mixdog 1.4.1 → 1.4.3

package/src/session-runtime/channel-config-api.mjs

@@ -167,6 +167,7 @@ export function createChannelConfigApi({ channels, reloadChannelsSoon, ensureAut
         {
           name: endpoint.name,
           ownerAgentId: endpoint.ownerAgentId,
+          executorAgentId: endpoint.executorAgentId || null,
           cwd: endpoint.cwd || null,
           attachments: endpoint.attachments || null,
           event: webhookEventSummary(payload.headers ?? {}, payload.body ?? {}),

package/src/session-runtime/config-change-effects.mjs

@@ -0,0 +1,179 @@
+// The change-driven effect step of one runtime. Every persisted change (a
+// config write or a keychain write, by this runtime, another runtime, another
+// process or a hand edit) reaches each subscribing runtime as one
+// notification; the runtime reloads, compares the result with the snapshot it
+// last applied, and runs only the effects keyed by what changed. The writer
+// takes the same step, so no effect depends on which process wrote.
+
+/** The setup-changed action announcing a settings change this runtime applied. */
+export const SETTINGS_CHANGED_SETUP_ACTION = 'settings_changed';
+
+// Provider credentials: `agent.<id>.apiKey` and a custom provider's extra keys
+// `agent.<id>.apiKey.<keyId>` (custom-provider-keys.mjs).
+// A deletion (config.mjs `#deleted`) may remove a secret the marker never
+// listed (stored before it existed), so it counts for providers and MCP alike.
+const PROVIDER_SECRET_ACCOUNT = /^(agent\.[^.]+\.apiKey(\.|$)|#deleted$)/;
+// What an MCP connection depends on beside its config: OAuth sign-ins and
+// client secrets, Gmail app passwords, and the plugin registry (plugin
+// servers). Token refreshes are not announced (oauth-credentials.mjs).
+const MCP_STATE_ACCOUNT = /^(mcp-oauth\.|mcp-oauth-client\.|gmail-app-password\.|#plugins$|#deleted$)/;
+
+// Secret values are compared through their change tokens, never by value.
+function tokensSignature(tokens, filter = () => true) {
+  const entries = Object.entries(tokens && typeof tokens === 'object' ? tokens : {});
+  return JSON.stringify(entries.filter(([account]) => filter(account)).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+/** What a runtime last applied: the persisted root (the desktop section has
+ *  its own owners), the applied secret change tokens and the effective MCP
+ *  servers. Provider and settings changes are judged on the stored state, not
+ *  the effective provider entries: those depend on whether a load read secrets
+ *  and ran credential probes (boot loads without), so the boot config is an
+ *  exact first baseline. MCP servers load the same either way. */
+export function configChangeSnapshot({ config, root, secretTokens }) {
+  const { desktop: _desktop, ...settingsRoot } = root && typeof root === 'object' ? root : {};
+  const agents = config?.agents && typeof config.agents === 'object' ? config.agents : {};
+  return {
+    providers: JSON.stringify([
+      settingsRoot.agent?.providers ?? null,
+      // Developer provider options (e.g. cursorOAuth) shape provider clients.
+      config?.developer ?? null,
+      tokensSignature(secretTokens, (account) => PROVIDER_SECRET_ACCOUNT.test(account)),
+    ]),
+    cacheWarming: config?.promptCacheWarming === true,
+    autoClear: JSON.stringify(config?.autoClear ?? null),
+    agentRoutes: Object.fromEntries(Object.entries(agents).map(([id, route]) => [id, JSON.stringify(route ?? null)])),
+    mcp: JSON.stringify([
+      config?.mcpServers ?? null,
+      config?.pluginMcp ?? null,
+      tokensSignature(secretTokens, (account) => MCP_STATE_ACCOUNT.test(account)),
+    ]),
+    settings: JSON.stringify([settingsRoot, tokensSignature(secretTokens)]),
+  };
+}
+
+export function diffConfigSnapshots(before, after) {
+  const routes = new Set([...Object.keys(before.agentRoutes || {}), ...Object.keys(after.agentRoutes || {})]);
+  return {
+    providers: before.providers !== after.providers,
+    mcp: before.mcp !== after.mcp,
+    settings: before.settings !== after.settings,
+    // The new value when it changed, else null.
+    cacheWarming: before.cacheWarming !== after.cacheWarming ? after.cacheWarming : null,
+    autoClear: before.autoClear !== after.autoClear,
+    // Bots whose stored route was set, changed or cleared.
+    agentRoutes: [...routes].filter((id) => before.agentRoutes?.[id] !== after.agentRoutes?.[id]).sort(),
+  };
+}
+
+/** Whether a diff found nothing changed. */
+export function configChangeIsEmpty(change) {
+  return (
+    !change.providers &&
+    !change.mcp &&
+    !change.settings &&
+    change.cacheWarming === null &&
+    !change.autoClear &&
+    !change.agentRoutes.length
+  );
+}
+
+// A domain whose effect failed: it differs from every snapshot value, so the
+// next diff carries the domain again and its effect is retried.
+const PENDING = Symbol('pending');
+
+/** The effect domains a diff carries (`agentRoutes:<id>` per bot). */
+export function configChangeDomains(change) {
+  return [
+    ...['providers', 'mcp', 'autoClear', 'settings'].filter((domain) => change[domain]),
+    ...(change.cacheWarming !== null && change.cacheWarming !== undefined ? ['cacheWarming'] : []),
+    ...(change.agentRoutes || []).map((id) => `agentRoutes:${id}`),
+  ];
+}
+
+/** `snapshot` with `domain` marked not applied. */
+export function withConfigDomainPending(snapshot, domain) {
+  if (domain.startsWith('agentRoutes:')) {
+    const id = domain.slice('agentRoutes:'.length);
+    return { ...snapshot, agentRoutes: { ...snapshot.agentRoutes, [id]: PENDING } };
+  }
+  return { ...snapshot, [domain]: PENDING };
+}
+
+/** The effects themselves, keyed by the diff. `change` may be all-false (a
+ *  rewrite of identical content): only the always-on invalidation runs.
+ *  `config` is the reloaded effective config the diff was taken against.
+ *  Answers a promise of the domains whose effect failed. One domain's effects
+ *  never overlap: a later one starts once the earlier settled (it runs at
+ *  once when none is in flight), so the latest change is applied last. */
+export function createConfigChangeEffects({
+  invalidateContextStatusCache,
+  reinitProviders,
+  releaseAdmissionCooldowns,
+  reconcileMcp,
+  announceSettingsChange,
+  noteCacheWarmingEnabled = () => {},
+  refreshLiveSessionsCacheOpts = () => {},
+  publishAgentRoute = () => {},
+}) {
+  const inFlight = new Map();
+  // domain → the failure last warned about: a retry failing the same way is
+  // not warned about again until the domain recovers.
+  const warned = new Map();
+  function run(domain, effect) {
+    const attempt = () => {
+      try {
+        return Promise.resolve(effect()).then(
+          () => {
+            warned.delete(domain);
+            return null;
+          },
+          (error) => failed(domain, error)
+        );
+      } catch (error) {
+        return Promise.resolve(failed(domain, error));
+      }
+    };
+    const prior = inFlight.get(domain);
+    const done = prior ? prior.then(attempt) : attempt();
+    inFlight.set(domain, done);
+    void done.then(() => {
+      if (inFlight.get(domain) === done) inFlight.delete(domain);
+    });
+    return done;
+  }
+  function failed(domain, error) {
+    const message = error?.message || String(error);
+    if (warned.get(domain) !== message) {
+      warned.set(domain, message);
+      console.warn(`[config] applying the ${domain} change failed: ${message}`);
+    }
+    return domain;
+  }
+
+  return function applyConfigChangeEffects(change, config) {
+    invalidateContextStatusCache();
+    const runs = [];
+    if (change.providers) {
+      // Cooldowns and initialized clients belong to the old credentials.
+      runs.push(
+        run('providers', () => {
+          releaseAdmissionCooldowns();
+          return reinitProviders();
+        })
+      );
+    }
+    if (change.mcp) runs.push(run('mcp', reconcileMcp));
+    // Every session of this process warms (or stops warming, armed chains
+    // included) as the setting now says.
+    if (change.cacheWarming !== null && change.cacheWarming !== undefined) {
+      runs.push(run('cacheWarming', () => noteCacheWarmingEnabled(change.cacheWarming)));
+    }
+    // Live sessions take the new idle window as their cache lifetime.
+    if (change.autoClear) runs.push(run('autoClear', () => refreshLiveSessionsCacheOpts(config)));
+    // The bots' chats this process hosts move onto their new routes.
+    for (const id of change.agentRoutes || []) runs.push(run(`agentRoutes:${id}`, () => publishAgentRoute(id, config)));
+    if (change.settings) runs.push(run('settings', announceSettingsChange));
+    return Promise.all(runs).then((results) => results.filter(Boolean));
+  };
+}

package/src/session-runtime/config-lifecycle/config-writers.mjs

@@ -150,5 +150,6 @@ export function createConfigWriters({ cfgMod, sharedCfgMod }) {
     hasPendingConfigChanges: () => configWriter.hasPending(),
     pendingConfigChanges: () => pendingConfigChanges,
     pendingSkills: () => skillsWriter.getPending(),
+    pendingOutputStyle: () => outputStyleWriter.getPending(),
   };
 }

package/src/session-runtime/config-lifecycle.mjs

@@ -18,7 +18,14 @@ import {
   withDefaultPresets,
 } from '../runtime/agent/orchestrator/config-presets.mjs';
 import { syncSessionCompaction } from './session-compaction-sync.mjs';
-import { createConfigWriters } from './config-lifecycle/config-writers.mjs';
+import {
+  configChangeDomains,
+  configChangeIsEmpty,
+  configChangeSnapshot,
+  diffConfigSnapshots,
+  withConfigDomainPending,
+} from './config-change-effects.mjs';
+import { configWithOutputStyle, createConfigWriters } from './config-lifecycle/config-writers.mjs';
 import { createLeadRouteSync } from './config-lifecycle/lead-route-sync.mjs';
 import { createOutputStyleStatusCache } from './config-lifecycle/output-style-cache.mjs';
 
@@ -45,9 +52,19 @@ function seedChanges(config, changes) {
     .map((key) => ({ path: [key], value: structuredClone(config[key]), ifAbsent: true }));
 }
 
+// The agent config load carries no root `outputStyle`; the stored root value
+// is laid on it (absent: the default style applies).
+function withStoredOutputStyle(config, storedOutputStyle) {
+  return typeof storedOutputStyle === 'string' && storedOutputStyle.trim()
+    ? { ...config, outputStyle: storedOutputStyle.trim() }
+    : config;
+}
+
 // The config just read from disk with this runtime's still-pending edits laid
 // back on it (the config and skills writers hold the only copy of them).
-function withPendingEdits(loaded, writers) {
+// The agent config load carries no root `outputStyle`: the stored root value
+// (`storedOutputStyle`) is laid on it, and this runtime's pending pick wins.
+function withPendingEdits(loaded, writers, storedOutputStyle) {
   let next = loaded;
   if (writers.hasPendingConfigChanges()) {
     // Preserve only our pending edits. Peer changes and fresh secret overlays
@@ -67,6 +84,9 @@ function withPendingEdits(loaded, writers) {
   if (pendingSkills !== null) {
     next = { ...next, skills: { ...(next.skills || {}), disabled: pendingSkills } };
   }
+  const pendingOutputStyle = writers.pendingOutputStyle();
+  if (pendingOutputStyle !== null) next = configWithOutputStyle(next, pendingOutputStyle);
+  else next = withStoredOutputStyle(next, storedOutputStyle);
   return next;
 }
 
@@ -85,6 +105,7 @@ function withPendingEdits(loaded, writers) {
 export function resolveInitialConfigState({
   initialConfig,
   loadConfig,
+  readStoredOutputStyle = null,
   resolveRoute,
   provider,
   model,
@@ -97,8 +118,12 @@ export function resolveInitialConfigState({
   selectedContextWindow,
   agentOwned = false,
 }) {
+  // An injected config is complete as given; a loaded one takes the stored
+  // root output style (`readStoredOutputStyle`) as every reload does.
   const config = withGrandfatheredBuiltins(
-    initialConfig && typeof initialConfig === 'object' ? initialConfig : loadConfig()
+    initialConfig && typeof initialConfig === 'object'
+      ? initialConfig
+      : withStoredOutputStyle(loadConfig(), readStoredOutputStyle?.())
   );
   // A requested percent replaces a saved token window; requested tokens
   // replace both (resolveRouteContextState lets tokens win).
@@ -135,10 +160,12 @@ export function createConfigLifecycle({
   getConfigHasSecrets,
   setConfigHasSecrets,
   getRoute,
-  // The live session follows the reloaded global compaction settings, unless
-  // the runtime runs on an injected (headless) config.
+  // The live session follows the reloaded global compaction settings.
   getSession,
-  fixedSessionCompaction = false,
+  // A headless caller injects a complete, deliberately isolated config: it
+  // never reloads from disk (no change subscription either), and its sessions
+  // keep the compaction they were created with.
+  injectedConfig = false,
   // Main route sync on reload (both optional: a lifecycle without them never syncs)
   setRouteState,
   resolveRoute,
@@ -153,9 +180,14 @@ export function createConfigLifecycle({
   clean,
   resolve,
   performanceNow = () => performance.now(),
-  onConfigReloaded,
+  // The runtime's change-driven effects (config-change-effects.mjs), given the
+  // diff against the snapshot this runtime last applied.
+  onConfigChanged,
+  // The backoff of a failed effect's retries; the last delay repeats.
+  effectRetryDelaysMs = [1000, 4000, 15000, 60000],
   STANDALONE_DATA_DIR,
 }) {
+  let disposed = false;
   const outputStyleCache = createOutputStyleStatusCache({
     cfgMod,
     STANDALONE_DATA_DIR,
@@ -217,25 +249,125 @@ export function createConfigLifecycle({
   }
 
   // --- reload / ensure --------------------------------------------------------
-  function reloadFullConfig() {
-    // A pending debounced write holds the only copy of the latest change.
-    // Flush it before re-reading from disk so loadConfig() observes (and the
-    // subsequent adopt preserves) that change instead of reverting to a stale
-    // on-disk snapshot.
+  const changeSnapshot = (config) =>
+    configChangeSnapshot({
+      config,
+      root: sharedCfgMod?.readConfig?.(),
+      secretTokens: sharedCfgMod?.secretChangeTokens?.(),
+    });
+  // What this runtime's effects last ran against, starting from the boot
+  // config (the snapshot does not depend on whether a load read secrets).
+  let appliedSnapshot = changeSnapshot(getConfig());
+  // The stored settings the current config object was taken from (never
+  // marked pending): the object is replaced only when they changed, so a
+  // retry of a failed effect alone keeps it.
+  let loadedSnapshot = appliedSnapshot;
+
+  // A pending debounced write holds the only copy of the latest change.
+  // Flush it before re-reading from disk so loadConfig() observes (and the
+  // subsequent adopt preserves) that change instead of reverting to a stale
+  // on-disk snapshot.
+  function loadFullConfig() {
     writers.flushConfigSave();
-    const next = withPendingEdits(cfgMod.loadConfig(), writers);
+    if (injectedConfig) return null;
+    return withPendingEdits(cfgMod.loadConfig(), writers, sharedCfgMod?.readConfig?.()?.outputStyle);
+  }
+
+  function reloadFullConfig() {
+    return adoptFullConfig(loadFullConfig());
+  }
+
+  function adoptFullConfig(next) {
+    if (!next) return getConfig();
     const adopted = adoptConfig(next, { hasSecrets: true });
     configSaveBaseline = structuredClone(adopted);
     leadRoute.syncEmptyMainRoute(adopted);
-    if (!fixedSessionCompaction) syncSessionCompaction(getSession?.(), adopted);
+    syncSessionCompaction(getSession?.(), adopted);
     return adopted;
   }
 
   function ensureFullConfig() {
-    if (getConfigHasSecrets()) return getConfig();
+    if (injectedConfig || getConfigHasSecrets()) return getConfig();
     return reloadFullConfig();
   }
 
+  /** The change step: reload, then run the effects keyed by what differs from
+   *  the last applied snapshot. A writer that runs it right after its own write
+   *  has applied the change, so the notification that follows finds nothing.
+   *  The config object is replaced only when the stored settings changed (a
+   *  retry of a failed effect alone keeps it): consumers key turn-start
+   *  reconciles on its identity. */
+  function applyConfigChange() {
+    // A load that throws changes nothing: pending domains stay pending.
+    const loaded = loadFullConfig();
+    // Every pending domain is in this step's diff, so it runs again here (and
+    // a scheduled retry is this step).
+    pendingDomains = new Set();
+    clearTimeout(retryTimer);
+    retryTimer = null;
+    outputStyleCache.invalidateOutputStyleStatusCache();
+    const next = changeSnapshot(loaded ?? getConfig());
+    const change = diffConfigSnapshots(appliedSnapshot, next);
+    appliedSnapshot = next;
+    const settingsChanged = !configChangeIsEmpty(diffConfigSnapshots(loadedSnapshot, next));
+    loadedSnapshot = next;
+    const config = settingsChanged ? adoptFullConfig(loaded) : getConfig();
+    let outcome;
+    try {
+      outcome = onConfigChanged?.(change, config);
+    } catch {
+      outcome = configChangeDomains(change);
+    }
+    void Promise.resolve(outcome).then(
+      (failedDomains) => settleConfigEffects(failedDomains),
+      () => settleConfigEffects(configChangeDomains(change))
+    );
+    return change;
+  }
+
+  // A domain whose effect failed is marked not applied, so the next change
+  // step (any notification, a writer's own step, or the retry below) runs it
+  // again; the applied snapshot otherwise advances as the step runs, which
+  // keeps a step overlapping an in-flight effect from repeating it. The retry
+  // backs off to the last delay and keeps going until the domain succeeds or
+  // the sync is disposed.
+  let pendingDomains = new Set();
+  let retryTimer = null;
+  let retryAttempt = 0;
+  function settleConfigEffects(failedDomains) {
+    for (const domain of Array.isArray(failedDomains) ? failedDomains : []) {
+      appliedSnapshot = withConfigDomainPending(appliedSnapshot, domain);
+      pendingDomains.add(domain);
+    }
+    if (!pendingDomains.size) {
+      retryAttempt = 0;
+      return;
+    }
+    if (retryTimer || disposed) return;
+    const delay = effectRetryDelaysMs[Math.min(retryAttempt, effectRetryDelaysMs.length - 1)];
+    retryTimer = setTimeout(() => {
+      retryTimer = null;
+      retryAttempt += 1;
+      try {
+        applyConfigChange();
+      } catch {
+        // The reload failed (e.g. a config mid-write): still pending, retry later.
+        settleConfigEffects([]);
+      }
+    }, delay);
+    retryTimer.unref?.();
+  }
+
+  // The output style this runtime selected but has not yet persisted wins over
+  // a status read from disk, so a concurrent write never shows the old style.
+  function getOutputStyleStatusCached(options) {
+    const status = outputStyleCache.getOutputStyleStatusCached(options);
+    const pending = writers.pendingOutputStyle();
+    if (pending === null || status?.configured === pending) return status;
+    const current = (status?.styles || []).find((style) => style.id === pending) || status?.current;
+    return { ...status, configured: pending, current };
+  }
+
   function ensureConfigForRouteProvider() {
     const config = getConfig();
     const providerId = clean(getRoute().provider);
@@ -246,19 +378,22 @@ export function createConfigLifecycle({
     return ensureFullConfig();
   }
 
-  // Settings persisted by any other runtime (or process) reach this runtime's
-  // in-memory config. reloadFullConfig keeps our own pending edits, and the
-  // shared layer coalesces bursts into one pass per subscriber.
-  const unsubscribeConfigChange = sharedCfgMod?.subscribeConfigChange?.(() => {
-    reloadFullConfig();
-    outputStyleCache.invalidateOutputStyleStatusCache();
-    onConfigReloaded?.();
-  });
+  // Settings and secrets persisted by this or any other runtime (or process)
+  // reach this runtime's config and effects. reloadFullConfig keeps our own
+  // pending edits, and the shared layer coalesces bursts into one pass per
+  // subscriber. An injected config never follows the disk.
+  const unsubscribeConfigChange = injectedConfig ? null : sharedCfgMod?.subscribeConfigChange?.(applyConfigChange);
 
   return {
-    disposeConfigSync: () => unsubscribeConfigChange?.(),
+    disposeConfigSync: () => {
+      disposed = true;
+      clearTimeout(retryTimer);
+      retryTimer = null;
+      unsubscribeConfigChange?.();
+    },
     // output-style cache
     ...outputStyleCache,
+    getOutputStyleStatusCached,
     // adopt / save
     adoptConfig,
     saveConfigAndAdopt,
@@ -270,6 +405,7 @@ export function createConfigLifecycle({
     flushAllConfigSavesAsync: writers.flushAllConfigSavesAsync,
     // reload / ensure
     reloadFullConfig,
+    applyConfigChange,
     ensureFullConfig,
     displayConfig: () => getConfig(),
     ensureConfigForRouteProvider,

package/src/session-runtime/connector-merge-migration.mjs

@@ -1,6 +1,6 @@
-// After the multi-account connector merge (connector-catalog.mjs
-// mergeConnectorAccountServers) `gmail-2`, `google-calendar-2`… are accounts of
-// one server, no longer servers. Every store of ours that keys a setting by
+// After the connector merge (connector-catalog.mjs mergeConnectorAccountServers)
+// `gmail-2`, `notion-2`, `postgres-2`… are accounts of their connector's one
+// server, no longer servers. Every store of ours that keys a setting by
 // MCP server name must name the surviving server instead:
 //   agents/<id>/agent.json, bots/<id>/agent.json   connectors.off / connectors.tools
 //                                                  (a legacy allow list too)
@@ -11,14 +11,15 @@
 // name models, not servers.) Project and plugin hook files are the user's or
 // the plugin's own and are never rewritten here.
 //
-// Rule: the merged connector is OFF for an agent/project only when EVERY
-// merged server was off (the same rule as the merged server's `enabled`: one
-// working account keeps the connector usable). Per-tool permissions move to
-// the surviving name; where two merged servers disagree on a tool the MORE
-// PERMISSIVE permission wins, as "on beats off" does at server level. Entries
-// of a server that was off are dormant and are dropped when the connector
-// stays on, so they never become live. A setting that names no merged-away
-// server is never touched, which makes every run after the first a no-op.
+// Rule: differences are ignored and the topmost server decides. The merged
+// connector is on or off for an agent/project as the surviving server was
+// there when the setting names it, else as the lowest-numbered merged server
+// it names (so a switched-off `-N` server never becomes reachable through the
+// merge). Per-tool permissions move to the surviving name; where merged
+// servers disagree on a tool the surviving server's own entry wins, else the
+// first merged server's. Entries of a server that was off are dormant and
+// dropped when the connector stays on. A setting that names no merged-away
+// server is never touched, so every run after the first is a no-op.
 //
 // The merge is saved to the config once, so the rename mapping outlives it:
 // `<data>/connector-merge-pending.json` ({ merged: [{ name, from }] }) is
@@ -35,7 +36,6 @@ import { readdirSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { normalizeRules, standardConfigReport } from './services/hook-bus/config.mjs';
 import {
-  PERMISSION_RANK,
   PROJECT_CONNECTORS_FILE,
   connectorEnabled,
   parseConnectorPolicy,
@@ -56,7 +56,8 @@ function mapMergedConnectorPolicy(policy, merged) {
       current.off.includes(server) || current.allow?.includes(server) || Object.hasOwn(current.tools, server);
     if (!gone.some(named)) continue;
     const live = from.filter((server) => connectorEnabled(current, server));
-    const on = live.length > 0;
+    // `from` lists the surviving server first, then the others lowest-numbered first.
+    const on = connectorEnabled(current, from.find(named));
     const off = current.off.filter((server) => !from.includes(server));
     const allow = current.allow?.filter((server) => !from.includes(server));
     if (allow && on) allow.push(name);
@@ -64,9 +65,11 @@ function mapMergedConnectorPolicy(policy, merged) {
     const tools = { ...current.tools };
     for (const server of from) delete tools[server];
     const moved = {};
-    for (const server of on ? live : from) {
+    const sources = on ? live : from;
+    for (const server of [name, ...sources.filter((id) => id !== name)]) {
+      if (!sources.includes(server)) continue;
       for (const [tool, permission] of Object.entries(current.tools[server] || {})) {
-        if (!(tool in moved) || PERMISSION_RANK[permission] > PERMISSION_RANK[moved[tool]]) moved[tool] = permission;
+        if (!(tool in moved)) moved[tool] = permission;
       }
     }
     if (Object.keys(moved).length) tools[name] = moved;