mixdog 1.4.2 → 1.4.3

package/src/session-runtime/boot/providers.mjs

@@ -31,13 +31,27 @@ import {
 } from '../model-recency.mjs';
 import { createNativeWebSearch } from '../native-web-search.mjs';
 import { createConfigLifecycle } from '../config-lifecycle.mjs';
+import { createConfigChangeEffects, SETTINGS_CHANGED_SETUP_ACTION } from '../config-change-effects.mjs';
+import { resetProviderAdmissionCooldowns } from '../../runtime/agent/orchestrator/providers/admission-scheduler.mjs';
 import { usesInjectedConfig } from '../session-compaction-sync.mjs';
 import { createQuickModelRows } from '../quick-model-rows.mjs';
 import { createProviderModels } from '../provider-models.mjs';
 import { createProviderUsage } from '../provider-usage.mjs';
 import { bootProfile } from '../boot-profile.mjs';
 import { standaloneDataDir } from '../runtime-paths.mjs';
-import { outputStyleStatus, resolveRoute, webSearchCapableFor } from './shared.mjs';
+import { noteCacheWarmingEnabled } from '../../runtime/agent/orchestrator/session/cache-warm.mjs';
+import { refreshLiveSessionsProviderCacheOpts } from '../../runtime/agent/orchestrator/session/manager/session-lifecycle.mjs';
+import { publishStoredAgentRoute } from '../agent-profile-changes.mjs';
+import {
+  ensureConnectorAccountIds,
+  forgetConversationConnectorAccounts,
+} from '../../runtime/connectors/connector-accounts-mcp.mjs';
+import { registerSessionPurgeHook } from '../../runtime/agent/orchestrator/session/store/session-observers.mjs';
+import { effectiveAgentRoute } from '../workflow-agents-api/shared.mjs';
+import { agentRouteFromConfig, outputStyleStatus, resolveRoute, webSearchCapableFor } from './shared.mjs';
+
+// A conversation's connector accounts go with its session (once per process).
+registerSessionPurgeHook((sessionId) => forgetConversationConnectorAccounts(sessionId));
 
 export function wireProviders(boot) {
   wireConfigLifecycle(boot);
@@ -52,6 +66,17 @@ export function wireProviders(boot) {
 // injection.
 function wireConfigLifecycle(boot) {
   const { rt, cfgMod, sharedCfgMod } = boot;
+  // Every stored connector account gets its identity (an injected config is
+  // not the stored one). True when the stored config changed.
+  boot.ensureConnectorAccountIds = () => {
+    if (usesInjectedConfig(boot.params)) return false;
+    try {
+      return ensureConnectorAccountIds();
+    } catch (error) {
+      console.warn(`[connectors] giving accounts their identity failed: ${error?.message || error}`);
+      return false;
+    }
+  };
   const lifecycle = createConfigLifecycle({
     getConfig: () => rt.config,
     setConfig: (next) => {
@@ -68,7 +93,7 @@ function wireConfigLifecycle(boot) {
     },
     getRoute: () => rt.route,
     getSession: () => rt.session,
-    fixedSessionCompaction: usesInjectedConfig(boot.params),
+    injectedConfig: usesInjectedConfig(boot.params),
     setRouteState: (next) => {
       rt.route = next;
     },
@@ -82,7 +107,47 @@ function wireConfigLifecycle(boot) {
     LAZY_SECRET_PROVIDERS,
     clean,
     resolve,
-    onConfigReloaded: () => boot.invalidateContextStatusCache?.(),
+    // Late-bound: the effect targets (notification bus, MCP connect, context
+    // status) are wired by later boot stages.
+    onConfigChanged: createConfigChangeEffects({
+      invalidateContextStatusCache: () => boot.invalidateContextStatusCache?.(),
+      reinitProviders: () => boot.reinitProviders(),
+      releaseAdmissionCooldowns: resetProviderAdmissionCooldowns,
+      // Fails (so the change step retries it) when a server failed to connect
+      // (other than needing a sign-in, which waits on the user) or the
+      // identities failed; the servers reconcile either way.
+      reconcileMcp: async () => {
+        // An account written by hand gets its identity; that write is one
+        // more change, reconciled in turn.
+        let idsError = null;
+        if (!usesInjectedConfig(boot.params)) {
+          try {
+            ensureConnectorAccountIds();
+          } catch (error) {
+            idsError = error;
+          }
+        }
+        const status = await boot.connectConfiguredMcp?.({ reconcile: true });
+        if (idsError) throw idsError;
+        const failed = (status?.servers || []).filter((row) => row.enabled !== false && row.status === 'failed');
+        if (failed.length) {
+          throw new Error(
+            `MCP servers failed to connect: ${failed.map((row) => `${row.name} (${row.error})`).join(', ')}`
+          );
+        }
+      },
+      noteCacheWarmingEnabled,
+      refreshLiveSessionsCacheOpts: (config) => refreshLiveSessionsProviderCacheOpts(config),
+      // A bot whose stored route was cleared follows Main.
+      publishAgentRoute: (id, config) =>
+        publishStoredAgentRoute(id, effectiveAgentRoute({ agentRouteFromConfig, resolveRoute }, config, id)),
+      // Attached surfaces (TUI, desktop session lanes) re-read open settings.
+      announceSettingsChange: () =>
+        boot.emitRuntimeNotification?.('Settings changed', {
+          kind: 'setup-changed',
+          action: SETTINGS_CHANGED_SETUP_ACTION,
+        }),
+    }),
     STANDALONE_DATA_DIR: standaloneDataDir(),
   });
   const {
@@ -98,11 +163,13 @@ function wireConfigLifecycle(boot) {
     scheduleOutputStyleSave,
     flushAllConfigSavesAsync,
     reloadFullConfig,
+    applyConfigChange,
     ensureFullConfig,
     displayConfig,
     ensureConfigForRouteProvider,
   } = lifecycle;
   Object.assign(boot, {
+    applyConfigChange,
     disposeConfigSync,
     getOutputStyleStatusCached,
     invalidateOutputStyleStatusCache,

package/src/session-runtime/boot/session.mjs

@@ -51,6 +51,8 @@ export function wireSessionLifecycle(boot) {
     schemaAllowedTools: modelToolSchemaAllowlist(rt.toolProfile),
     featureDisallowedTools: boot.featureDisallowedTools,
     applyPreSessionToolSelection: boot.applyPreSessionToolSelection,
+    // Late-bound: the tool policy refresh is wired with the API slices.
+    noteToolAvailability: (session, coreMemory) => boot.noteToolAvailability?.(session, coreMemory),
     statusRoutes: boot.statusRoutes,
     warmupTimers: boot.warmupTimers,
     providerModelCaches: boot.providerModelCaches,

package/src/session-runtime/boot/tools.mjs

@@ -41,6 +41,7 @@ import {
 } from '../../runtime/agent/orchestrator/runtime-core/context-status.mjs';
 import { createInternalToolExecutor } from '../internal-tool-executor.mjs';
 import { registerWorktreeToolHost } from '../../runtime/shared/worktrees/tool-host.mjs';
+import { registerLiveFeatureGates } from '../../runtime/agent/orchestrator/runtime-core/tool-availability.mjs';
 import { createWorktreeToolHost } from '../workspace/worktree-tool.mjs';
 import { STANDALONE_ROOT, standaloneDataDir } from '../runtime-paths.mjs';
 import { dataDirOf, workflowHelpers } from './shared.mjs';
@@ -61,8 +62,14 @@ export function wireTools(boot) {
       })
     )
     .catch((error) => bootProfile('mcp:failed', { error: error?.message || String(error) }));
+  // A lost reload leaves the old timers armed; the scheduler re-reads each
+  // schedule before it fires (scheduler.mjs fireTimed), so it is only reported.
   boot.reloadChannelsSoon = () => {
-    boot.channels.execute('reload_config', {}).catch(() => {});
+    boot.channels
+      .execute('reload_config', {})
+      .catch((error) =>
+        process.stderr.write(`[channels] schedule reload failed: ${error?.message || String(error)}\n`)
+      );
   };
 }
 
@@ -183,23 +190,29 @@ function wireToolSurface(boot) {
     skillToolEnabled: !envFlag('MIXDOG_DISABLE_SKILLS'),
   });
   bootProfile('tools:ready', { ms: (performance.now() - toolsStartedAt).toFixed(1), count: standaloneTools.length });
-  const { modelStandaloneTools, invalidatePreSessionToolSurface, activeToolSurface, applyPreSessionToolSelection } =
-    createToolSurface({
-      mgr,
-      mode: rt.mode,
-      standaloneTools,
-      agentToolNames,
-      getSession: () => rt.session,
-      getRoute: () => rt.route,
-      getConfig: () => rt.config,
-      getToolProfile: () => rt.toolProfile,
-      getMcpScopeId: () => rt.mcpScopeId,
-      getCurrentCwd: () => rt.currentCwd,
-      cfgMod,
-      delegatableAgentIds: workflowHelpers.delegatableAgentIds,
-      dataDir: standaloneDataDir(),
-      getFeatureDisallowedTools: featureDisallowedTools,
-    });
+  const {
+    modelStandaloneTools,
+    invalidatePreSessionToolSurface,
+    activeToolSurface,
+    applyPreSessionToolSelection,
+    toolDefinitionsFor,
+    surfaceGeneration,
+  } = createToolSurface({
+    mgr,
+    mode: rt.mode,
+    standaloneTools,
+    agentToolNames,
+    getSession: () => rt.session,
+    getRoute: () => rt.route,
+    getConfig: () => rt.config,
+    getToolProfile: () => rt.toolProfile,
+    getMcpScopeId: () => rt.mcpScopeId,
+    getCurrentCwd: () => rt.currentCwd,
+    cfgMod,
+    delegatableAgentIds: workflowHelpers.delegatableAgentIds,
+    dataDir: standaloneDataDir(),
+    getFeatureDisallowedTools: featureDisallowedTools,
+  });
   Object.assign(boot, {
     standaloneTools,
     internalToolDefs,
@@ -208,10 +221,15 @@ function wireToolSurface(boot) {
     invalidatePreSessionToolSurface,
     activeToolSurface,
     applyPreSessionToolSelection,
+    toolDefinitionsFor,
+    surfaceGeneration,
   });
 }
 
-function wireContextStatus(boot) {
+/** The setup-changed action of a context status an empty session's reconcile moved. */
+export const CONTEXT_STATUS_REFRESHED_ACTION = 'context_status_refreshed';
+
+export function wireContextStatus(boot) {
   const { rt } = boot;
   const { contextStatus: computeContextStatus, invalidateContextStatusCache } = createContextStatus({
     getSession: () => rt.session,
@@ -221,7 +239,33 @@ function wireContextStatus(boot) {
     getMode: () => rt.mode,
   });
   Object.assign(boot, {
-    computeContextStatus,
+    // The synchronous accessor (the local TUI): an empty session whose
+    // settings gates moved starts the shared turn-start reconcile
+    // (late-bound); when it rebuilt anything the cache is dropped and the
+    // attached surfaces are told to read again.
+    computeContextStatus: (...args) => {
+      if (boot.emptySessionStale?.()) {
+        boot
+          .reconcileEmptySession()
+          .then((result) => {
+            if (!result) return;
+            invalidateContextStatusCache();
+            boot.emitRuntimeNotification?.('Context status refreshed', {
+              kind: 'setup-changed',
+              action: CONTEXT_STATUS_REFRESHED_ACTION,
+            });
+          })
+          .catch(() => {});
+      }
+      return computeContextStatus(...args);
+    },
+    // Async boundaries (desktop, remote, IPC) wait for the same reconcile.
+    computeContextStatusSettled: async (...args) => {
+      if (boot.emptySessionStale?.()) {
+        if (await boot.reconcileEmptySession()) invalidateContextStatusCache();
+      }
+      return computeContextStatus(...args);
+    },
     invalidateContextStatusCache,
     computeContextStatusForSession: (session) =>
       contextStatusForSession(session, {
@@ -255,11 +299,7 @@ function wireInternalTools(boot) {
       goalRuntime: boot.goalRuntime,
       agentTool: boot.routedAgentTool,
       setupTool,
-      webSearchEnabled: boot.webSearchEnabled,
-      memoryToolsEnabled: boot.memoryToolsEnabledFn,
-      officeToolsEnabled: boot.officeToolsEnabledFn,
-      mediaToolEnabled: boot.mediaToolEnabledFn,
-      tidyToolEnabled: boot.tidyToolEnabledFn,
+      featureDisallowedTools: boot.featureDisallowedTools,
       getWebSearchModule: boot.getWebSearchModule,
       getMemoryModule: boot.getMemoryModule,
       getCodeGraphModule: boot.getCodeGraphModule,
@@ -288,9 +328,13 @@ function wireInternalTools(boot) {
       executeSessionControl: boot.params.executeSessionControl || null,
     }).run,
   });
+  // Dispatch refuses a model call of a tool a setting turned off from this
+  // runtime's live gates (a turn already running when it changed included).
+  const disposeLiveGates = registerLiveFeatureGates(rt.mcpScopeId, boot.featureDisallowedTools);
   Object.assign(boot, {
     setupTool,
     disposeInternalTools: () => {
+      disposeLiveGates();
       disposeWorktreeToolHost();
       // Its turn snapshot cleanups stop with the runtime (maintenance finishes them).
       boot.workspaceApi?.dispose();

package/src/session-runtime/channel-config-api.mjs

@@ -167,6 +167,7 @@ export function createChannelConfigApi({ channels, reloadChannelsSoon, ensureAut
         {
           name: endpoint.name,
           ownerAgentId: endpoint.ownerAgentId,
+          executorAgentId: endpoint.executorAgentId || null,
           cwd: endpoint.cwd || null,
           attachments: endpoint.attachments || null,
           event: webhookEventSummary(payload.headers ?? {}, payload.body ?? {}),

package/src/session-runtime/config-change-effects.mjs

@@ -0,0 +1,179 @@
+// The change-driven effect step of one runtime. Every persisted change (a
+// config write or a keychain write, by this runtime, another runtime, another
+// process or a hand edit) reaches each subscribing runtime as one
+// notification; the runtime reloads, compares the result with the snapshot it
+// last applied, and runs only the effects keyed by what changed. The writer
+// takes the same step, so no effect depends on which process wrote.
+
+/** The setup-changed action announcing a settings change this runtime applied. */
+export const SETTINGS_CHANGED_SETUP_ACTION = 'settings_changed';
+
+// Provider credentials: `agent.<id>.apiKey` and a custom provider's extra keys
+// `agent.<id>.apiKey.<keyId>` (custom-provider-keys.mjs).
+// A deletion (config.mjs `#deleted`) may remove a secret the marker never
+// listed (stored before it existed), so it counts for providers and MCP alike.
+const PROVIDER_SECRET_ACCOUNT = /^(agent\.[^.]+\.apiKey(\.|$)|#deleted$)/;
+// What an MCP connection depends on beside its config: OAuth sign-ins and
+// client secrets, Gmail app passwords, and the plugin registry (plugin
+// servers). Token refreshes are not announced (oauth-credentials.mjs).
+const MCP_STATE_ACCOUNT = /^(mcp-oauth\.|mcp-oauth-client\.|gmail-app-password\.|#plugins$|#deleted$)/;
+
+// Secret values are compared through their change tokens, never by value.
+function tokensSignature(tokens, filter = () => true) {
+  const entries = Object.entries(tokens && typeof tokens === 'object' ? tokens : {});
+  return JSON.stringify(entries.filter(([account]) => filter(account)).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+/** What a runtime last applied: the persisted root (the desktop section has
+ *  its own owners), the applied secret change tokens and the effective MCP
+ *  servers. Provider and settings changes are judged on the stored state, not
+ *  the effective provider entries: those depend on whether a load read secrets
+ *  and ran credential probes (boot loads without), so the boot config is an
+ *  exact first baseline. MCP servers load the same either way. */
+export function configChangeSnapshot({ config, root, secretTokens }) {
+  const { desktop: _desktop, ...settingsRoot } = root && typeof root === 'object' ? root : {};
+  const agents = config?.agents && typeof config.agents === 'object' ? config.agents : {};
+  return {
+    providers: JSON.stringify([
+      settingsRoot.agent?.providers ?? null,
+      // Developer provider options (e.g. cursorOAuth) shape provider clients.
+      config?.developer ?? null,
+      tokensSignature(secretTokens, (account) => PROVIDER_SECRET_ACCOUNT.test(account)),
+    ]),
+    cacheWarming: config?.promptCacheWarming === true,
+    autoClear: JSON.stringify(config?.autoClear ?? null),
+    agentRoutes: Object.fromEntries(Object.entries(agents).map(([id, route]) => [id, JSON.stringify(route ?? null)])),
+    mcp: JSON.stringify([
+      config?.mcpServers ?? null,
+      config?.pluginMcp ?? null,
+      tokensSignature(secretTokens, (account) => MCP_STATE_ACCOUNT.test(account)),
+    ]),
+    settings: JSON.stringify([settingsRoot, tokensSignature(secretTokens)]),
+  };
+}
+
+export function diffConfigSnapshots(before, after) {
+  const routes = new Set([...Object.keys(before.agentRoutes || {}), ...Object.keys(after.agentRoutes || {})]);
+  return {
+    providers: before.providers !== after.providers,
+    mcp: before.mcp !== after.mcp,
+    settings: before.settings !== after.settings,
+    // The new value when it changed, else null.
+    cacheWarming: before.cacheWarming !== after.cacheWarming ? after.cacheWarming : null,
+    autoClear: before.autoClear !== after.autoClear,
+    // Bots whose stored route was set, changed or cleared.
+    agentRoutes: [...routes].filter((id) => before.agentRoutes?.[id] !== after.agentRoutes?.[id]).sort(),
+  };
+}
+
+/** Whether a diff found nothing changed. */
+export function configChangeIsEmpty(change) {
+  return (
+    !change.providers &&
+    !change.mcp &&
+    !change.settings &&
+    change.cacheWarming === null &&
+    !change.autoClear &&
+    !change.agentRoutes.length
+  );
+}
+
+// A domain whose effect failed: it differs from every snapshot value, so the
+// next diff carries the domain again and its effect is retried.
+const PENDING = Symbol('pending');
+
+/** The effect domains a diff carries (`agentRoutes:<id>` per bot). */
+export function configChangeDomains(change) {
+  return [
+    ...['providers', 'mcp', 'autoClear', 'settings'].filter((domain) => change[domain]),
+    ...(change.cacheWarming !== null && change.cacheWarming !== undefined ? ['cacheWarming'] : []),
+    ...(change.agentRoutes || []).map((id) => `agentRoutes:${id}`),
+  ];
+}
+
+/** `snapshot` with `domain` marked not applied. */
+export function withConfigDomainPending(snapshot, domain) {
+  if (domain.startsWith('agentRoutes:')) {
+    const id = domain.slice('agentRoutes:'.length);
+    return { ...snapshot, agentRoutes: { ...snapshot.agentRoutes, [id]: PENDING } };
+  }
+  return { ...snapshot, [domain]: PENDING };
+}
+
+/** The effects themselves, keyed by the diff. `change` may be all-false (a
+ *  rewrite of identical content): only the always-on invalidation runs.
+ *  `config` is the reloaded effective config the diff was taken against.
+ *  Answers a promise of the domains whose effect failed. One domain's effects
+ *  never overlap: a later one starts once the earlier settled (it runs at
+ *  once when none is in flight), so the latest change is applied last. */
+export function createConfigChangeEffects({
+  invalidateContextStatusCache,
+  reinitProviders,
+  releaseAdmissionCooldowns,
+  reconcileMcp,
+  announceSettingsChange,
+  noteCacheWarmingEnabled = () => {},
+  refreshLiveSessionsCacheOpts = () => {},
+  publishAgentRoute = () => {},
+}) {
+  const inFlight = new Map();
+  // domain → the failure last warned about: a retry failing the same way is
+  // not warned about again until the domain recovers.
+  const warned = new Map();
+  function run(domain, effect) {
+    const attempt = () => {
+      try {
+        return Promise.resolve(effect()).then(
+          () => {
+            warned.delete(domain);
+            return null;
+          },
+          (error) => failed(domain, error)
+        );
+      } catch (error) {
+        return Promise.resolve(failed(domain, error));
+      }
+    };
+    const prior = inFlight.get(domain);
+    const done = prior ? prior.then(attempt) : attempt();
+    inFlight.set(domain, done);
+    void done.then(() => {
+      if (inFlight.get(domain) === done) inFlight.delete(domain);
+    });
+    return done;
+  }
+  function failed(domain, error) {
+    const message = error?.message || String(error);
+    if (warned.get(domain) !== message) {
+      warned.set(domain, message);
+      console.warn(`[config] applying the ${domain} change failed: ${message}`);
+    }
+    return domain;
+  }
+
+  return function applyConfigChangeEffects(change, config) {
+    invalidateContextStatusCache();
+    const runs = [];
+    if (change.providers) {
+      // Cooldowns and initialized clients belong to the old credentials.
+      runs.push(
+        run('providers', () => {
+          releaseAdmissionCooldowns();
+          return reinitProviders();
+        })
+      );
+    }
+    if (change.mcp) runs.push(run('mcp', reconcileMcp));
+    // Every session of this process warms (or stops warming, armed chains
+    // included) as the setting now says.
+    if (change.cacheWarming !== null && change.cacheWarming !== undefined) {
+      runs.push(run('cacheWarming', () => noteCacheWarmingEnabled(change.cacheWarming)));
+    }
+    // Live sessions take the new idle window as their cache lifetime.
+    if (change.autoClear) runs.push(run('autoClear', () => refreshLiveSessionsCacheOpts(config)));
+    // The bots' chats this process hosts move onto their new routes.
+    for (const id of change.agentRoutes || []) runs.push(run(`agentRoutes:${id}`, () => publishAgentRoute(id, config)));
+    if (change.settings) runs.push(run('settings', announceSettingsChange));
+    return Promise.all(runs).then((results) => results.filter(Boolean));
+  };
+}

package/src/session-runtime/config-lifecycle/config-writers.mjs

@@ -150,5 +150,6 @@ export function createConfigWriters({ cfgMod, sharedCfgMod }) {
     hasPendingConfigChanges: () => configWriter.hasPending(),
     pendingConfigChanges: () => pendingConfigChanges,
     pendingSkills: () => skillsWriter.getPending(),
+    pendingOutputStyle: () => outputStyleWriter.getPending(),
   };
 }