mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -20,7 +20,7 @@ import { cwdWithinProjects } from '../../../shared/extension-scopes.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { mixyIdentityDir, userDefinitionDir } from '../../../shared/agent-store.mjs';
 import { isSelfMcpToolName, parseMcpToolName } from '../../../shared/tool-primitives.mjs';
-import { connectorToolDefault } from '../../../shared/connector-catalog.mjs';
+import { connectorById, connectorToolDefault } from '../../../shared/connector-catalog.mjs';
 import { MIXY_AGENT_ID } from '../session/agent-home.mjs';
 import { AGENT_MODE, sessionModeOf } from '../session/agent-mode.mjs';
 import { serverConnector } from './server-connectors.mjs';
@@ -214,12 +214,43 @@ export function connectorToolPermission(policy, toolOrName) {
   const mcp = parseMcpToolName(toolOrName);
   if (!mcp || isSelfMcpToolName(toolOrName)) return 'auto';
   if (policy && !connectorEnabled(policy, mcp.server)) return 'disabled';
-  // An explicit per-tool entry decides; otherwise a catalog connector's
-  // high-risk tools ask (connectorToolDefault) and any other tool is auto.
-  return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
+  // An explicit per-tool entry of the tool's connector decides; otherwise a
+  // catalog connector's high-risk tools ask (connectorToolDefault) and any
+  // other tool is auto.
+  const [own] = connectorToolEntries(policy?.tools, connectorGroupId(mcp.server), mcp.tool);
+  return own || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
 export const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+
+/** The connector a server (account) belongs to: `gmail-2` → `gmail` for a
+ *  catalog connector; any other id is its own. A tool's permission is stored
+ *  once, under this id, and governs every account. */
+export function connectorGroupId(serverId) {
+  const base = String(serverId).replace(/-\d+$/, '');
+  return base !== serverId && connectorById(base) ? base : serverId;
+}
+
+const accountNumber = (id) => Number(/-(\d+)$/.exec(id)?.[1] ?? 0);
+
+/** The entries for `tool` under the connector `group` or any of its accounts,
+ *  topmost first: the connector's own, then the lowest-numbered account. An
+ *  account only holds one in data saved before permissions were kept per
+ *  connector; the first entry is the one that applies. */
+export function connectorToolEntries(tools, group, tool) {
+  return Object.entries(tools || {})
+    .filter(([id, own]) => connectorGroupId(id) === group && CONNECTOR_PERMISSIONS.includes(own?.[tool]))
+    .sort(([a], [b]) => accountNumber(a) - accountNumber(b))
+    .map(([, own]) => own[tool]);
+}
+
+const UNLISTED_ACCOUNT = '\0unlisted account';
+
+/** Rank of `tool` on one account of connector `group`: 0 when that account is
+ *  off, else the topmost entry for the connector, else `unset` (no override:
+ *  at least asks / at most runs freely). */
+const accountRank = (tools, off, account, group, tool, unset) =>
+  off.has(account) ? 0 : (PERMISSION_RANK[connectorToolEntries(tools, group, tool)[0]] ?? unset);
 export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
 
 /** Whether replacing the stored policy `before` (a stored value, a parsed
@@ -243,21 +274,100 @@ function connectorPolicyWidens(before, after) {
   for (const server of offBefore) if (!offAfter.has(server)) return true;
   const toolsBefore = old.tools || {};
   const toolsAfter = next.tools || {};
-  for (const server of new Set([...Object.keys(toolsBefore), ...Object.keys(toolsAfter)])) {
-    const tools = new Set([...Object.keys(toolsBefore[server] || {}), ...Object.keys(toolsAfter[server] || {})]);
-    for (const tool of tools) {
-      // No override: at least asks / at most runs freely.
-      const was = offBefore.has(server) ? 0 : (PERMISSION_RANK[toolsBefore[server]?.[tool]] ?? 1);
-      const now = offAfter.has(server) ? 0 : (PERMISSION_RANK[toolsAfter[server]?.[tool]] ?? 2);
+  // Judged per connector and tool: the accounts of one connector share them.
+  const pairs = new Set(
+    [toolsBefore, toolsAfter].flatMap((tools) =>
+      Object.entries(tools).flatMap(([id, own]) => Object.keys(own || {}).map((tool) => `${connectorGroupId(id)}\0${tool}`))
+    )
+  );
+  for (const pair of pairs) {
+    const [group, tool] = pair.split('\0');
+    // Each account on its own: one that is off does not hold back its siblings.
+    // Plus one account the policy never names: it is on in both policies, so it
+    // stands for every installed account that is not listed.
+    const accounts = new Set([
+      UNLISTED_ACCOUNT,
+      ...[group, ...offBefore, ...offAfter, ...Object.keys(toolsBefore), ...Object.keys(toolsAfter)].filter(
+        (id) => connectorGroupId(id) === group
+      ),
+    ]);
+    for (const account of accounts) {
+      const was = accountRank(toolsBefore, offBefore, account, group, tool, 1);
+      const now = accountRank(toolsAfter, offAfter, account, group, tool, 2);
       if (now > was) return true;
     }
   }
   return false;
 }
 
-/** Throws NO_WIDEN_MESSAGE when `after` could widen `before` (see connectorPolicyWidens). */
+/** The `code` of the error a refused widening throws. */
+export const CONNECTOR_POLICY_WIDENS = 'CONNECTOR_POLICY_WIDENS';
+/** An approved tool change met a restriction newer than its request. */
+export const CONNECTOR_TOOL_NARROWED = 'CONNECTOR_TOOL_NARROWED';
+/** An approved tool change found the tool already at that level or more. */
+export const CONNECTOR_TOOL_ALREADY = 'CONNECTOR_TOOL_ALREADY';
+
+const codedError = (code, message) => Object.assign(new Error(message), { code });
+
+// The one change a person approved on a card (setup-tool connector-widen-approval.mjs),
+// set only for the synchronous stretch of its write.
+let approvedToolChange = null;
+
+/** Run `write` (a writer whose noWiden check runs synchronously, before it
+ *  writes) with one approved change `{ server, tool, from, to }`: its check
+ *  then lets exactly that tool go to `to`, judged on the stored policy it
+ *  writes over, and nothing else widen. Returns what `write` returns. */
+export function withApprovedConnectorToolChange(change, write) {
+  approvedToolChange = change;
+  try {
+    return write();
+  } finally {
+    approvedToolChange = null;
+  }
+}
+
+// The approved tool's entries (the connector's, and any account's) pinned to
+// one value in both policies, so the comparison judges every other tool and switch.
+const pinTool = (policy, group, tool) => {
+  const tools = Object.fromEntries(
+    Object.entries(policy?.tools || {}).map(([id, own]) => [
+      id,
+      connectorGroupId(id) === group ? { ...own, [tool]: 'disabled' } : own,
+    ])
+  );
+  tools[group] = { ...tools[group], [tool]: 'disabled' };
+  return { off: policy?.off || [], tools };
+};
+
+function assertApprovedToolChange(before, after, { server, tool, from, to }) {
+  let old;
+  try {
+    old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);
+  } catch {
+    throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
+  }
+  // The approved change is the connector's: its one entry goes to `to`.
+  const group = connectorGroupId(server);
+  if (old.allow || after?.tools?.[group]?.[tool] !== to) throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
+  if (connectorPolicyWidens(pinTool(old, group, tool), pinTool(after, group, tool))) {
+    throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
+  }
+  // No override: it asks at least (as connectorPolicyWidens reads it).
+  const was = accountRank(old.tools, new Set(old.off), server, group, tool, 1);
+  if (was < PERMISSION_RANK[from]) {
+    throw codedError(CONNECTOR_TOOL_NARROWED, 'A newer restriction on this tool landed meanwhile; it was kept.');
+  }
+  if (was >= PERMISSION_RANK[to]) {
+    throw codedError(CONNECTOR_TOOL_ALREADY, 'The tool already has this permission or more; nothing changed.');
+  }
+}
+
+/** Throws NO_WIDEN_MESSAGE (code CONNECTOR_POLICY_WIDENS) when `after` could
+ *  widen `before` (see connectorPolicyWidens); inside
+ *  withApprovedConnectorToolChange, only its approved change may. */
 export function assertConnectorPolicyNotWidened(before, after) {
-  if (connectorPolicyWidens(before, after)) throw new Error(NO_WIDEN_MESSAGE);
+  if (approvedToolChange) return assertApprovedToolChange(before, after, approvedToolChange);
+  if (connectorPolicyWidens(before, after)) throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
 }
 
 let toolPermissionWriter = null;

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -69,8 +69,10 @@ function run(cmd, args, { strict = false, timeoutMs = ENUMERATION_DEADLINE_MS }
 }
 
 // Snapshot the whole process table once: parent map + a per-pid identity
-// token (Windows CreationDate, POSIX lstart) so a later kill can prove a pid
-// number was not recycled onto a different process before signalling it.
+// token (Windows CreationDate as a UTC FILETIME, POSIX lstart) so a later kill
+// can prove a pid number was not recycled onto a different process before
+// signalling it. The FILETIME form orders against the spawn server's root
+// creation time and carries no local-time offset.
 // POSIX rows also carry the process group id (Windows has none).
 async function enumerate({ strict = false } = {}) {
   const childrenOf = new Map();
@@ -84,7 +86,7 @@ async function enumerate({ strict = false } = {}) {
           '-NoProfile',
           '-NonInteractive',
           '-Command',
-          `${strict ? "$ErrorActionPreference = 'Stop'; " : ''}Get-CimInstance Win32_Process | ForEach-Object { $created = if ($_.CreationDate) { $_.CreationDate.ToString('o') } else { '' }; "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $created" }`,
+          `${strict ? "$ErrorActionPreference = 'Stop'; " : ''}Get-CimInstance Win32_Process | ForEach-Object { $created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { '' }; "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $created" }`,
         ],
         { strict, timeoutMs: ENUMERATION_DEADLINE_MS }
       )

package/src/runtime/agent/orchestrator/mcp/client-config.mjs

@@ -307,14 +307,25 @@ export function resolveMcpTransportKind(cfg) {
   throw new Error(`Invalid config: need autoDetect, type (stdio/http/sse/ws), url (http), or command (stdio)`);
 }
 
-/** The exact URL OAuth credentials of an HTTP/SSE server config are stored
- *  under; null for other transports. */
+/** The exact URL an HTTP/SSE server config signs in at with OAuth; null for
+ *  other transports. */
 export function resolveMcpOAuthUrl(cfg) {
   const kind = resolveMcpTransportKind(cfg);
   if (kind !== 'http' && kind !== 'sse') return null;
   return normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), kind);
 }
 
+/** What the OAuth credentials of an HTTP/SSE server config are stored under:
+ *  its exact URL, or a connector account's own `oauthKey` (another account
+ *  of the connector signs in at the same URL), whatever the URL. Null for
+ *  other transports. */
+export function resolveMcpOAuthCredentialKey(cfg) {
+  const url = resolveMcpOAuthUrl(cfg);
+  if (!url) return null;
+  const own = typeof cfg.oauthKey === 'string' ? cfg.oauthKey.trim() : '';
+  return own ? `mcp-account:${own}` : url;
+}
+
 // MCP per-tool-call timeout. Default 2min: a hung/unresponsive MCP server
 // (e.g. a busy editor) must not stall a tool call indefinitely. Genuinely
 // long-running tools can raise/disable it via MIXDOG_MCP_CALL_TIMEOUT_MS or a

package/src/runtime/agent/orchestrator/mcp/client-transport.mjs

@@ -8,24 +8,30 @@ import { createMcpOAuth } from './oauth.mjs';
 import { mcpOAuthClientFor, mcpOAuthDisplayName } from './oauth-client.mjs';
 import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
 import { gmailAppPasswordService, withGmailAppPasswordMcp } from '../../../connectors/gmail-app-password.mjs';
-import { connectorAccountRequest, withConnectorAccountsMcp } from '../../../connectors/connector-accounts-mcp.mjs';
+import { withConnectorAccountsMcp } from '../../../connectors/connector-accounts-mcp.mjs';
 import {
   connectorAccountsOf,
   connectorLiveAccountServers,
   gmailAppPasswordAccount,
 } from '../../../shared/connector-catalog.mjs';
-import { isMcpOAuthReauthenticationRequired } from './oauth.mjs';
+import { runAbortable } from '../../../shared/abort-race.mjs';
+import { isMcpOAuthReauthenticationRequired, storedMcpOAuthIdentity } from './oauth.mjs';
+import { shutdownStdioChild } from './child-tree.mjs';
+import { listAllMcpTools } from './client-handshake.mjs';
 import {
   AUTO_DETECT_PORTS,
+  MCP_MAX_TIMER_MS,
   expandEnvVars,
   findMissingMcpEnvVars,
   mcpUrlForLog,
   normalizeMcpTransportUrl,
   resolveMcpHttpHeaders,
+  resolveMcpOAuthCredentialKey,
   resolveMcpOAuthUrl,
   resolveMcpStdioEnvironment,
   resolveMcpTransportKind,
   scrubMcpConnectionMessage,
+  scrubMcpSecrets,
 } from './client-config.mjs';
 
 /**
@@ -76,57 +82,142 @@ export function hasConfiguredMcpAuth(cfg) {
   );
 }
 
-/** One account of a multi-account connector server (connector-catalog.mjs
- *  connectorAccountServer) as connector-accounts-mcp.mjs calls it: through
- *  the transport the account had as a server of its own — its app-password
- *  header, or its own non-interactive OAuth sign-in (refreshed as needed; a
- *  new sign-in goes through 계정 바꾸기, never through a tool call). */
-function connectorAccountClient(serverName, accountCfg, oauthOptions) {
-  const base = { name: accountCfg.name, email: '', appPassword: false, close() {} };
-  let url;
+// A stdio account (Postgres) runs one process per account config, shared by
+// the connector server of every scope like any stdio server (client.mjs):
+// account config → its connection, which closes with its last holder.
+const sharedAccountConnections = new Map();
+
+/** Close one account connection: a stdio child with its whole process tree. */
+async function closeAccountConnection(connection) {
+  connection.dead = true;
+  if (connection.transport?._process) await shutdownStdioChild(connection.transport).catch(() => {});
+  await connection.client.close().catch(() => {});
+}
+
+/** Whether a call failure is the account server's own JSON-RPC answer: its
+ *  connection stays. */
+const answeredError = (error) => error?.name === 'McpError' && error.code !== -32000;
+
+/** The address a remote account is signed in as, '' when none is known. */
+function signedInAs(accountCfg) {
   try {
-    url = resolveMcpOAuthUrl(accountCfg);
-    if (hasConfiguredMcpAuth(accountCfg)) {
-      const email = gmailAppPasswordAccount(accountCfg);
-      const fetchImpl = gmailAppPasswordService(url) ? withGmailAppPasswordMcp() : fetch;
-      return {
-        ...base,
-        email,
-        appPassword: Boolean(email),
-        request: connectorAccountRequest(url, fetchImpl, resolveMcpHttpHeaders(accountCfg)),
-      };
+    const url = resolveMcpOAuthUrl(accountCfg);
+    if (!url || hasConfiguredMcpAuth(accountCfg)) return '';
+    return storedMcpOAuthIdentity(url, resolveMcpOAuthCredentialKey(accountCfg))?.account || '';
+  } catch {
+    return '';
+  }
+}
+
+/** One account of a connector server (connector-catalog.mjs
+ *  connectorAccountServer) as connector-accounts-mcp.mjs calls it: its own
+ *  MCP connection through the transport it had as a server of its own — its
+ *  key header, its app password, its local command, or its own
+ *  non-interactive OAuth sign-in (refreshed as needed; a new sign-in goes
+ *  through 계정 바꾸기, never through a tool call). Connected on first use and
+ *  again after its connection failed. */
+function connectorAccountClient(serverName, accountCfg, { sdk, log, oauthOptions }) {
+  const { interactive: _interactive, ...ownOAuth } = oauthOptions || {};
+  const address = gmailAppPasswordAccount(accountCfg);
+  const shareKey = resolveMcpTransportKind(accountCfg) === 'stdio' ? JSON.stringify(accountCfg) : null;
+  const secretsOf = (connection) => connection?.transport?.oauth?.secrets() || [];
+  const accountError = (error, connection) => {
+    if (isMcpOAuthReauthenticationRequired(error)) {
+      return Object.assign(new Error('Sign-in required; sign this account in again in Connectors.'), {
+        authRequired: true,
+      });
     }
-    const oauth = createMcpOAuth({
-      url,
-      serverName: mcpOAuthDisplayName(accountCfg, serverName),
-      oauthClient: mcpOAuthClientFor(accountCfg, url),
-      ...(oauthOptions?.fetchImpl ? { fetchImpl: oauthOptions.fetchImpl } : {}),
-      ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp(oauthOptions?.fetchImpl) } : {}),
-    });
-    const send = connectorAccountRequest(url, (input, init) => oauth.fetch(input, init));
-    return {
-      ...base,
-      async request(message, options) {
-        try {
-          return await send(message, options);
-        } catch (error) {
-          const reason = scrubMcpConnectionMessage(error?.message || String(error), accountCfg);
-          const scrubbed = new Error(
-            isMcpOAuthReauthenticationRequired(error)
-              ? 'Sign-in required; sign this account in again in Connectors.'
-              : reason
-          );
-          if (isMcpOAuthReauthenticationRequired(error)) scrubbed.authRequired = true;
-          throw scrubbed;
-        }
-      },
-      close: () => oauth.close(),
+    const reason = scrubMcpConnectionMessage(error?.message || String(error), accountCfg, secretsOf(connection));
+    return new Error(appendMcpStderrTail(reason, connection?.stderrTail?.() || ''));
+  };
+  const open = () => {
+    const connection = { users: 0, dead: false };
+    try {
+      const made = createMcpTransport({ name: accountCfg.name, cfg: accountCfg, sdk, log, oauthOptions: ownOAuth });
+      connection.transport = made.transport;
+      connection.stderrTail = made.stderrTail;
+    } catch (error) {
+      // A broken account (no sign-in client, an invalid address) stays listed with why.
+      connection.dead = true;
+      connection.client = { close: async () => {} };
+      connection.ready = Promise.reject(error);
+      connection.ready.catch(() => {});
+      return connection;
+    }
+    const client = new sdk.Client({ name: `mixdog-agent/${serverName}`, version: '1.0.0' });
+    connection.client = client;
+    const retire = () => {
+      connection.dead = true;
+      if (shareKey && sharedAccountConnections.get(shareKey) === connection) sharedAccountConnections.delete(shareKey);
     };
-  } catch (error) {
-    // A broken account (no sign-in client, an invalid address) stays listed with why.
-    const failed = new Error(error?.message || String(error));
-    return { ...base, request: async () => Promise.reject(failed) };
-  }
+    client.onclose = retire;
+    connection.retire = retire;
+    connection.ready = (async () => {
+      await client.connect(connection.transport, { timeout: MCP_MAX_TIMER_MS });
+      const tools = client.getServerCapabilities()?.tools
+        ? (await listAllMcpTools(client, { timeout: MCP_MAX_TIMER_MS }))?.tools
+        : [];
+      if (!Array.isArray(tools)) throw new Error('The account listed its tools in an invalid shape');
+      return { instructions: client.getInstructions() || '', tools };
+    })();
+    connection.ready.catch(() => {
+      retire();
+      void closeAccountConnection(connection);
+    });
+    return connection;
+  };
+  let held = null;
+  const release = () => {
+    const connection = held;
+    held = null;
+    if (!connection || --connection.users > 0) return;
+    connection.retire?.();
+    void closeAccountConnection(connection);
+  };
+  const acquire = () => {
+    if (held && !held.dead) return held;
+    release();
+    let connection = shareKey ? sharedAccountConnections.get(shareKey) : null;
+    if (!connection || connection.dead) {
+      connection = open();
+      if (shareKey && !connection.dead) sharedAccountConnections.set(shareKey, connection);
+    }
+    connection.users += 1;
+    held = connection;
+    return connection;
+  };
+  return {
+    name: accountCfg.name,
+    email: address || signedInAs(accountCfg),
+    async connect(signal) {
+      const connection = acquire();
+      try {
+        return await runAbortable(signal, () => connection.ready);
+      } catch (error) {
+        throw accountError(error, connection);
+      }
+    },
+    async callTool(params, { signal, onprogress } = {}) {
+      const connection = acquire();
+      try {
+        await runAbortable(signal, () => connection.ready);
+        // The caller's deadline governs (it resets on the progress passed up).
+        const result = await connection.client.callTool(params, undefined, {
+          signal,
+          timeout: MCP_MAX_TIMER_MS,
+          ...(onprogress ? { onprogress } : {}),
+        });
+        return scrubMcpSecrets(result, secretsOf(connection));
+      } catch (error) {
+        const failed = accountError(error, connection);
+        if (answeredError(error)) return { content: [{ type: 'text', text: failed.message }], isError: true };
+        // A connection a call failed on is opened again for the next call.
+        if (!signal?.aborted) connection.retire?.();
+        throw failed;
+      }
+    },
+    close: release,
+  };
 }
 
 // The SDK's WebSocket transport opens its socket without a way to set request
@@ -177,13 +268,15 @@ function missingEnvWarnings(name, cfg, strictEnv, log) {
   return warnings;
 }
 
-// A multi-account connector: one server, every account behind it; closing the
-// transport closes every account client.
-function connectorAccountsTransport({ name, cfg, Transport, url, accountServers, oauthOptions, log }) {
-  const accounts = accountServers.map((accountCfg) => connectorAccountClient(name, accountCfg, oauthOptions));
-  const transport = new Transport(new URL(url), {
-    fetch: withConnectorAccountsMcp({ connector: cfg.connector, accounts }),
-  });
+// A connector server: one server, every account behind it (its account choice
+// on `connectorAccounts`); closing the transport closes every account client.
+function connectorAccountsTransport({ name, cfg, Transport, url, accountServers, sdk, oauthOptions, log }) {
+  const accounts = accountServers.map((accountCfg) =>
+    connectorAccountClient(name, accountCfg, { sdk, log, oauthOptions })
+  );
+  const fetchImpl = withConnectorAccountsMcp({ connector: cfg.connector, accounts });
+  const transport = new Transport(new URL(url), { fetch: fetchImpl });
+  transport.connectorAccounts = fetchImpl.connectorAccounts;
   const close = transport.close.bind(transport);
   transport.close = async () => {
     for (const account of accounts) account.close();
@@ -204,6 +297,7 @@ function remoteHttpTransport({ name, cfg, kind, Transport, url, oauthOptions, lo
   if (!hasConfiguredMcpAuth(cfg)) {
     oauth = createMcpOAuth({
       url,
+      credentialKey: resolveMcpOAuthCredentialKey(cfg),
       serverName: mcpOAuthDisplayName(cfg, name),
       oauthClient: mcpOAuthClientFor(cfg, url),
       ...oauthOptions,
@@ -291,7 +385,7 @@ export function createMcpTransport({ name, cfg, sdk, log, strictEnv, oauthOption
       throw new Error(`Every account of "${name}" is disabled`);
     }
     const transport = accountServers.length
-      ? connectorAccountsTransport({ name, cfg, Transport, url, accountServers, oauthOptions, log })
+      ? connectorAccountsTransport({ name, cfg, Transport, url, accountServers, sdk, oauthOptions, log })
       : remoteHttpTransport({ name, cfg, kind, Transport, url, oauthOptions, log });
     return { transport, autoDetectAdvert: null, stderrTail: noStderrTail, warnings };
   }

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -25,6 +25,7 @@ import { currentToolExecutionOwner } from '../../../shared/tool-execution-owner.
 import { positiveInt } from '../../../shared/numbers.mjs';
 import {
   providerSafeMcpToolName,
+  resolveMcpOAuthCredentialKey,
   resolveMcpOAuthUrl,
   resolveMcpRequestTimeouts,
   resolveMcpTransportKind,
@@ -39,6 +40,7 @@ import { mcpOAuthClientFor, mcpOAuthDisplayName } from './oauth-client.mjs';
 import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.mjs';
 import { gmailAppPasswordService } from '../../../connectors/gmail-app-password.mjs';
 import { connectorLiveAccountServers } from '../../../shared/connector-catalog.mjs';
+import { CONVERSATION_META } from '../../../connectors/connector-accounts-mcp.mjs';
 import {
   clearMcpOAuth,
   commitMcpOAuthSwitch,
@@ -503,10 +505,15 @@ export async function executeMcpTool(name, args, options = {}) {
   const serverName = server.name;
   const toolName = definition?.mcpToolName || match[2];
   const callSignal = options?.signal || null;
+  // A connector server's call names the conversation it is made in: its
+  // account default, and the account it makes the last used.
+  const conversation = String(options?.conversation || '').trim();
+  const metaFor = (target) =>
+    conversation && target.transport?.connectorAccounts ? { [CONVERSATION_META]: conversation } : undefined;
   const dispatch = (target) =>
     definition?.mcpOperation
       ? _callMcpFeatureWithTimeout(target, definition.mcpOperation, args, callSignal)
-      : _callToolWithTimeout(target, toolName, args, callSignal);
+      : _callToolWithTimeout(target, toolName, args, callSignal, metaFor(target));
   let retryServer = null;
   const secrets = () => oauthSecrets(server.transport, retryServer?.transport);
   const gate = callAdmissionFor(server);
@@ -999,7 +1006,7 @@ export function raceMcpAbort(promise, signal, message) {
   });
 }
 
-async function _callToolWithTimeout(server, toolName, args, signal = null) {
+async function _callToolWithTimeout(server, toolName, args, signal = null, meta = undefined) {
   // The request's signal goes INTO the SDK: an aborted caller (or our own
   // timeout) cancels the live JSON-RPC request (notifications/cancelled)
   // instead of merely walking away from it. The abort race additionally frees
@@ -1008,7 +1015,8 @@ async function _callToolWithTimeout(server, toolName, args, signal = null) {
   return runMcpRequest(
     server,
     signal,
-    (options) => server.client.callTool({ name: toolName, arguments: args }, undefined, options),
+    (options) =>
+      server.client.callTool({ name: toolName, arguments: args, ...(meta ? { _meta: meta } : {}) }, undefined, options),
     {
       abortMessage: `MCP tool call aborted (server="${server?.name}", tool="${toolName}")`,
       timeoutMessage: (ms) =>
@@ -1119,6 +1127,24 @@ export function isMcpTool(name) {
 export function isRegisteredMcpTool(name, scopeId = DEFAULT_MCP_SCOPE_ID) {
   return Boolean(resolveMcpToolTarget(scopeId, name)?.definition);
 }
+/**
+ * The account (`{ name, label }`: its unique name, which binds a call to it,
+ * and what it is shown as) a call of the prefixed tool `name` with `args`
+ * would use on its connector server, made in `conversation`
+ * (connectors/connector-accounts-mcp.mjs): the one `args.account` names, else
+ * the one used last. Null when the tool's server holds no accounts. Throws the
+ * refusal (usable accounts listed) when that account cannot be used.
+ */
+export function resolveMcpToolAccount(name, args, { scopeId = DEFAULT_MCP_SCOPE_ID, conversation = '' } = {}) {
+  const target = resolveMcpToolTarget(normalizeMcpScopeId(scopeId), name);
+  const accounts = target?.server?.transport?.connectorAccounts;
+  if (!accounts || target.definition?.mcpOperation) return null;
+  return accounts.choose({
+    tool: target.definition?.mcpToolName || MCP_TOOL_NAME_RE.exec(name)?.[2],
+    wanted: args?.account,
+    conversation: String(conversation || '').trim(),
+  });
+}
 /** True when the prefixed name is `read_email` of a server whose every
  *  endpoint Mixdog answers in-process (the Gmail app-password connector,
  *  alone or behind the multi-account server): its result is a mail as the
@@ -1272,18 +1298,19 @@ export function isMcpLoginPending(name, options = {}) {
  * for servers that never use MCP OAuth.
  */
 export function getMcpServerOAuthState(cfg) {
-  let url;
+  let key;
   try {
-    url = resolveMcpOAuthUrl(cfg);
+    key = resolveMcpOAuthCredentialKey(cfg);
   } catch {
     return null;
   }
-  if (!url || hasConfiguredMcpAuth(cfg)) return null;
-  const signedIn = hasStoredMcpOAuthTokens(url);
+  if (!key || hasConfiguredMcpAuth(cfg)) return null;
+  const url = resolveMcpOAuthUrl(cfg);
+  const signedIn = hasStoredMcpOAuthTokens(url, key);
   if (!signedIn) return { signedIn };
   // Who it is signed in as (never guessed: empty when the server named nobody)
   // and whether 계정 바꾸기 can make the provider show its account choice.
-  const who = storedMcpOAuthIdentity(url);
+  const who = storedMcpOAuthIdentity(url, key);
   return {
     signedIn,
     account: typeof who?.account === 'string' ? who.account : '',
@@ -1298,32 +1325,38 @@ export function startMcpServerOAuthSwitch(cfg, launch, serverName) {
   if (!url) throw new Error(`MCP server "${serverName}" does not use OAuth sign-in`);
   return startMcpOAuthSwitch({
     url,
+    credentialKey: resolveMcpOAuthCredentialKey(cfg),
     launch,
     serverName: mcpOAuthDisplayName(cfg, serverName),
     oauthClient: mcpOAuthClientFor(cfg, url),
     ...(googleMcpService(url) ? { fetchImpl: withGoogleMcp() } : {}),
   });
 }
-/** Store a switch's sign-in for the server's URL; resolves its rollback. */
+/** Store a switch's sign-in as the server's (its URL's, or its own key's);
+ *  resolves its rollback. */
 export function commitMcpServerOAuthSwitch(cfg, signIn) {
-  return commitMcpOAuthSwitch({ url: resolveMcpOAuthUrl(cfg), signIn });
+  return commitMcpOAuthSwitch({
+    url: resolveMcpOAuthUrl(cfg),
+    credentialKey: resolveMcpOAuthCredentialKey(cfg),
+    signIn,
+  });
 }
 /**
- * Log out of an HTTP/SSE server URL: delete the OAuth tokens and client
- * registration stored for it, shared by every server configured with that
- * exact URL, and drop them from live connections. `options.revoke` also
- * revokes the grant where the authorization server documents how; resolves
- * `{ revoked }`.
+ * Log out of an HTTP/SSE server: delete the OAuth tokens and client
+ * registration stored for it (shared by every server configured with that
+ * exact URL, unless it has its own credential key), and drop them from live
+ * connections. `options.revoke` also revokes the grant where the
+ * authorization server documents how; resolves `{ revoked }`.
  */
 export async function clearMcpServerOAuth(cfg, options = {}) {
-  let url;
+  let key;
   try {
-    url = resolveMcpOAuthUrl(cfg);
+    key = resolveMcpOAuthCredentialKey(cfg);
   } catch {
     // A config without a valid remote URL never connected, so never logged in.
     return { revoked: false };
   }
-  if (url) return clearMcpOAuth({ url, revoke: options.revoke === true });
+  if (key) return clearMcpOAuth({ url: resolveMcpOAuthUrl(cfg), credentialKey: key, revoke: options.revoke === true });
   return { revoked: false };
 }
 /**