@alphacoder-v0/pi-loops 0.22.8 → 0.24.1

package/src/sdk-runner.ts

@@ -16,6 +16,8 @@ import { realpathish } from "./paths.ts";
 import { previewRedacted } from "./redact.ts";
 import { type ParentRuntimeFlags, type RunnerResult, type SubagentRequest, type SubagentRunner, failedRun } from "./runner.ts";
 import { subagentGuardExtension } from "./subagent-guard.ts";
+import { PI_BUILTIN_TOOL_NAMES } from "./mcp.ts";
+import { projectNeedsTrust } from "./trust.ts";
 
 export interface InProcessRunnerDeps {
 	agentDir: string;
@@ -35,6 +37,8 @@ export interface InProcessRunnerDeps {
 	 * pi falls back to its four-tool default, which both drops what the session has (grep, find,
 	 * web_fetch…) and keeps what the session took away (`-xt`).
 	 */
+	/** A warning about a project's runs that a window of that project should show (the host's notices). */
+	notice?: (text: string, cwd: string) => void;
 	getParentTools?: () => string[] | undefined;
 	getParentThinking: () => string | undefined;
 	/** The parent's live tools for this run: every MCP server's tools plus the automation tools at hop 1. */
@@ -129,8 +133,19 @@ export interface SubSessionResources {
 	trusted: boolean;
 }
 
-/** One loaded extension set per (cwd, trust, agent dir, parent flags). */
-const loadedResources = new Map<string, Promise<SubSessionResources>>();
+/**
+ * One loaded extension set per (cwd, trust, agent dir, parent flags), with the runs using it. A set
+ * replaced while a run still uses it shuts down when that run ends: shutting it at once closed the
+ * running loop's MCP connections under it, whenever a `/model` anywhere rewrote settings.json.
+ */
+interface SharedEntry {
+	loading: Promise<SubSessionResources>;
+	inUse: number;
+	lastUsed: number;
+	outdated: boolean;
+	cwd: string;
+}
+const loadedResources = new Map<string, SharedEntry>();
 /** Projects we have already said are untrusted: say it once, not once per run. */
 const untrustedWarned = new Set<string>();
 
@@ -147,31 +162,229 @@ const untrustedWarned = new Set<string>();
  * The trust decision is part of the key, so a loader built for a trusted project can never be
  * handed to an untrusted cwd.
  */
-export async function sharedSubSessionResources(req: Pick<SubagentRequest, "cwd">, deps: Pick<InProcessRunnerDeps, "agentDir" | "parentFlags" | "isTrusted" | "ownDir" | "log" | "allowCommands">): Promise<SubSessionResources> {
+/** The key each cwd's set was last loaded under, so an outdated set is dropped rather than kept. */
+const loadedKeyFor = new Map<string, string>();
+
+/**
+ * What a sub-session's resources are read from, as modification times: the project's and pi's
+ * AGENTS.md and settings, and their skills, extensions and prompts (each skill's SKILL.md too, whose
+ * edit does not touch its directory). A missing file counts as 0.
+ */
+export function resourceStamp(cwd: string, agentDir: string): string {
+	const at = (file: string): number => {
+		try {
+			return fs.statSync(file).mtimeMs;
+		} catch {
+			return 0; // not there: as good an answer as a time
+		}
+	};
+	const files: string[] = [];
+	for (const root of [cwd, path.join(cwd, ".pi"), agentDir]) files.push(path.join(root, "AGENTS.md"), path.join(root, "CLAUDE.md"), path.join(root, "settings.json"));
+	for (const dirName of [path.join(cwd, ".pi", "skills"), path.join(cwd, ".agents", "skills"), path.join(agentDir, "skills"), path.join(cwd, ".pi", "extensions"), path.join(agentDir, "extensions"), path.join(cwd, ".pi", "prompts"), path.join(agentDir, "prompts")]) {
+		files.push(dirName);
+		let entries: string[] = [];
+		try {
+			entries = fs.readdirSync(dirName);
+		} catch {
+			continue; // no such directory
+		}
+		for (const e of entries) files.push(path.join(dirName, e), path.join(dirName, e, "SKILL.md"));
+	}
+	return files.map(at).join(",");
+}
+
+export async function sharedSubSessionResources(req: Pick<SubagentRequest, "cwd">, deps: Pick<InProcessRunnerDeps, "agentDir" | "parentFlags" | "isTrusted" | "ownDir" | "log" | "notice" | "allowCommands">): Promise<{ resources: SubSessionResources; done: () => void }> {
+	// Loops and checks: saved trust for this exact directory only. A held turn's owner trust goes to its own loader.
 	const trusted = deps.isTrusted(req.cwd);
 	// Worth saying out loud once per project: pi's trust prompt offers "trust the parent folder",
 	// which records the parent and deletes the child entry, and "this session only", which records
 	// nothing — so a run can silently lose the project's AGENTS.md, skills, extensions and settings.
-	if (!trusted && !untrustedWarned.has(req.cwd)) {
+	if (!trusted && !untrustedWarned.has(req.cwd) && projectNeedsTrust(req.cwd)) {
 		untrustedWarned.add(req.cwd);
-		deps.log?.(`${req.cwd} is not trusted, so runs there get no project settings, skills or extensions (open pi in that directory and run /trust to change it)`);
+		const message = `${req.cwd} is not trusted, so runs there get no project settings, skills or extensions (open pi in that directory and run /trust to change it)`;
+		deps.log?.(message);
+		deps.notice?.(message, req.cwd);
+	}
+	// The files the set was loaded from, by modification time: a background process lives for days,
+	// and an AGENTS.md or a skill edited meanwhile must reach the next run, as a new window's would.
+	const key = JSON.stringify([req.cwd, trusted, deps.agentDir, deps.ownDir, deps.parentFlags, resourceStamp(req.cwd, deps.agentDir)]);
+	// Per directory and trust: a trusted and an untrusted run in one directory do not evict each other.
+	const slot = JSON.stringify([req.cwd, trusted]);
+	const before = loadedKeyFor.get(slot);
+	if (before !== undefined && before !== key) {
+		// Its extensions get their session_shutdown, or each edit would leave a live copy behind; once
+		// the runs using it have ended.
+		const outdated = loadedResources.get(before);
+		loadedResources.delete(before);
+		if (outdated) {
+			outdated.outdated = true;
+			if (outdated.inUse === 0) shutdownShared(outdated, deps);
+		}
 	}
-	const key = JSON.stringify([req.cwd, trusted, deps.agentDir, deps.ownDir, deps.parentFlags]);
-	let loading = loadedResources.get(key);
-	if (!loading) {
-		loading = (async () => {
+	loadedKeyFor.set(slot, key);
+	let entry = loadedResources.get(key);
+	if (!entry) {
+		const loading = (async () => {
 			const resources = subSessionResources(req, { ...deps, isTrusted: () => trusted });
 			await resources.loader.reload();
 			// Once per load, not once per run: the errors are a property of the extension set.
-			for (const e of resources.loader.getExtensions().errors) deps.log?.(`sub-agent extension ${e.path}: ${e.error}`);
+			for (const e of resources.loader.getExtensions().errors) {
+				deps.log?.(`sub-agent extension ${e.path}: ${e.error}`);
+				deps.notice?.(`a loop's extension ${e.path} did not load: ${e.error}`, req.cwd);
+			}
+			return resources;
+		})();
+		const created: SharedEntry = { loading, inUse: 0, lastUsed: Date.now(), outdated: false, cwd: req.cwd };
+		loading.catch(() => {
+			if (loadedResources.get(key) === created) loadedResources.delete(key); // a failed load (a package install, say) must not be cached
+		});
+		loadedResources.set(key, created);
+		entry = created;
+	}
+	const shared = entry;
+	shared.inUse++;
+	let returned = false;
+	const done = () => {
+		if (returned) return;
+		returned = true;
+		shared.inUse = Math.max(0, shared.inUse - 1);
+		shared.lastUsed = Date.now();
+		if (shared.outdated && shared.inUse === 0) shutdownShared(shared, deps);
+	};
+	try {
+		return { resources: await shared.loading, done };
+	} catch (err) {
+		done();
+		throw err;
+	}
+}
+
+function shutdownShared(entry: SharedEntry, deps: Pick<InProcessRunnerDeps, "agentDir" | "log">): void {
+	entry.loading.then((r) => shutdownResources(r, entry.cwd, deps)).catch((err: any) => deps.log?.(`outdated resources in ${entry.cwd}: ${err?.message ?? err}`));
+}
+
+/**
+ * Release the loops' shared sets that no run has used for `idleMs`. The background process lives for
+ * weeks, and a project whose loops were removed kept its extensions' timers and sockets until then.
+ * Returns how many were released.
+ */
+export function releaseSharedResources(deps: Pick<InProcessRunnerDeps, "agentDir" | "log">, opts: { now?: number; idleMs?: number } = {}): number {
+	const now = opts.now ?? Date.now();
+	const idleMs = opts.idleMs ?? HELD_IDLE_MS;
+	let released = 0;
+	for (const [key, entry] of [...loadedResources]) {
+		if (entry.inUse > 0 || now - entry.lastUsed < idleMs) continue;
+		loadedResources.delete(key);
+		for (const [slot, k] of loadedKeyFor) if (k === key) loadedKeyFor.delete(slot);
+		shutdownShared(entry, deps);
+		released++;
+	}
+	return released;
+}
+
+/** A conversation's held-turn resources are released after this long without a turn. */
+export const HELD_IDLE_MS = 60 * 60 * 1000;
+/** At most this many conversations keep their held-turn resources at once. */
+export const HELD_RESOURCES_MAX = 8;
+/** How long a release may take to send `session_shutdown` before it gives up waiting. */
+const HELD_SHUTDOWN_MS = 10_000;
+
+interface HeldEntry {
+	loading: Promise<SubSessionResources>;
+	lastUsed: number;
+	inUse: number;
+	release: () => Promise<void>;
+}
+const heldResources = new Map<string, HeldEntry>();
+
+/**
+ * A held turn's resources, loaded once per conversation and kept for that conversation's later
+ * turns, rather than once per turn.
+ * Loading per turn re-ran every extension factory each time and never shut the instances down, so
+ * the long-lived host gained a set of timers, sockets and listeners per turn. One set per
+ * conversation, not per cwd: a `pi.*` action from an extension between turns can then only reach
+ * another turn of the same conversation, never a loop's throwaway session or someone else's chat.
+ * Released after an hour idle, past `HELD_RESOURCES_MAX`, and when the host stops.
+ */
+export async function heldSubSessionResources(req: Pick<SubagentRequest, "cwd" | "sessionFile" | "trusted">, deps: Pick<InProcessRunnerDeps, "agentDir" | "parentFlags" | "isTrusted" | "ownDir" | "log" | "allowCommands">): Promise<{ resources: SubSessionResources; done: () => void }> {
+	const trusted = !!req.trusted || deps.isTrusted(req.cwd);
+	const key = JSON.stringify([req.sessionFile, req.cwd, trusted, deps.agentDir, deps.ownDir, deps.parentFlags]);
+	let entry = heldResources.get(key);
+	if (!entry) {
+		await releaseHeldResources({ keep: HELD_RESOURCES_MAX - 1 });
+		const loading = (async () => {
+			const resources = subSessionResources(req, { ...deps, isTrusted: () => trusted });
+			await resources.loader.reload();
+			for (const e of resources.loader.getExtensions().errors) deps.log?.(`held-turn extension ${e.path}: ${e.error}`);
 			return resources;
-		})().catch((err) => {
-			loadedResources.delete(key); // a failed load (a package install, say) must not be cached
-			throw err;
+		})();
+		const created: HeldEntry = { loading, lastUsed: Date.now(), inUse: 0, release: async () => shutdownResources(await loading.catch(() => undefined), req.cwd, deps) };
+		heldResources.set(key, created);
+		loading.catch(() => {
+			if (heldResources.get(key) === created) heldResources.delete(key); // a failed load is not cached
 		});
-		loadedResources.set(key, loading);
+		entry = created;
+	}
+	const held = entry;
+	held.inUse++;
+	const done = () => {
+		held.inUse = Math.max(0, held.inUse - 1);
+		held.lastUsed = Date.now();
+	};
+	try {
+		return { resources: await held.loading, done };
+	} catch (err) {
+		done();
+		throw err;
+	}
+}
+
+/**
+ * Release cached held-turn resources that no turn is using: those idle for `idleMs`, then the least
+ * recently used until at most `keep` remain. `{ idleMs: 0, keep: 0 }` releases everything idle (the
+ * host stopping). Returns how many were released.
+ */
+export async function releaseHeldResources(opts: { now?: number; idleMs?: number; keep?: number } = {}): Promise<number> {
+	const now = opts.now ?? Date.now();
+	const idleMs = opts.idleMs ?? HELD_IDLE_MS;
+	const keep = opts.keep ?? HELD_RESOURCES_MAX;
+	const idle = [...heldResources.entries()].filter(([, e]) => e.inUse === 0).sort((a, b) => a[1].lastUsed - b[1].lastUsed);
+	const victims = idle.filter(([, e]) => now - e.lastUsed >= idleMs);
+	for (const candidate of idle) {
+		if (heldResources.size - victims.length <= keep) break;
+		if (!victims.includes(candidate)) victims.push(candidate);
+	}
+	for (const [key] of victims) heldResources.delete(key);
+	// In parallel: each release is bounded on its own, and the host stopping waits on all of them.
+	await Promise.all(victims.map(([, e]) => e.release()));
+	return victims.length;
+}
+
+/**
+ * Tell a released set's extensions to shut down, then drop it: a throwaway in-memory session built on
+ * that set sends `session_shutdown`, and is disposed whatever happens. Bounded, because an extension
+ * that never answers must not hold up the host.
+ */
+async function shutdownResources(resources: SubSessionResources | undefined, cwd: string, deps: Pick<InProcessRunnerDeps, "agentDir" | "log">): Promise<void> {
+	if (!resources) return;
+	let session: { extensionRunner: { emit(event: { type: "session_shutdown"; reason: "quit" }): Promise<unknown> }; dispose(): void } | undefined;
+	let timer: NodeJS.Timeout | undefined;
+	const deadline = new Promise<"timeout">((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), HELD_SHUTDOWN_MS);
+		timer.unref();
+	});
+	try {
+		const created = await Promise.race([createAgentSession({ cwd, agentDir: deps.agentDir, resourceLoader: resources.loader, settingsManager: resources.settingsManager, sessionManager: SessionManager.inMemory(cwd) }), deadline]);
+		if (created === "timeout") return;
+		session = created.session as unknown as typeof session;
+		const sent = await Promise.race([session!.extensionRunner.emit({ type: "session_shutdown", reason: "quit" }), deadline]);
+		if (sent === "timeout") deps.log?.(`held-turn extensions in ${cwd} did not finish session_shutdown within ${HELD_SHUTDOWN_MS / 1000}s`);
+	} catch (err: any) {
+		deps.log?.(`held-turn extensions in ${cwd}: shutdown failed: ${err?.message ?? err}`);
+	} finally {
+		if (timer) clearTimeout(timer);
+		if (session) disposeSubSession(session, deps.log);
 	}
-	return loading;
 }
 
 /**
@@ -214,6 +427,11 @@ export function resolveRunModel(
  * parent's active set. Custom tools (this run's MCP servers and the automation tools) are always
  * added, because pi's allowlist filters those too and they are the sub-agent's whole point.
  */
+/** `active` with its built-in tools replaced by `builtins`; every other tool is left as it is. */
+export function keepBuiltins(active: string[], builtins: string[]): string[] {
+	return [...new Set([...active.filter((t) => !PI_BUILTIN_TOOL_NAMES.includes(t)), ...builtins])];
+}
+
 export function subSessionTools(req: Pick<SubagentRequest, "tools">, parentTools: string[] | undefined, customTools: Array<{ name: string }>): string[] | undefined {
 	const custom = customTools.map((t) => t.name);
 	if (req.tools) return [...new Set(req.tools.filter((t) => !parentTools || parentTools.includes(t) || custom.includes(t)))];
@@ -283,17 +501,44 @@ export interface RunTelemetry {
 	compactions: number;
 }
 
+type SessionStats = { tokens: { input: number; output: number; cacheRead: number; cacheWrite: number }; cost: number; assistantMessages: number };
+
+/**
+ * Where a held turn started: the conversation it opened already had messages and a cost, and pi's
+ * stats add up the whole file. Everything this run reports is measured from here.
+ */
+export interface RunBaseline {
+	messages: number;
+	stats: SessionStats;
+}
+
+/** This run's share of a session's stats: everything, or what was added since `base`. */
+export function usageSince(stats: SessionStats, base?: SessionStats): RunnerResult["usage"] {
+	const less = (a: number, b = 0) => Math.max(0, a - b);
+	return {
+		input: less(stats.tokens.input, base?.tokens.input),
+		output: less(stats.tokens.output, base?.tokens.output),
+		cacheRead: less(stats.tokens.cacheRead, base?.tokens.cacheRead),
+		cacheWrite: less(stats.tokens.cacheWrite, base?.tokens.cacheWrite),
+		cost: less(stats.cost, base?.cost),
+		turns: less(stats.assistantMessages, base?.assistantMessages),
+	};
+}
+
 /** A finished (or failed) sub-session, reduced to what the schedulers record. */
 export function collect(
-	session: { messages: unknown[]; sessionId: string; sessionFile: string | undefined; getSessionStats(): { tokens: { input: number; output: number; cacheRead: number; cacheWrite: number }; cost: number; assistantMessages: number }; agent: { state: { errorMessage?: string } } },
+	session: { messages: unknown[]; sessionId: string; sessionFile: string | undefined; getSessionStats(): SessionStats; agent: { state: { errorMessage?: string } } },
 	req: Pick<SubagentRequest, "signal" | "timeoutMs">,
 	timedOut: boolean,
 	thrown?: string,
 	telemetry?: RunTelemetry,
 	/** Set when the daily budget stopped this run: it outranks the abort it had to use to do it. */
 	budgetStopMessage?: string,
+	baseline?: RunBaseline,
 ): RunnerResult {
-	const messages = session.messages as any[];
+	// Only this run's messages: in a conversation that already had answers, the last one before this
+	// turn is not this turn's reply, and a turn that produced none must not borrow it.
+	const messages = (session.messages as any[]).slice(baseline?.messages ?? 0);
 	const assistant = [...messages].reverse().find((message) => message?.role === "assistant");
 	const text = assistant ? (assistant.content as any[]).filter((b) => b?.type === "text").map((b) => b.text).join("\n") : "";
 	const stopReason: string | undefined = assistant?.stopReason;
@@ -317,7 +562,7 @@ export function collect(
 		// A run that silently retried five times or compacted twice must not look like a clean one.
 		retries: telemetry?.retries,
 		compactions: telemetry?.compactions,
-		usage: { input: stats.tokens.input, output: stats.tokens.output, cacheRead: stats.tokens.cacheRead, cacheWrite: stats.tokens.cacheWrite, cost: stats.cost, turns: stats.assistantMessages },
+		usage: usageSince(stats, baseline?.stats),
 		sessionId: session.sessionId,
 		sessionFile: session.sessionFile,
 	};
@@ -325,6 +570,8 @@ export function collect(
 
 /** Resolved when the run's deadline or its abort signal fires; raced against every setup step. */
 const STOPPED = Symbol("stopped");
+/** How often a held turn looks whether a window took its conversation back, between events. */
+const HELD_CHECK_MS = 2_000;
 
 /**
  * End of one run. No `session_shutdown`: the extension instances are shared with the runs that
@@ -342,6 +589,13 @@ export function disposeSubSession(session: { dispose(): void }, log?: (message:
 }
 
 export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner {
+	// Conversations whose held turns stopped coming give their extensions back within the idle window.
+	// So do the loops' shared sets that no run has used for as long.
+	const sweep = setInterval(() => {
+		releaseSharedResources(deps);
+		void releaseHeldResources().catch((err: any) => deps.log?.(`held-turn resources: ${err?.message ?? err}`));
+	}, 10 * 60 * 1000);
+	sweep.unref();
 	// Only a fallback for the headless host, which has no interactive session to borrow from. It
 	// reads the credentials of *this* agent dir, and is rebuilt when they change on disk, so a
 	// rotated key or a fresh `pi login` is picked up without restarting the host.
@@ -378,7 +632,9 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 	return async (req: SubagentRequest): Promise<RunnerResult> => {
 		let session: Awaited<ReturnType<typeof createAgentSession>>["session"] | undefined;
 		let unsubscribe: (() => void) | undefined;
+		let releaseHeld: (() => void) | undefined;
 		let timedOut = false;
+		let takenBack = false;
 		let budgetStopMessage: string | undefined;
 		let stop = () => {};
 		const stopped = new Promise<typeof STOPPED>((resolve) => {
@@ -396,12 +652,28 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 			onAbort();
 		}, req.timeoutMs);
 		timer.unref();
+		// A quiet tool (a long `sleep`, a build) sends no events, so the per-event check below would
+		// see a window take the conversation back only when it ends, and the turn would go on writing
+		// into a conversation a person is now using. A held turn also looks on a clock.
+		const holdCheck = req.stillHolds
+			? setInterval(() => {
+					try {
+						if (takenBack || req.stillHolds!()) return;
+					} catch {
+						return; // a lease that cannot be read now is not one taken away: the next look decides
+					}
+					takenBack = true;
+					onAbort();
+				}, HELD_CHECK_MS)
+			: undefined;
+		holdCheck?.unref();
 		req.signal?.addEventListener("abort", onAbort, { once: true });
 		// This run's own live cost, and its place in what the process has in flight. Retired in the
 		// `finally` below, before the session is disposed, so its final cost is still readable there.
+		let baseline: RunBaseline | undefined;
 		const runCost = () => {
 			try {
-				return session?.getSessionStats().cost ?? 0;
+				return Math.max(0, (session?.getSessionStats().cost ?? 0) - (baseline?.stats.cost ?? 0));
 			} catch {
 				return 0; // a half-built or already disposed session has nothing to report
 			}
@@ -429,7 +701,7 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 			onAbort();
 			return true;
 		};
-		const stoppedEarly = () => (budgetStopMessage ? failedRun(budgetStopMessage, { stopReason: "aborted" }) : timedOut ? failedRun(`timed out after ${Math.round(req.timeoutMs / 1000)}s`, { timedOut: true }) : req.signal?.aborted ? failedRun("aborted", { stopReason: "aborted" }) : undefined);
+		const stoppedEarly = () => (takenBack ? failedRun("taken back: a window opened this conversation", { stopReason: "aborted" }) : budgetStopMessage ? failedRun(budgetStopMessage, { stopReason: "aborted" }) : timedOut ? failedRun(`timed out after ${Math.round(req.timeoutMs / 1000)}s`, { timedOut: true }) : req.signal?.aborted ? failedRun("aborted", { stopReason: "aborted" }) : undefined);
 		const stoppedResult = () => stoppedEarly() ?? failedRun("aborted", { stopReason: "aborted" });
 		// Until the session exists there is nothing for `abort()` to reach, and setup is not quick:
 		// `loader.reload()` shells out to npm/git for a project's `settings.json` packages, so a
@@ -450,31 +722,38 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 				// Only a pinned model needs the catalogue; the parent's model is already resolved.
 				let resolved: ReturnType<typeof resolveRunModel> = { model: parent };
 				if (req.model) resolved = resolveRunModel(req.model, parent, await modelRuntime());
+				else if (req.sessionFile) resolved = { model: undefined }; // a conversation keeps the model it was using
 				if (resolved.error) return failedRun(resolved.error);
 				model = resolved.model;
 				if (resolved.warning) {
 					telemetry.warning = resolved.warning;
 					deps.log?.(resolved.warning);
 				}
-				if (!model) return failedRun("no model is available for the sub-agent (the session has none and the job pins none)");
+				if (!model && !req.sessionFile) return failedRun("no model is available for the sub-agent (the session has none and the job pins none)");
 			} catch (err: any) {
 				return failedRun(`model runtime: ${err?.message ?? err}`);
 			}
 
 			const customTools = await untilStopped(deps.customTools(req));
 			if (customTools === STOPPED) return stoppedResult();
-			const resources = await untilStopped(sharedSubSessionResources(req, deps));
+			// A held turn runs in someone's conversation, so it gets a loader of its own: the shared one
+			// stubs `invalidate`, which is fine for a throwaway sub-session and wrong for that.
+			// A held turn borrows its conversation's cached set and hands it back however the run ends.
+			// A loop's run borrows the shared set the same way, so a newer set does not shut this one under it.
+			const load = req.sessionFile ? heldSubSessionResources(req, deps) : sharedSubSessionResources(req, deps);
+			releaseHeld = () => void load.then((h) => h.done()).catch(() => undefined);
+			const resources = await untilStopped(load.then((h) => h.resources));
 			if (resources === STOPPED) return stoppedResult();
 			const created = await untilStopped(
 				createAgentSession({
 					cwd: req.cwd,
 					agentDir: deps.agentDir,
 					model,
-					thinkingLevel: (req.thinking ?? deps.getParentThinking()) as Thinking,
+					thinkingLevel: (req.thinking ?? (req.sessionFile ? undefined : deps.getParentThinking())) as Thinking,
 					tools: subSessionTools(req, deps.getParentTools?.(), customTools),
 					customTools,
 					resourceLoader: resources.loader,
-					sessionManager: req.sessionDir ? SessionManager.create(req.cwd, req.sessionDir) : SessionManager.inMemory(req.cwd),
+					sessionManager: req.sessionFile ? SessionManager.open(req.sessionFile) : req.sessionDir ? SessionManager.create(req.cwd, req.sessionDir) : SessionManager.inMemory(req.cwd),
 					settingsManager: resources.settingsManager,
 					modelRuntime: await modelRuntime(),
 					sessionStartEvent: { type: "session_start", reason: "new" },
@@ -482,6 +761,11 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 			);
 			if (created === STOPPED) return stoppedResult();
 			session = created.session;
+			// The built-in tools of the chat the job was made in, and no more: a run in the background has
+			// no `--tools` of its own. Extension, MCP and automation tools stay as they are.
+			if (req.builtinTools && !req.tools) session.setActiveToolsByName(keepBuiltins(session.getActiveToolNames(), req.builtinTools));
+			// A held turn opens a conversation that already has a history and a cost: measure from here.
+			if (req.sessionFile) baseline = { messages: session.messages.length, stats: session.getSessionStats() };
 			if (session.sessionFile) req.onSessionFile?.(session.sessionFile);
 
 			// Nobody else watches this session, so what the run had to do to get through is only
@@ -492,6 +776,14 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 			const debug = envFlag("LOOPS_DEBUG");
 			const label = `${req.kind}/${(req.jobId ?? req.traceId ?? "?").slice(0, 12)}`;
 			unsubscribe = session.subscribe((e: any) => {
+				// The per-event lease check of a held turn. pi persists at message and tool boundaries, so
+				// stopping at the first event after a window took the conversation bounds what is written
+				// after it to one entry.
+				if (req.stillHolds && e.type !== "message_update" && !takenBack && !req.stillHolds()) {
+					takenBack = true;
+					onAbort();
+					return;
+				}
 				if (e.type === "auto_retry_start") {
 					telemetry.retries++;
 					if (debug) deps.log?.(`debug ${label}: provider retry`);
@@ -514,20 +806,22 @@ export function createInProcessRunner(deps: InProcessRunnerDeps): SubagentRunner
 			if (bound === STOPPED) return stoppedResult();
 			// Setup can take seconds; the runs beside this one were spending throughout. Check with the
 			// session in hand, before the first token is bought, then once per turn from the subscriber.
-			if (overBudget()) return collect(session, req, timedOut, undefined, telemetry, budgetStopMessage);
+			if (overBudget()) return collect(session, req, timedOut, undefined, telemetry, budgetStopMessage, baseline);
 			await session.prompt(req.prompt);
-			return collect(session, req, timedOut, undefined, telemetry, budgetStopMessage);
+			return collect(session, req, timedOut, undefined, telemetry, budgetStopMessage, baseline);
 		} catch (err: any) {
 			const message = err?.message ?? String(err);
-			if (session) return collect(session, req, timedOut, message, telemetry, budgetStopMessage);
+			if (session) return collect(session, req, timedOut, message, telemetry, budgetStopMessage, baseline);
 			return failedRun(budgetStopMessage ?? message, { warning: telemetry.warning });
 		} finally {
 			clearTimeout(timer);
+			clearInterval(holdCheck);
 			stop();
 			retireCost();
 			unsubscribe?.();
 			req.signal?.removeEventListener("abort", onAbort);
 			if (session) disposeSubSession(session, deps.log);
+			releaseHeld?.();
 		}
 	};
 }