers?: Record<string, string>;
+  oauthClientId?: string;
+  /** `false`: the account is kept but neither connected nor called. */
+  enabled?: boolean;
+}
+export function connectorAccountsUrl(id: string): string;
+export function connectorAccountsOf(cfg: unknown): ConnectorAccountEntry[];
+export function connectorAccountServer(
+  cfg: Record<string, unknown>,
+  account: ConnectorAccountEntry
+): Record<string, unknown>;
+export function connectorAccountServers(cfg: unknown): Record<string, unknown>[];
+export function connectorAccountEnabled(account: ConnectorAccountEntry): boolean;
+export function connectorLiveAccountServers(cfg: unknown): Record<string, unknown>[];
+export function withConnectorAccountEnabled(
+  cfg: Record<string, unknown>,
+  name: string,
+  enabled: boolean
+): Record<string, unknown>;
+export function connectorAccountEntry(name: string, cfg: Record<string, unknown>): ConnectorAccountEntry;
+export function mergeConnectorAccountServers(servers: Record<string, unknown>): {
+  servers: Record<string, unknown>;
+  merged: { connector: string; name: string; from: string[] }[];
+};

package/src/runtime/shared/connector-catalog.mjs

@@ -190,6 +190,156 @@ export function connectorMultiAccount(entry) {
   return entry?.backend?.kind === 'oauth' && entry.backend.oauthClient === 'google';
 }
 
+// ── One server per multi-account connector ──────────────────────────────────
+// A multi-account connector is ONE MCP server (`gmail`, `google-calendar`,
+// `google-drive`) holding its accounts:
+//   { type: 'http', url: connectorAccountsUrl(id), connector: id,
+//     accounts: [{ name, url, headers?, oauthClientId? }, …] }
+// Each account keeps the transport it had as a server of its own (the Google
+// sign-in URL its tokens are stored under, or the app-password address and
+// account header), so its keychain entries are untouched. Account names share
+// the server-name space (`gmail`, `gmail-2`…): a name-based call (remove, sign
+// in, sign out) that names an account acts on that account. The server is
+// answered in-process (connectors/connector-accounts-mcp.mjs): one tool set
+// with an `account` argument.
+const ACCOUNT_FIELDS = ['url', 'headers', 'oauthClientId'];
+
+/** The reserved (never resolvable) address of connector `id`'s accounts server. */
+export function connectorAccountsUrl(id) {
+  return `https://connectors.mixdog.invalid/${encodeURIComponent(id)}/mcp`;
+}
+
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+/** The stored accounts of a multi-account connector server, [] for any other
+ *  config (a legacy one-account server included). */
+export function connectorAccountsOf(cfg) {
+  if (!isRecord(cfg) || !Array.isArray(cfg.accounts)) return [];
+  if (!connectorMultiAccount(connectorById(connectorOfServer(cfg)))) return [];
+  return cfg.accounts.filter(
+    (account) =>
+      isRecord(account) && typeof account.name === 'string' && account.name && typeof account.url === 'string'
+  );
+}
+
+/** The one-account server config of `account` of server `cfg` (the shape the
+ *  account had as a server of its own), named by the account. */
+export function connectorAccountServer(cfg, account) {
+  const out = { name: account.name, type: 'http' };
+  for (const field of ACCOUNT_FIELDS) if (account[field] !== undefined) out[field] = account[field];
+  out.connector = cfg.connector;
+  return out;
+}
+
+/** Every account of `cfg` as its one-account server config. */
+export function connectorAccountServers(cfg) {
+  return connectorAccountsOf(cfg).map((account) => connectorAccountServer(cfg, account));
+}
+
+/** Whether stored account `account` is switched on (`enabled: false` is off). */
+export const connectorAccountEnabled = (account) => account.enabled !== false;
+
+/** The switched-on accounts of `cfg` as their one-account server configs: the
+ *  ones the server connects and routes calls to. */
+export function connectorLiveAccountServers(cfg) {
+  return connectorAccountsOf(cfg)
+    .filter(connectorAccountEnabled)
+    .map((account) => connectorAccountServer(cfg, account));
+}
+
+/**
+ * Server `cfg` with its account `name` switched on or off. Off flags the
+ * account (`enabled: false`) and switches the server off with its last
+ * switched-on account. On drops the flag (a switched-on account carries none)
+ * and switches the server on. Every other entry stays as stored.
+ */
+export function withConnectorAccountEnabled(cfg, name, enabled) {
+  const accounts = cfg.accounts.map((account) => {
+    if (!isRecord(account) || account.name !== name) return account;
+    const { enabled: _enabled, ...rest } = account;
+    return enabled ? rest : { ...rest, enabled: false };
+  });
+  const next = { ...cfg, accounts };
+  if (enabled) return { ...next, enabled: true };
+  return connectorAccountsOf(next).some(connectorAccountEnabled) ? next : { ...next, enabled: false };
+}
+
+/** The stored account entry of one-account config `cfg` under `name`. */
+export function connectorAccountEntry(name, cfg) {
+  const out = { name };
+  for (const field of ACCOUNT_FIELDS) if (cfg?.[field] !== undefined) out[field] = cfg[field];
+  return out;
+}
+
+const naturalOrder = (a, b) => a.localeCompare(b, 'en', { numeric: true });
+
+/**
+ * Merges every multi-account connector's servers into one server holding the
+ * accounts: legacy one-account servers (`gmail`, `gmail-2`…, Calendar and
+ * Drive alike) and any second accounts server. The server keeps the name of
+ * an existing accounts server, else the connector id when a server has it,
+ * else the first name; its other fields come from that server. Accounts keep
+ * their names, transports and order (that server's first); a second entry
+ * for the same name or app-password address is dropped. The merged server is
+ * off only when every merged one was; otherwise the accounts of a merged
+ * server that was off stay off (`enabled: false` on the account), and an
+ * account's own `enabled: false` is kept. A server left with no switched-on
+ * account is off. Idempotent: `merged` is empty when
+ * nothing changed. Returns `{ servers, merged: [{ connector, name, from }] }`.
+ */
+export function mergeConnectorAccountServers(input) {
+  const servers = isRecord(input) ? { ...input } : {};
+  const merged = [];
+  for (const entry of CONNECTOR_CATALOG.filter(connectorMultiAccount)) {
+    const names = Object.keys(servers)
+      .filter((name) => isRecord(servers[name]) && connectorOfServer(servers[name]) === entry.id)
+      .sort(naturalOrder);
+    if (!names.length) continue;
+    const grouped = names.filter((name) => Array.isArray(servers[name].accounts));
+    if (names.length === 1 && grouped.length === 1) continue;
+    const target = grouped[0] ?? (names.includes(entry.id) ? entry.id : names[0]);
+    const order = [target, ...names.filter((name) => name !== target)];
+    const off = order.every((name) => input[name].enabled === false);
+    const accounts = [];
+    const seenNames = new Set();
+    const seenAddresses = new Set();
+    for (const name of order) {
+      const cfg = servers[name];
+      const own = Array.isArray(cfg.accounts) ? connectorAccountsOf(cfg) : [connectorAccountEntry(name, cfg)];
+      // A merged server that was off keeps its accounts off, unless the whole
+      // connector is off (then re-enabling it brings every account back).
+      const serverOff = !off && cfg.enabled === false;
+      for (const account of own) {
+        const address = gmailAppPasswordAccount(connectorAccountServer(cfg, account));
+        if (seenNames.has(account.name) || (address && seenAddresses.has(address))) continue;
+        seenNames.add(account.name);
+        if (address) seenAddresses.add(address);
+        accounts.push(serverOff ? { ...account, enabled: false } : account);
+      }
+    }
+    const {
+      type: _type,
+      url: _url,
+      headers: _headers,
+      oauthClientId: _client,
+      accounts: _accounts,
+      enabled: _enabled,
+      ...rest
+    } = servers[target];
+    for (const name of order) delete servers[name];
+    servers[target] = {
+      ...rest,
+      type: 'http',
+      url: connectorAccountsUrl(entry.id),
+      connector: entry.id,
+      accounts,
+      ...(off || (accounts.length > 0 && !accounts.some(connectorAccountEnabled)) ? { enabled: false } : {}),
+    };
+    merged.push({ connector: entry.id, name: target, from: order });
+  }
+  return { servers, merged };
+}
+
 /** Whether a new connection of `entry` goes by app password only (Gmail). */
 export function connectorAppPasswordOnly(entry) {
   return entry?.appPasswordOnly === true;