mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/context/skill-catalog.mjs

@@ -304,6 +304,31 @@ export function skillOutsideScopeError(name) {
   return `Error: skill "${name}" is not available in this project (its project scope excludes the current folder)`;
 }
 
+/** Why the Skill tool refuses `name` at `cwd` now (missing feature, switched
+ *  off, outside the project scope), or null when nothing refuses it. `config`
+ *  and `skills` let a batch of checks share one config read and one scan. */
+export function skillLoadRefusal(name, cwd, config = null, skills = null) {
+  const missing = skillMissingFeature(name, config, skills);
+  if (missing) {
+    return `Error: skill "${name}" needs the ${missing} built-in feature, which is not installed or is switched off in Extensions → Plugin → Built-in`;
+  }
+  if (isSkillDisabled(name, config, skills)) return `Error: skill "${name}" is disabled`;
+  if (skillOutsideScope(name, cwd, config, skills)) return skillOutsideScopeError(name);
+  return null;
+}
+
+/**
+ * What the Skill tool would deliver for `name` at `cwd` now: the injected
+ * `<skill>` body and the resource it came from, or null when the skill no
+ * longer loads there (refused by skillLoadRefusal, or removed).
+ */
+export function currentSkillDelivery(name, cwd, config = null, skills = null) {
+  if (skillLoadRefusal(name, cwd, config, skills)) return null;
+  const resource = loadSkillResource(name, cwd);
+  if (!resource) return null;
+  return { body: buildSkillResultEnvelope(name, resource.content, resource.dir), resource };
+}
+
 /**
  * Skills a session may see: not switched off, feature available, and — when
  * `cwd` is given — inside the skill's (or its plugin's) project scope. Without
@@ -348,11 +373,16 @@ const _skillsCache = new Map();
 // every plain-file gate path are stat'ed on every call as before.
 const _ROOT_WATCH_LIMIT = 64;
 const _rootWatches = new Map(); // root -> { watcher, dirty, text, settled }
+// Bumped by every closed root watch; part of each cached SKILL.md text stamp.
+let _skillTextGeneration = 0;
 
 function _closeRootWatch(root) {
   const watch = _rootWatches.get(root);
   if (!watch) return;
   _rootWatches.delete(root);
+  // Any change under a skill root (or a lost watcher, or an invalidation)
+  // makes the next load re-read SKILL.md text, whatever the file stamps say.
+  _skillTextGeneration += 1;
   try {
     watch.watcher.close();
   } catch {
@@ -452,6 +482,26 @@ export function skillExecutionDir(dir, source) {
   return String(dir).replace(/([\\/])runtime\.asar(?=[\\/]|$)/, '$1runtime.asar.unpacked');
 }
 
+// SKILL.md text per catalog entry, with the stamp it was read at: the
+// file's own mtime and size (any depth) plus the skills watcher generation
+// (an edit that keeps both, e.g. inside one timestamp tick).
+const _skillFileText = new WeakMap();
+
+function skillFileText(skill) {
+  let stamp;
+  try {
+    const stat = statSync(skill.filePath);
+    stamp = `${_skillTextGeneration}:${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return null;
+  }
+  const cached = _skillFileText.get(skill);
+  if (cached?.stamp === stamp) return cached.text;
+  const text = readSafe(skill.filePath);
+  _skillFileText.set(skill, { stamp, text });
+  return text;
+}
+
 /**
  * Load full skill content plus its on-disk directory (for base-dir + ${MIXDOG_SKILL_DIR};
  * ${MIXDOG_SKILL_NODE} is resolved at render time in buildSkillResultEnvelope).
@@ -462,7 +512,10 @@ export function loadSkillResource(name, cwd) {
   const skills = collectSkillsCached(cwd);
   const skill = skills.find((s) => s.name === skillName);
   if (!skill) return null;
-  const content = readSafe(skill.filePath);
+  // The catalog's freshness signature does not see every nested SKILL.md, so
+  // the text follows the file itself: one stat per load, re-read only when
+  // that file's own mtime or size moved.
+  const content = skillFileText(skill);
   if (content == null) return null;
   try {
     return {
@@ -616,7 +669,9 @@ export function buildSkillManifest(skills, { limit = 80, charBudget = SKILL_MANI
   for (const skill of visible) skill.trigger = compactPromptManifestText(skill.trigger, triggerCap);
   const lines = [
     '# available-skills',
-    'Selection triggers and linked tools for Skill({"name":"<skill-name>"}). mcp:<server> denotes that server’s tools.',
+    visible.some((skill) => skill.linkedTools.some((tool) => tool.startsWith('mcp:')))
+      ? 'Selection triggers and linked tools. mcp:<server> denotes that server’s tools.'
+      : 'Selection triggers and linked tools.',
     '<available_skills>',
     ...visible.map(
       (skill) => (skill.trigger ? `- ${skill.name}: ${skill.trigger}` : `- ${skill.name}`) + toolSuffix(skill)

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -203,7 +203,7 @@ export function readProjectConnectorsFile(path) {
   });
 }
 
-export function projectConnectorPolicies(dataDir = resolvePluginData()) {
+function projectConnectorPolicies(dataDir = resolvePluginData()) {
   return cachedRead(join(dataDir, PROJECT_CONNECTORS_FILE), readProjectConnectorsFile);
 }
 
@@ -219,7 +219,7 @@ export function connectorToolPermission(policy, toolOrName) {
   return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
-const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+export const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
 export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
 
 /** Whether replacing the stored policy `before` (a stored value, a parsed
@@ -229,7 +229,7 @@ export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do wit
  *  default, which is `needs_approval` for a catalog connector's high-risk
  *  tools and `auto` otherwise). A legacy allow list or an unreadable policy is
  *  not compared: it counts as widening. */
-export function connectorPolicyWidens(before, after) {
+function connectorPolicyWidens(before, after) {
   let old;
   try {
     old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);

package/src/runtime/agent/orchestrator/mcp/client-transport.mjs

@@ -8,6 +8,13 @@ import { createMcpOAuth } from './oauth.mjs';
 import { mcpOAuthClientFor, mcpOAuthDisplayName } from './oauth-client.mjs';
 import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
 import { gmailAppPasswordService, withGmailAppPasswordMcp } from '../../../connectors/gmail-app-password.mjs';
+import { connectorAccountRequest, withConnectorAccountsMcp } from '../../../connectors/connector-accounts-mcp.mjs';
+import {
+  connectorAccountsOf,
+  connectorLiveAccountServers,
+  gmailAppPasswordAccount,
+} from '../../../shared/connector-catalog.mjs';
+import { isMcpOAuthReauthenticationRequired } from './oauth.mjs';
 import {
   AUTO_DETECT_PORTS,
   expandEnvVars,
@@ -63,10 +70,65 @@ export function hasConfiguredMcpAuth(cfg) {
   return (
     Boolean(String(cfg.bearer_token_env_var || '').trim()) ||
     configured(cfg.headers) ||
-    configured(cfg.env_http_headers)
+    configured(cfg.env_http_headers) ||
+    // A multi-account connector's server: each account authenticates itself.
+    connectorAccountsOf(cfg).length > 0
   );
 }
 
+/** One account of a multi-account connector server (connector-catalog.mjs
+ *  connectorAccountServer) as connector-accounts-mcp.mjs calls it: through
+ *  the transport the account had as a server of its own — its app-password
+ *  header, or its own non-interactive OAuth sign-in (refreshed as needed; a
+ *  new sign-in goes through 계정 바꾸기, never through a tool call). */
+function connectorAccountClient(serverName, accountCfg, oauthOptions) {
+  const base = { name: accountCfg.name, email: '', appPassword: false, close() {} };
+  let url;
+  try {
+    url = resolveMcpOAuthUrl(accountCfg);
+    if (hasConfiguredMcpAuth(accountCfg)) {
+      const email = gmailAppPasswordAccount(accountCfg);
+      const fetchImpl = gmailAppPasswordService(url) ? withGmailAppPasswordMcp() : fetch;
+      return {
+        ...base,
+        email,
+        appPassword: Boolean(email),
+        request: connectorAccountRequest(url, fetchImpl, resolveMcpHttpHeaders(accountCfg)),
+      };
+    }
+    const oauth = createMcpOAuth({
+      url,
+      serverName: mcpOAuthDisplayName(accountCfg, serverName),
+      oauthClient: mcpOAuthClientFor(accountCfg, url),
+      ...(oauthOptions?.fetchImpl ? { fetchImpl: oauthOptions.fetchImpl } : {}),
+      ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
+    });
+    const send = connectorAccountRequest(url, (input, init) => oauth.fetch(input, init));
+    return {
+      ...base,
+      async request(message, options) {
+        try {
+          return await send(message, options);
+        } catch (error) {
+          const reason = scrubMcpConnectionMessage(error?.message || String(error), accountCfg);
+          const scrubbed = new Error(
+            isMcpOAuthReauthenticationRequired(error)
+              ? 'Sign-in required; sign this account in again in Connectors.'
+              : reason
+          );
+          if (isMcpOAuthReauthenticationRequired(error)) scrubbed.authRequired = true;
+          throw scrubbed;
+        }
+      },
+      close: () => oauth.close(),
+    };
+  } catch (error) {
+    // A broken account (no sign-in client, an invalid address) stays listed with why.
+    const failed = new Error(error?.message || String(error));
+    return { ...base, request: async () => Promise.reject(failed) };
+  }
+}
+
 // The SDK's WebSocket transport opens its socket without a way to set request
 // headers. This subclass changes only socket creation: Node's WebSocket takes
 // `{ protocols, headers }`; the guard and event wiring match the stock start().
@@ -101,24 +163,115 @@ function createHeaderWebSocketTransport(Base, messageSchema, url, headers) {
     }
   })(url);
 }
+// Unset variables a config references: a failure under `strictEnv`,
+// otherwise warnings (names only), each logged.
+function missingEnvWarnings(name, cfg, strictEnv, log) {
+  const warnings = [];
+  const missing = findMissingMcpEnvVars(cfg);
+  if (missing.length) {
+    const message = `missing environment variable(s): ${missing.join(', ')}`;
+    if (strictEnv === true) throw new Error(message);
+    warnings.push(message);
+    log(`[mcp-client] "${name}": ${message}\n`);
+  }
+  return warnings;
+}
+
+// A multi-account connector: one server, every account behind it; closing the
+// transport closes every account client.
+function connectorAccountsTransport({ name, cfg, Transport, url, accountServers, oauthOptions, log }) {
+  const accounts = accountServers.map((accountCfg) => connectorAccountClient(name, accountCfg, oauthOptions));
+  const transport = new Transport(new URL(url), {
+    fetch: withConnectorAccountsMcp({ connector: cfg.connector, accounts }),
+  });
+  const close = transport.close.bind(transport);
+  transport.close = async () => {
+    for (const account of accounts) account.close();
+    await close();
+  };
+  log(`[mcp-client] Connecting "${name}" with ${accounts.length} account(s)\n`);
+  return transport;
+}
+
+// A streamable HTTP or SSE server: its configured authentication, or else an
+// OAuth sign-in the transport owns (and closes with it).
+function remoteHttpTransport({ name, cfg, kind, Transport, url, oauthOptions, log }) {
+  const opts = requestInitFor(cfg);
+  // Explicit authentication remains authoritative (including custom API-key
+  // headers). Never forward those credentials to OAuth discovery endpoints.
+  let transport;
+  let oauth = null;
+  if (!hasConfiguredMcpAuth(cfg)) {
+    oauth = createMcpOAuth({
+      url,
+      serverName: mcpOAuthDisplayName(cfg, name),
+      oauthClient: mcpOAuthClientFor(cfg, url),
+      ...oauthOptions,
+      // A built-in Google connector is answered in-process.
+      ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
+      // SSE advertises its POST endpoint on the authenticated event stream.
+      // No other path on the origin is allowed to receive this server's token.
+      isTransportEndpoint: (input) => kind === 'sse' && transport?._endpoint?.href === new URL(input).href,
+    });
+  }
+  // Gmail with an app password is answered in-process too (its account
+  // header is the configured authentication; the password is in the keychain).
+  const local = !oauth && gmailAppPasswordService(url) ? { ...opts, fetch: withGmailAppPasswordMcp() } : opts;
+  transport = new Transport(new URL(url), oauth ? { fetch: oauth.fetch } : local);
+  if (oauth) {
+    transport.oauth = oauth;
+    const close = transport.close.bind(transport);
+    transport.close = async () => {
+      oauth.close();
+      await close();
+    };
+  }
+  log(`[mcp-client] Connecting "${name}" via ${kind.toUpperCase()}: ${mcpUrlForLog(url)}\n`);
+  return transport;
+}
+
+function webSocketTransport(name, cfg, sdk, log) {
+  const { WebSocketClientTransport } = sdk;
+  const url = normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), 'ws');
+  const opts = requestInitFor(cfg);
+  log(`[mcp-client] Connecting "${name}" via WebSocket: ${mcpUrlForLog(url)}\n`);
+  return opts
+    ? createHeaderWebSocketTransport(
+        WebSocketClientTransport,
+        sdk.JSONRPCMessageSchema,
+        new URL(url),
+        opts.requestInit.headers
+      )
+    : new WebSocketClientTransport(new URL(url));
+}
+
+// A stdio child, its stderr logged and its bounded (scrubbed) tail kept.
+function stdioTransport(name, cfg, StdioClientTransport, log) {
+  const transport = new StdioClientTransport({
+    command: expandEnvVars(String(cfg.command ?? '')),
+    args: Array.isArray(cfg.args) ? expandEnvVars(cfg.args) : cfg.args,
+    cwd: cfg.cwd == null ? cfg.cwd : expandEnvVars(String(cfg.cwd)),
+    env: resolveMcpStdioEnvironment(cfg),
+    stderr: cfg.stderr ?? 'pipe',
+  });
+  let tail = '';
+  transport.stderr?.on?.('data', (chunk) => {
+    const text = scrubMcpConnectionMessage(chunk, cfg);
+    tail = (tail + text).slice(-MCP_STDERR_TAIL_CHARS);
+    log(`[mcp:${name}:stderr] ${text}`);
+  });
+  return { transport, stderrTail: () => tail.trim() };
+}
+
 /** Returns { transport, autoDetectAdvert, stderrTail, warnings } — stderrTail()
  *  is the last ~4 KB of a stdio server's (scrubbed) stderr, '' for remote
  *  transports. `strictEnv` (the caller passes it for plugin-declared servers)
  *  makes unset variables without a default fail the server; otherwise they
  *  expand to empty and are reported in `warnings` (names only). */
 export function createMcpTransport({ name, cfg, sdk, log, strictEnv, oauthOptions }) {
-  const { StdioClientTransport, StreamableHTTPClientTransport, SSEClientTransport, WebSocketClientTransport } = sdk;
+  const { StdioClientTransport, StreamableHTTPClientTransport, SSEClientTransport } = sdk;
   const kind = resolveMcpTransportKind(cfg);
-  const warnings = [];
-  if (kind !== 'autoDetect') {
-    const missing = findMissingMcpEnvVars(cfg);
-    if (missing.length) {
-      const message = `missing environment variable(s): ${missing.join(', ')}`;
-      if (strictEnv === true) throw new Error(message);
-      warnings.push(message);
-      log(`[mcp-client] "${name}": ${message}\n`);
-    }
-  }
+  const warnings = kind !== 'autoDetect' ? missingEnvWarnings(name, cfg, strictEnv, log) : [];
   if (kind === 'autoDetect') {
     const { url, advert } = resolveAutoDetectUrl(name, cfg);
     log(`[mcp-client] Connecting "${name}" via autoDetect HTTP: ${url}\n`);
@@ -132,72 +285,23 @@ export function createMcpTransport({ name, cfg, sdk, log, strictEnv, oauthOption
   if (kind === 'http' || kind === 'sse') {
     const Transport = kind === 'http' ? StreamableHTTPClientTransport : SSEClientTransport;
     const url = resolveMcpOAuthUrl(cfg);
-    const opts = requestInitFor(cfg);
-    // Explicit authentication remains authoritative (including custom API-key
-    // headers). Never forward those credentials to OAuth discovery endpoints.
-    let transport;
-    const oauth = hasConfiguredMcpAuth(cfg)
-      ? null
-      : createMcpOAuth({
-          url,
-          serverName: mcpOAuthDisplayName(cfg, name),
-          oauthClient: mcpOAuthClientFor(cfg, url),
-          ...oauthOptions,
-          // A built-in Google connector is answered in-process.
-          ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
-          // SSE advertises its POST endpoint on the authenticated event stream.
-          // No other path on the origin is allowed to receive this server's token.
-          isTransportEndpoint: (input) => kind === 'sse' && transport?._endpoint?.href === new URL(input).href,
-        });
-    // Gmail with an app password is answered in-process too (its account
-    // header is the configured authentication; the password is in the keychain).
-    const local = !oauth && gmailAppPasswordService(url) ? { ...opts, fetch: withGmailAppPasswordMcp() } : opts;
-    transport = new Transport(new URL(url), oauth ? { fetch: oauth.fetch } : local);
-    if (oauth) {
-      transport.oauth = oauth;
-      const close = transport.close.bind(transport);
-      transport.close = async () => {
-        oauth.close();
-        await close();
-      };
+    // A disabled account is neither connected nor routed to.
+    const accountServers = connectorLiveAccountServers(cfg);
+    if (!accountServers.length && connectorAccountsOf(cfg).length) {
+      throw new Error(`Every account of "${name}" is disabled`);
     }
-    log(`[mcp-client] Connecting "${name}" via ${kind.toUpperCase()}: ${mcpUrlForLog(url)}\n`);
-    return {
-      transport,
-      autoDetectAdvert: null,
-      stderrTail: noStderrTail,
-      warnings,
-    };
+    const transport = accountServers.length
+      ? connectorAccountsTransport({ name, cfg, Transport, url, accountServers, oauthOptions, log })
+      : remoteHttpTransport({ name, cfg, kind, Transport, url, oauthOptions, log });
+    return { transport, autoDetectAdvert: null, stderrTail: noStderrTail, warnings };
   }
   if (kind === 'ws') {
-    const url = normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), 'ws');
-    const opts = requestInitFor(cfg);
-    log(`[mcp-client] Connecting "${name}" via WebSocket: ${mcpUrlForLog(url)}\n`);
-    const transport = opts
-      ? createHeaderWebSocketTransport(
-          WebSocketClientTransport,
-          sdk.JSONRPCMessageSchema,
-          new URL(url),
-          opts.requestInit.headers
-        )
-      : new WebSocketClientTransport(new URL(url));
+    const transport = webSocketTransport(name, cfg, sdk, log);
     return { transport, autoDetectAdvert: null, stderrTail: noStderrTail, warnings };
   }
   if (kind === 'stdio') {
-    const transport = new StdioClientTransport({
-      command: expandEnvVars(String(cfg.command ?? '')),
-      args: Array.isArray(cfg.args) ? expandEnvVars(cfg.args) : cfg.args,
-      cwd: cfg.cwd == null ? cfg.cwd : expandEnvVars(String(cfg.cwd)),
-      env: resolveMcpStdioEnvironment(cfg),
-      stderr: cfg.stderr ?? 'pipe',
-    });
-    let tail = '';
-    transport.stderr?.on?.('data', (chunk) => {
-      const text = scrubMcpConnectionMessage(chunk, cfg);
-      tail = (tail + text).slice(-MCP_STDERR_TAIL_CHARS);
-      log(`[mcp:${name}:stderr] ${text}`);
-    });
-    return { transport, autoDetectAdvert: null, stderrTail: () => tail.trim(), warnings };
+    const { transport, stderrTail } = stdioTransport(name, cfg, StdioClientTransport, log);
+    return { transport, autoDetectAdvert: null, stderrTail, warnings };
   }
   throw new Error(
     `Invalid config for "${name}": need autoDetect, type (stdio/http/sse/ws), url (http), or command (stdio)`

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -37,6 +37,8 @@ import { listAllMcpTools, MCP_CONNECT_CANCELLED, runBoundedHandshake } from './c
 import { rememberServerConnector } from './server-connectors.mjs';
 import { mcpOAuthClientFor, mcpOAuthDisplayName } from './oauth-client.mjs';
 import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
+import { gmailAppPasswordService } from '../../../connectors/gmail-app-password.mjs';
+import { connectorLiveAccountServers } from '../../../shared/connector-catalog.mjs';
 import {
   clearMcpOAuth,
   commitMcpOAuthSwitch,
@@ -1117,6 +1119,23 @@ export function isMcpTool(name) {
 export function isRegisteredMcpTool(name, scopeId = DEFAULT_MCP_SCOPE_ID) {
   return Boolean(resolveMcpToolTarget(scopeId, name)?.definition);
 }
+/** True when the prefixed name is `read_email` of a server whose every
+ *  endpoint Mixdog answers in-process (the Gmail app-password connector,
+ *  alone or behind the multi-account server): its result is a mail as the
+ *  mailbox holds it, never another server's text (browser-bridge/mail-links.mjs). */
+export function isBuiltinMailRead(name, scopeId = DEFAULT_MCP_SCOPE_ID) {
+  const target = resolveMcpToolTarget(normalizeMcpScopeId(scopeId), name);
+  if (!target || (target.definition?.mcpToolName || MCP_TOOL_NAME_RE.exec(name)?.[2]) !== 'read_email') return false;
+  const accounts = connectorLiveAccountServers(target.server.cfg);
+  return (accounts.length ? accounts : [target.server.cfg]).every((cfg) => {
+    try {
+      const url = resolveMcpOAuthUrl(cfg);
+      return Boolean(gmailAppPasswordService(url) || googleMcpService(url));
+    } catch {
+      return false;
+    }
+  });
+}
 /**
  * Check whether the inputSchema for an MCP tool declares the given top-level
  * property. Used to decide if the orchestrator should auto-inject context

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -1,4 +1,5 @@
 import { createServer } from 'node:http';
+import { listenOnFetchSafePort } from '../../../shared/fetch-safe-listen.mjs';
 import { randomBytes } from 'node:crypto';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 import { identityFromTokenResponse } from './oauth-account.mjs';
@@ -48,8 +49,10 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     await new Promise((resolve, reject) => {
       flow.listener.once('error', reject);
       // Retain the registered redirect URI if this connection later needs
-      // refresh or reauthorization; never register a different callback.
-      flow.listener.listen(creds.redirectUrl ? Number(new URL(creds.redirectUrl).port) : 0, '127.0.0.1', resolve);
+      // refresh or reauthorization; never register a different callback. A new
+      // one is a port the browser can be redirected to.
+      if (creds.redirectUrl) flow.listener.listen(Number(new URL(creds.redirectUrl).port), '127.0.0.1', resolve);
+      else listenOnFetchSafePort(flow.listener, '127.0.0.1', resolve);
     });
     creds.redirectUrl = `http://127.0.0.1:${flow.listener.address().port}/oauth/callback`;
   }