@cjhyy/code-shell-core 0.7.1 → 0.8.0

package/dist/protocol/chat-session-manager.d.ts

@@ -1,8 +1,11 @@
 import { ChatSession } from "./chat-session.js";
+import type { SessionKind } from "../types.js";
 import type { Engine } from "../engine/engine.js";
 import type { EngineRuntime } from "../engine/runtime.js";
 import type { EngineConfig } from "../engine/types.js";
-export type EngineConfigSlice = Pick<EngineConfig, "permissionMode" | "preset" | "customSystemPrompt" | "appendSystemPrompt" | "goal" | "maxTurns" | "maxContextTokens" | "cwd" | "projectTrusted">;
+export type EngineConfigSlice = Pick<EngineConfig, "permissionMode" | "preset" | "customSystemPrompt" | "appendSystemPrompt" | "goal" | "maxTurns" | "maxContextTokens" | "cwd" | "projectTrusted" | "sessionStorageDir">;
+/** Identity scope every ChatSessionManager belongs to when none is injected. */
+export declare const LOCAL_CHAT_IDENTITY = "local";
 export interface ChatSessionManagerOptions {
     /**
      * Shared runtime, supplied here so callers and engineFactory closures
@@ -14,6 +17,35 @@ export interface ChatSessionManagerOptions {
     engineFactory: (slice: EngineConfigSlice) => Engine;
     maxSessions?: number;
     idleTtlMs?: number;
+    /** Host lifecycle generation attached to Pet projection snapshots/deltas. */
+    projectionGeneration?: number;
+    /**
+     * Identity scope this manager serves. Defaults to "local" — the single
+     * OS-user manager every host uses today. A server host that authenticates
+     * connections derives one manager per identity via {@link
+     * ChatSessionManager.forIdentity}; sessions never cross identities.
+     */
+    identity?: string;
+    /**
+     * Base data root used to derive per-identity session persistence
+     * (`<dataRoot>/identities/<id>/sessions`). Defaults to `codeShellHome()`
+     * (`CODE_SHELL_HOME` env → `~/.code-shell`). Only consulted when a
+     * non-default identity manager is derived — the default "local" manager
+     * never redirects persistence.
+     */
+    dataRoot?: string;
+}
+export interface LiveChatSessionSnapshot {
+    generation: number;
+    /** Identity scope of the manager that produced this snapshot. */
+    identity: string;
+    sessions: Array<{
+        sessionId: string;
+        busy: boolean;
+        queueDepth: number;
+        lastActivityAt: number;
+        kind: SessionKind;
+    }>;
 }
 export declare const CLOSED_CHAT_SESSION_TOMBSTONE_LIMIT = 4096;
 export declare class ChatSessionManager {
@@ -22,12 +54,34 @@ export declare class ChatSessionManager {
     private readonly closedSessions;
     private readonly sessionGeneration;
     readonly runtime: EngineRuntime;
+    /** Identity scope this manager serves ("local" unless injected). */
+    readonly identity: string;
     private readonly factory;
     private readonly maxSessions;
     private readonly idleTtlMs;
+    private readonly projectionGeneration;
+    /** Construction options retained so forIdentity() can derive siblings. */
+    private readonly baseOptions;
     private sweeper;
     constructor(opts: ChatSessionManagerOptions);
+    /**
+     * Derive a manager scoped to another identity. The derived manager shares
+     * this manager's runtime/limits but persists its sessions under
+     * `<dataRoot>/identities/<identity>/sessions` by injecting
+     * `sessionStorageDir` into every engineFactory slice (Task 1's SessionManager
+     * storageDir seam). Asking for this manager's own identity returns `this`
+     * unchanged, so the default single-identity ("local") path is byte-for-byte
+     * today's behavior. Callers (AgentServer) cache derived managers per
+     * identity; each call here builds a fresh instance.
+     */
+    forIdentity(identity: string): ChatSessionManager;
     getOrCreate(sessionId: string, slice: EngineConfigSlice): Promise<ChatSession>;
+    /**
+     * Cold-resume a persisted session using its own cwd. The first detached
+     * Engine is only a storage probe; all actual work runs on the second Engine
+     * built from the recovered project slice.
+     */
+    getOrCreatePersisted(sessionId: string, slice?: Partial<EngineConfigSlice>, restorePersistedModel?: boolean): Promise<ChatSession | null>;
     private getOrCreateNow;
     get(sessionId: string): ChatSession | undefined;
     isClosing(sessionId: string): boolean;
@@ -41,6 +95,8 @@ export declare class ChatSessionManager {
      * the values so a callback that closes a session can't perturb the walk.
      */
     forEachSession(fn: (s: ChatSession) => void): void;
+    /** Snapshot-safe, read-only source shared by query("sessions") and Pet projection. */
+    getLiveSessionSnapshot(): LiveChatSessionSnapshot;
     close(sessionId: string): Promise<void>;
     private closeSession;
     private rememberClosedSession;
@@ -58,3 +114,10 @@ export declare class ChatSessionManager {
     private unregisterMcpOwner;
     private engineSessionManager;
 }
+/**
+ * Factory counterpart of `new ChatSessionManager(opts)` for identity/dataRoot
+ * aware hosts (identity dimension foundations, Task 2). Identity defaults to
+ * "local" and dataRoot to `codeShellHome()`, so omitting both is exactly the
+ * constructor every existing host already calls.
+ */
+export declare function createChatSessionManager(opts: ChatSessionManagerOptions): ChatSessionManager;

package/dist/protocol/chat-session-manager.js

@@ -1,4 +1,6 @@
+import { join } from "node:path";
 import { ChatSession } from "./chat-session.js";
+import { codeShellHome } from "../session/session-manager.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
 import { clearAgentOutputFiles } from "../tool-system/builtin/agent-output-file.js";
 import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js";
@@ -7,6 +9,25 @@ import { clearInjectCredentialSessionAllow } from "../credentials/inject-credent
 import { logger } from "../logging/logger.js";
 import { clearSessionPathApprovals, openSessionPathApprovals } from "../tool-system/path-policy.js";
 import { clearInteractiveApprovalSession, openInteractiveApprovalSession, } from "../tool-system/permission.js";
+/** Identity scope every ChatSessionManager belongs to when none is injected. */
+export const LOCAL_CHAT_IDENTITY = "local";
+/**
+ * An identity becomes an on-disk path segment (`<root>/identities/<id>`), so
+ * it gets the same conservative validation as session ids: no separators, no
+ * parent-dir tokens, short, and a strict character allow-list.
+ */
+function assertSafeIdentity(identity) {
+    if (typeof identity !== "string" || identity.length === 0 || identity.length > 64) {
+        throw new Error(`invalid identity: must be a non-empty string of at most 64 chars`);
+    }
+    if (identity.includes("/") ||
+        identity.includes("\\") ||
+        identity === "." ||
+        identity.includes("..") ||
+        !/^[A-Za-z0-9_.-]+$/.test(identity)) {
+        throw new Error(`invalid identity: unexpected characters: ${identity}`);
+    }
+}
 export const CLOSED_CHAT_SESSION_TOMBSTONE_LIMIT = 4096;
 export class ChatSessionManager {
     sessions = new Map();
@@ -14,15 +35,47 @@ export class ChatSessionManager {
     closedSessions = new Set();
     sessionGeneration = new Map();
     runtime;
+    /** Identity scope this manager serves ("local" unless injected). */
+    identity;
     factory;
     maxSessions;
     idleTtlMs;
+    projectionGeneration;
+    /** Construction options retained so forIdentity() can derive siblings. */
+    baseOptions;
     sweeper = null;
     constructor(opts) {
         this.runtime = opts.runtime;
+        this.identity = opts.identity ?? LOCAL_CHAT_IDENTITY;
+        if (opts.identity !== undefined)
+            assertSafeIdentity(opts.identity);
         this.factory = opts.engineFactory;
         this.maxSessions = opts.maxSessions ?? 16;
         this.idleTtlMs = opts.idleTtlMs ?? 30 * 60 * 1000;
+        this.projectionGeneration = opts.projectionGeneration ?? 1;
+        this.baseOptions = opts;
+    }
+    /**
+     * Derive a manager scoped to another identity. The derived manager shares
+     * this manager's runtime/limits but persists its sessions under
+     * `<dataRoot>/identities/<identity>/sessions` by injecting
+     * `sessionStorageDir` into every engineFactory slice (Task 1's SessionManager
+     * storageDir seam). Asking for this manager's own identity returns `this`
+     * unchanged, so the default single-identity ("local") path is byte-for-byte
+     * today's behavior. Callers (AgentServer) cache derived managers per
+     * identity; each call here builds a fresh instance.
+     */
+    forIdentity(identity) {
+        assertSafeIdentity(identity);
+        if (identity === this.identity)
+            return this;
+        const sessionStorageDir = join(this.baseOptions.dataRoot ?? codeShellHome(), "identities", identity, "sessions");
+        const baseFactory = this.baseOptions.engineFactory;
+        return new ChatSessionManager({
+            ...this.baseOptions,
+            identity,
+            engineFactory: (slice) => baseFactory({ ...slice, sessionStorageDir }),
+        });
     }
     async getOrCreate(sessionId, slice) {
         const closing = this.closingSessions.get(sessionId);
@@ -31,6 +84,30 @@ export class ChatSessionManager {
         }
         return this.getOrCreateNow(sessionId, slice);
     }
+    /**
+     * Cold-resume a persisted session using its own cwd. The first detached
+     * Engine is only a storage probe; all actual work runs on the second Engine
+     * built from the recovered project slice.
+     */
+    async getOrCreatePersisted(sessionId, slice = {}, restorePersistedModel = true) {
+        const existing = this.sessions.get(sessionId);
+        if (existing)
+            return existing;
+        const probe = this.factory(slice);
+        if (!probe.sessionExistsOnDisk(sessionId))
+            return null;
+        const cwd = probe.getSessionManager().readSessionMainRoot(sessionId);
+        if (!cwd)
+            return null;
+        const session = await this.getOrCreate(sessionId, {
+            ...slice,
+            cwd,
+            projectTrusted: slice.projectTrusted ?? false,
+        });
+        if (restorePersistedModel)
+            session.engine.restoreSessionModel(sessionId);
+        return session;
+    }
     getOrCreateNow(sessionId, slice) {
         openSessionPathApprovals(sessionId);
         openInteractiveApprovalSession(sessionId);
@@ -87,6 +164,23 @@ export class ChatSessionManager {
         for (const s of [...this.sessions.values()])
             fn(s);
     }
+    /** Snapshot-safe, read-only source shared by query("sessions") and Pet projection. */
+    getLiveSessionSnapshot() {
+        const sessions = [];
+        this.forEachSession((session) => {
+            sessions.push({
+                sessionId: session.id,
+                busy: session.isBusy(),
+                queueDepth: session.queueDepth(),
+                lastActivityAt: session.lastActivityAt,
+                kind: session.engine
+                    .getSessionManager?.()
+                    .readSessionKind?.(session.id) ?? "work",
+            });
+        });
+        sessions.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
+        return { generation: this.projectionGeneration, identity: this.identity, sessions };
+    }
     close(sessionId) {
         return this.closeSession(sessionId, true);
     }
@@ -205,6 +299,7 @@ export class ChatSessionManager {
         void mcpPool.unregisterOwner(session.engine).catch((err) => {
             logger.warn("chat_session.mcp_owner_unregister_failed", {
                 sessionId: session.id,
+                identity: this.identity,
                 error: err instanceof Error ? err.message : String(err),
             });
         });
@@ -219,3 +314,12 @@ export class ChatSessionManager {
         return manager;
     }
 }
+/**
+ * Factory counterpart of `new ChatSessionManager(opts)` for identity/dataRoot
+ * aware hosts (identity dimension foundations, Task 2). Identity defaults to
+ * "local" and dataRoot to `codeShellHome()`, so omitting both is exactly the
+ * constructor every existing host already calls.
+ */
+export function createChatSessionManager(opts) {
+    return new ChatSessionManager(opts);
+}

package/dist/protocol/chat-session.d.ts

@@ -1,22 +1,32 @@
 import type { Engine, EngineResult } from "../engine/engine.js";
 import type { ModelEntry } from "../llm/model-pool.js";
 import type { StreamEvent } from "../types.js";
-import type { PermissionMode } from "../types.js";
-import type { InputAttachmentMeta } from "./types.js";
+import type { PermissionMode, SessionKind } from "../types.js";
+import type { InputAttachmentMeta, PendingApprovalMetadata } from "./types.js";
 import type { ApprovalRouter } from "../tool-system/permission.js";
+import type { RunBehaviorMode } from "../engine/run-types.js";
+import type { SessionMessageTarget } from "../session/session-message.js";
+import type { LegacyPetWorkspaceOption } from "../types.js";
+import { type GoalConfig } from "../goal/lifecycle.js";
 export interface ChatSessionOptions {
     id: string;
     engine: Engine;
     onStream?: (event: StreamEvent) => void;
 }
+export interface PendingApprovalEntry {
+    resolve: (decision: unknown) => void;
+    metadata: PendingApprovalMetadata;
+}
 export interface TurnOpts {
     /** Working directory override for this turn. If omitted, Engine uses its
      *  configured cwd. */
     cwd?: string;
     onStream?: (event: StreamEvent) => void;
+    /** User-facing text persisted beside the full model-facing task. */
+    displayText?: string;
     /** Goal mode for this turn — forwarded to engine.run (loop-until-done).
      *  String objective or full GoalConfig (objective + optional budgets). */
-    goal?: string | import("../engine/goal.js").GoalConfig;
+    goal?: string | import("../goal/lifecycle.js").GoalConfig;
     /** Marks this turn as a synthetic system-reminder injection (background-job
      *  completion notification) rather than the user's own input — persisted so
      *  the disk reader skips it as a user bubble on replay. See Engine.run. */
@@ -29,6 +39,20 @@ export interface TurnOpts {
     permissionMode?: PermissionMode;
     /** Plan-mode snapshot for this queued turn only. */
     planMode?: boolean;
+    /** Named behavior profile snapshot for this queued turn only. */
+    behaviorMode?: RunBehaviorMode;
+    /** Generic per-run parameters consumed by the active behavior profile. */
+    profileParams?: Record<string, unknown>;
+    /** Digital human to bind durably to this Work Session. */
+    workspaceProfile?: string;
+    /** Closed same-project Session catalog available to SendMessageToSession. */
+    sessionMessageTargets?: readonly SessionMessageTarget[];
+    /** @deprecated Compat alias for `profileParams.runtimeContext`. */
+    petRuntimeContext?: string;
+    /** @deprecated Compat alias for `profileParams.workspaces`. */
+    petWorkspaces?: LegacyPetWorkspaceOption[];
+    /** Durable classification used only when the Engine creates the session. */
+    kind?: SessionKind;
     /** Connection owner router for permission prompts in this turn. */
     approvalRouter?: ApprovalRouter;
 }
@@ -41,16 +65,16 @@ export declare class ChatSession {
     readonly id: string;
     readonly engine: Engine;
     /**
-     * Per-session approval callbacks indexed by tool-call requestId.
+     * Per-session approval callbacks and resolver-free metadata indexed by requestId.
      * `readonly` guards the Map reference (preventing reassignment); the
      * contents are mutated by `.set()` / `.delete()` as approvals come and go.
-     * Task 10 will register entries here when the Engine raises an approval
-     * request and clean them up on response.
+     * The resolver stays process-local; only metadata is eligible for Pet snapshots.
      */
-    readonly pendingApprovals: Map<string, (decision: unknown) => void>;
+    readonly pendingApprovals: Map<string, PendingApprovalEntry>;
     lastActivityAt: number;
     private queue;
     private active;
+    private exclusiveOperation;
     private controller;
     private readonly defaultOnStream?;
     /**
@@ -81,6 +105,13 @@ export declare class ChatSession {
     private resolveSettled;
     constructor(opts: ChatSessionOptions);
     enqueueTurn(task: string, opts: TurnOpts): Promise<EngineResult>;
+    /**
+     * Run session maintenance (for example context-package summarization) under
+     * the same per-session mutex as turns. Existing activity fails fast; turns
+     * arriving after the lock is acquired remain queued until maintenance has
+     * persisted its final usage/state update.
+     */
+    runExclusive<T>(operation: (signal: AbortSignal) => Promise<T>): Promise<T>;
     /**
      * True when the user hit Stop and hasn't started a new turn since. The server
      * consults this before auto-waking an idle session on a background-job
@@ -118,16 +149,34 @@ export declare class ChatSession {
         maxStopBlocks: number;
     } | null;
     /**
-     * Read this session's persisted active goal (state.activeGoal), or undefined
+     * Read this session's persisted active goal (state.goalLifecycle), or undefined
      * when none. Cheap — reads only state.json. The host calls this on session
      * load to re-surface the goal block + Cancel button after a reload.
      */
-    getGoal(): import("../engine/goal.js").GoalConfig | undefined;
+    getGoal(): import("../goal/lifecycle.js").GoalConfig | undefined;
     /**
      * Clear this session's persisted active goal (CC /goal clear). Works idle or
      * mid-run. Returns true if a goal was actually cleared.
      */
-    clearGoal(): boolean;
+    clearGoal(expected?: {
+        goalId?: string;
+        revision?: number;
+    }): boolean;
+    /** Edit or pause/resume this session's persistent goal. */
+    updateGoal(patch: {
+        objective?: string;
+        paused?: boolean;
+        expectedGoalId?: string;
+        expectedRevision?: number;
+    }): import("../goal/lifecycle.js").GoalConfig | undefined;
+    /** Whether a paused Goal can reuse this run's already Goal-capable prompt/tools. */
+    canResumeGoalInPlace(): boolean;
+    /**
+     * Queue the synthetic turn which actually drives an idle/dormant Goal after
+     * Resume. The version guard is checked at queue head, so a later edit/delete
+     * cannot leave a stale "resume" turn behind another user turn.
+     */
+    enqueueGoalResumeTurn(goal: GoalConfig, opts?: Omit<TurnOpts, "goal">): Promise<boolean>;
     /**
      * Switch this session's active model (per-session, not worker-global).
      * Applies immediately when idle; defers to the next run boundary when a
@@ -144,6 +193,8 @@ export declare class ChatSession {
      * path and the deferred run-boundary path.
      */
     private applyModelSwitch;
+    /** Apply and clear a deferred switch before another run may start. */
+    private applyPendingModelSwitchAtRunBoundary;
     queueDepth(): number;
     private pump;
 }

package/dist/protocol/chat-session.js

@@ -1,4 +1,5 @@
 import { isAbortError } from "../llm/client-base.js";
+import { isSameGoalInstance } from "../goal/lifecycle.js";
 /**
  * One ChatSession per UI chat tab. Owns a single Engine, an AbortController
  * for the active turn, and a FIFO queue so a fast second send waits for the
@@ -8,16 +9,16 @@ export class ChatSession {
     id;
     engine;
     /**
-     * Per-session approval callbacks indexed by tool-call requestId.
+     * Per-session approval callbacks and resolver-free metadata indexed by requestId.
      * `readonly` guards the Map reference (preventing reassignment); the
      * contents are mutated by `.set()` / `.delete()` as approvals come and go.
-     * Task 10 will register entries here when the Engine raises an approval
-     * request and clean them up on response.
+     * The resolver stays process-local; only metadata is eligible for Pet snapshots.
      */
     pendingApprovals = new Map();
     lastActivityAt = Date.now();
     queue = [];
     active = null;
+    exclusiveOperation = false;
     controller = null;
     defaultOnStream;
     /**
@@ -62,6 +63,36 @@ export class ChatSession {
             this.pump();
         });
     }
+    /**
+     * Run session maintenance (for example context-package summarization) under
+     * the same per-session mutex as turns. Existing activity fails fast; turns
+     * arriving after the lock is acquired remain queued until maintenance has
+     * persisted its final usage/state update.
+     */
+    async runExclusive(operation) {
+        if (this.active || this.exclusiveOperation || this.queue.length > 0) {
+            throw new Error("source session is still producing or has queued turns");
+        }
+        this.lastActivityAt = Date.now();
+        this.exclusiveOperation = true;
+        this.settlePromise = new Promise((resolve) => {
+            this.resolveSettled = resolve;
+        });
+        this.controller = new AbortController();
+        try {
+            return await operation(this.controller.signal);
+        }
+        finally {
+            this.lastActivityAt = Date.now();
+            this.resolveSettled?.();
+            this.resolveSettled = null;
+            this.controller = null;
+            this.exclusiveOperation = false;
+            this.applyPendingModelSwitchAtRunBoundary();
+            if (this.queue.length > 0)
+                void this.pump();
+        }
+    }
     /**
      * True when the user hit Stop and hasn't started a new turn since. The server
      * consults this before auto-waking an idle session on a background-job
@@ -94,7 +125,7 @@ export class ChatSession {
         }
     }
     isBusy() {
-        return this.active !== null;
+        return this.active !== null || this.exclusiveOperation;
     }
     /** Resolves after the active engine.run() has completed its pump finally. */
     get settled() {
@@ -110,7 +141,7 @@ export class ChatSession {
         return this.engine.extendGoalRun(opts);
     }
     /**
-     * Read this session's persisted active goal (state.activeGoal), or undefined
+     * Read this session's persisted active goal (state.goalLifecycle), or undefined
      * when none. Cheap — reads only state.json. The host calls this on session
      * load to re-surface the goal block + Cancel button after a reload.
      */
@@ -121,8 +152,56 @@ export class ChatSession {
      * Clear this session's persisted active goal (CC /goal clear). Works idle or
      * mid-run. Returns true if a goal was actually cleared.
      */
-    clearGoal() {
-        return this.engine.clearGoal(this.id);
+    clearGoal(expected) {
+        return this.engine.clearGoal(this.id, expected);
+    }
+    /** Edit or pause/resume this session's persistent goal. */
+    updateGoal(patch) {
+        return this.engine.updateGoal(this.id, patch);
+    }
+    /** Whether a paused Goal can reuse this run's already Goal-capable prompt/tools. */
+    canResumeGoalInPlace() {
+        return this.engine.canResumeGoalInPlace(this.id);
+    }
+    /**
+     * Queue the synthetic turn which actually drives an idle/dormant Goal after
+     * Resume. The version guard is checked at queue head, so a later edit/delete
+     * cannot leave a stale "resume" turn behind another user turn.
+     */
+    enqueueGoalResumeTurn(goal, opts = {}) {
+        this.lastActivityAt = Date.now();
+        this.cancelledSinceLastTurn = false;
+        return new Promise((resolve, reject) => {
+            // Resume is level-triggered, not an instruction that should accumulate.
+            // While another turn owns the session, pause -> resume can otherwise
+            // leave multiple continuation turns for the same Goal instance queued.
+            // Supersede only pending entries; an already-active resume is governed by
+            // the live TurnLoop control path.
+            if (goal.goalId) {
+                for (let index = this.queue.length - 1; index >= 0; index--) {
+                    const pending = this.queue[index];
+                    if (pending?.goalResumeId !== goal.goalId)
+                        continue;
+                    this.queue.splice(index, 1);
+                    pending.onSkipped?.();
+                }
+            }
+            this.queue.push({
+                task: "<system-reminder>\n用户已恢复持久目标。请读取当前持久目标并继续执行。\n</system-reminder>",
+                opts: { ...opts, injected: true },
+                ...(goal.goalId ? { goalResumeId: goal.goalId } : {}),
+                guard: () => {
+                    const current = this.engine.getGoal(this.id);
+                    // Edits retain the same user-owned goalId and should update the
+                    // queued resume, not cancel it. Pause/delete/replacement must skip.
+                    return current?.paused !== true && isSameGoalInstance(current, goal);
+                },
+                onSkipped: () => resolve(false),
+                resolve: () => resolve(true),
+                reject,
+            });
+            void this.pump();
+        });
     }
     /**
      * Switch this session's active model (per-session, not worker-global).
@@ -150,17 +229,48 @@ export class ChatSession {
      * path and the deferred run-boundary path.
      */
     applyModelSwitch(key) {
-        const entry = this.engine.switchModel(key);
+        // persist: false — a per-session switch must not become the global boot
+        // default (settings.defaults.text); only explicit default-model changes
+        // (legacy single-engine path, TUI /model) persist.
+        const entry = this.engine.switchModel(key, { persist: false });
         this.engine.resetSessionUsage(this.id);
         return entry;
     }
+    /** Apply and clear a deferred switch before another run may start. */
+    applyPendingModelSwitchAtRunBoundary() {
+        const key = this.pendingModel;
+        this.pendingModel = null;
+        if (key === null)
+            return;
+        try {
+            this.applyModelSwitch(key);
+        }
+        catch {
+            // requestModelSwitch already returned when the switch was queued. A
+            // run-boundary persistence failure must not become an unhandled pump
+            // rejection or prevent the session from settling/continuing.
+        }
+    }
     queueDepth() {
         return this.queue.length;
     }
     async pump() {
-        if (this.active)
+        if (this.active || this.exclusiveOperation)
             return;
-        const next = this.queue.shift();
+        let next;
+        while ((next = this.queue.shift())) {
+            let allowed = true;
+            try {
+                allowed = next.guard?.() ?? true;
+            }
+            catch {
+                allowed = false;
+            }
+            if (allowed)
+                break;
+            next.onSkipped?.();
+            next = undefined;
+        }
         if (!next)
             return;
         this.active = next;
@@ -174,6 +284,7 @@ export class ChatSession {
             const result = await this.engine.run(next.task, {
                 cwd: next.opts.cwd,
                 sessionId: this.id,
+                displayText: next.opts.displayText,
                 signal: this.controller.signal,
                 onStream,
                 goal: next.opts.goal,
@@ -182,6 +293,13 @@ export class ChatSession {
                 attachments: next.opts.attachments,
                 permissionMode: next.opts.permissionMode,
                 planMode: next.opts.planMode,
+                behaviorMode: next.opts.behaviorMode,
+                profileParams: next.opts.profileParams,
+                workspaceProfile: next.opts.workspaceProfile,
+                sessionMessageTargets: next.opts.sessionMessageTargets,
+                petRuntimeContext: next.opts.petRuntimeContext,
+                petWorkspaces: next.opts.petWorkspaces,
+                kind: next.opts.kind,
                 approvalRouter: next.opts.approvalRouter,
             });
             this.lastActivityAt = Date.now();
@@ -217,21 +335,13 @@ export class ChatSession {
             // Run boundary: apply any model switch that was deferred because it was
             // requested mid-run. Done here (not in pump) so it still applies when
             // no further turn is queued.
-            try {
-                if (this.pendingModel !== null) {
-                    this.applyModelSwitch(this.pendingModel);
-                }
-            }
-            catch {
-                // requestModelSwitch already returned when the switch was queued. A
-                // run-boundary persistence failure must not become an unhandled pump
-                // rejection or prevent the session from settling/continuing.
-            }
-            finally {
-                this.pendingModel = null;
-                // Drain the next turn even if deferred model switching failed.
-                if (this.queue.length > 0)
-                    void this.pump();
+            this.applyPendingModelSwitchAtRunBoundary();
+            // Drain the next turn even if deferred model switching failed.
+            if (this.queue.length > 0) {
+                // Let the just-settled turn's resolve/reject handlers publish their
+                // terminal lifecycle before a queued turn can synchronously emit its
+                // session_started event. This preserves external QueryGuard ordering.
+                queueMicrotask(() => void this.pump());
             }
         }
     }