@cjhyy/code-shell-core 0.8.7 → 0.8.9

package/dist/cli/agent-server-stdio.js

@@ -215,11 +215,13 @@ function freshSettings() {
 }
 const chatManager = new ChatSessionManager({
     runtime,
-    // resolvedLlmConfig is the bootstrap-time snapshot. When the user
-    // hot-switches models via configure() the modelPool.activeKey moves
-    // ahead of it, so newly-created sessions must re-resolve from the pool
-    // each time the factory fires; fall back to the snapshot only when the
-    // pool can't resolve (no active key — shouldn't happen in practice).
+    // resolvedLlmConfig is the bootstrap-time snapshot. Explicit global model
+    // changes can move modelPool.activeKey ahead of it, so newly-created
+    // sessions re-resolve from the pool each time the factory fires. A
+    // per-session configure intentionally does NOT move that shared key; this
+    // keeps one Session's selected model from leaking into the next Session.
+    // Fall back to the snapshot only when the pool can't resolve (no active key
+    // — shouldn't happen in practice).
     engineFactory: (slice) => {
         // Effective cwd for THIS session: explicit slice.cwd → that project; absent
         // → the no-repo sandbox (NOT the worker's stale boot cwd). See

package/dist/context/manager.js

@@ -547,8 +547,16 @@ export class ContextManager {
         const window = messages.slice(start, end);
         // Feed a prior anchored summary back so the LLM merge-updates rather than
         // re-summarizes from scratch, matching the rolling-summary behavior of
-        // trySummaryCompact().
-        const priorSummary = extractAnchoredSummary(messages) ?? this.lastSummary;
+        // trySummaryCompact() — but ONLY when that anchored summary sits inside
+        // the window being replaced. A summary inside [start, end) is about to be
+        // overwritten by this call, so it must be merged in or its content is
+        // lost. A summary OUTSIDE the window belongs to a different, untouched
+        // span and must NOT be merged in: doing so (via `?? this.lastSummary`,
+        // which is a single most-recent-summary carryover with no span
+        // awareness) made every subsequent range archive fold in the text of
+        // every prior one, so N archived spans produced N copies of the same
+        // growing summary instead of N independent summaries.
+        const priorSummary = extractAnchoredSummary(window);
         const prompt = buildSummarizationPrompt(window, priorSummary);
         const summary = await this.summarizeFn(prompt, opts.signal);
         if (!summary || summary.length <= 50)

package/dist/engine/engine.d.ts

@@ -457,6 +457,13 @@ export declare class Engine {
      * Switch the active model by pool key. Takes effect on the next run() call.
      * Returns the new model entry.
      *
+     * Per-session switches (`persist:false`) must not mutate the shared
+     * ModelPool active key. Every desktop ChatSession owns an Engine, but those
+     * Engines share one runtime pool; changing the pool selection here made the
+     * next newly-created Session inherit whichever model another Session had
+     * just selected (for example a Mimi manager model leaking into its delegated
+     * Work Session).
+     *
      * Persists settings.defaults.text (= the connection id / pool key) so the
      * next process startup defaults to the same model — without this, switches
      * only live in memory and every restart reverts to the previously persisted
@@ -623,22 +630,67 @@ export declare class Engine {
      */
     private prepareContextManagerForSession;
     /**
-     * Archive a caller-chosen contiguous message-index window `[range.start,
-     * range.end)` of a session into a single anchored summary, leaving everything
-     * outside the window untouched, and cache the result so a later
-     * forceCompact/resume reads the archived history. This is a generic
-     * range-archival facade over ContextManager.summarizeRange — the caller
-     * decides which span to collapse (the range is a half-open message-index
-     * window, matching summarizeRange). Returns token stats before/after; equal
-     * before/after means the window was empty or the summary was rejected.
+     * Archive a contiguous message window of a session into a single anchored
+     * summary, leaving everything outside the window untouched, and cache the
+     * result so a later forceCompact/resume reads the archived history. This is
+     * a generic range-archival facade over ContextManager.summarizeRange.
+     * Returns token stats before/after; equal before/after means the window was
+     * empty/unresolvable or the summary was rejected.
+     *
+     * Window resolution depends on whether the caller supplied anchors:
+     * - With `anchors`, the caller's `range` is IGNORED and the window is
+     *   resolved from the client-message-id anchors over a fresh, marker-aware
+     *   transcript replay. Callers (the pet segment closure) compute index
+     *   ranges over the RAW transcript message list, whose indices grow
+     *   forever — but the live list is trimmed by every persisted marker
+     *   (replay after restart) and by each in-process archival, so a raw index
+     *   range clamps to an empty window or, worse, onto the WRONG tail
+     *   messages, which would then be persistently mis-summarized against
+     *   correct anchors. Anchors are the only stable coordinates.
+     * - Without `anchors`, legacy behavior: `range` is a half-open index window
+     *   over the cached/in-process message list, and nothing is persisted.
      */
     archiveTurnRange(sessionId: string, range: {
         start: number;
         end: number;
+    }, anchors?: {
+        toClientMessageId: string;
+        fromClientMessageId?: string;
+        segmentId?: string;
     }): Promise<{
         before: number;
         after: number;
     }>;
+    /**
+     * Guard against writing a marker anchored to a client message id the
+     * transcript doesn't actually contain. toMessages()'s replay silently
+     * ignores a range_archive event whose anchor doesn't resolve (fail open),
+     * so a bad anchor wouldn't corrupt anything on its own — but if the marker
+     * carries a segmentId, appendRangeArchive's idempotency check treats that
+     * segmentId as "already recorded" forever, with no retry path (e.g. a
+     * one-time migration keyed "migration-v1" would be permanently burned on
+     * its first, failed attempt). Reject before writing so the caller can
+     * retry with a corrected anchor. fromClientMessageId is optional in the
+     * data model (absent means "from the beginning"), so only validate it when
+     * present; missing it is fail-open by design, same as the replay path.
+     */
+    private hasLiveArchiveAnchors;
+    /**
+     * Persist an archive boundary WITHOUT a summarization call — the caller
+     * already has the summary text (e.g. the one-time migration built from
+     * pet journal entries). Wraps the plain text in the anchored-summary
+     * envelope so replay and rolling-merge treat it like a real archive.
+     * Returns false when the segmentId was already recorded (idempotent) OR
+     * when the anchors don't resolve to real messages in this transcript —
+     * see hasLiveArchiveAnchors for why a dead anchor must be rejected before
+     * the (potentially one-shot) segmentId gets burned.
+     */
+    appendArchiveMarker(sessionId: string, marker: {
+        summary: string;
+        toClientMessageId: string;
+        fromClientMessageId?: string;
+        segmentId?: string;
+    }): Promise<boolean>;
     private recordCacheReadDiagnostics;
     private getSettingsManager;
     /**

package/dist/engine/engine.js

@@ -12,6 +12,7 @@ import { enqueueSteerItem, consumeSteerItems, removeSteerItem, } from "./steer-q
 import { RunEnvironmentResolver } from "./run-environment.js";
 import { BUILTIN_TOOLS, } from "../tool-system/builtin/index.js";
 import { asyncAgentRegistry } from "../tool-system/builtin/agent-registry.js";
+import { skillToolDef } from "../tool-system/builtin/skill.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
 import { notificationQueue } from "../tool-system/builtin/agent-notifications.js";
 import { HookRegistry } from "../hooks/registry.js";
@@ -20,7 +21,7 @@ import { loadPluginHooks } from "../plugins/loadPluginHooks.js";
 import { pluginAgentDirs } from "../plugins/installer/loadPluginAgents.js";
 import { runShellHook, shellHookMatches } from "../hooks/shell-runner.js";
 import { ContextManager } from "../context/manager.js";
-import { CONTEXT_PACKAGE_MAX_OUTPUT_TOKENS, buildContextPackagePromptFromSerialized, estimateTokens, groupMessagesByApiRound, serializeContextPackageMessages, clampContextRatios as clampContextRatiosImpl, } from "../context/compaction.js";
+import { CONTEXT_PACKAGE_MAX_OUTPUT_TOKENS, buildAnchoredSummaryMessage, buildContextPackagePromptFromSerialized, estimateTokens, groupMessagesByApiRound, serializeContextPackageMessages, clampContextRatios as clampContextRatiosImpl, } from "../context/compaction.js";
 import { PromptComposer } from "../prompt/composer.js";
 import { SessionManager, assertSafeSessionId, isEphemeralSessionState, sessionsRoot, } from "../session/session-manager.js";
 import { createRunUsageAccounting, wireRunModelFacade } from "./run-accounting.js";
@@ -43,7 +44,7 @@ import { detectProviderFromApiKey, buildModelPool } from "../onboarding.js";
 import { detectPastedNoise } from "../utils/task-sanitizer.js";
 import { PromptCacheDiagnosticRecorder, promptCacheDropHint, } from "./prompt-cache-diagnostics.js";
 import { buildRunUserMessageContent, prepareRunImageInput } from "./run-image-input.js";
-import { QUICK_CHAT_RESTRICTED_PROFILE, } from "./run-types.js";
+import { ISOLATED_TASK_PROFILE, QUICK_CHAT_RESTRICTED_PROFILE, } from "./run-types.js";
 import { createSubAgentSpawner } from "./subagent-spawner.js";
 import { AuxiliaryPipeline, sameLlmIdentity } from "./auxiliary-pipeline.js";
 import { PermissionController } from "./permission-controller.js";
@@ -412,6 +413,7 @@ export class Engine {
         // extension modules — later registrations override earlier ones by id.
         this.behaviorProfiles = new Map([
             QUICK_CHAT_RESTRICTED_PROFILE,
+            ISOLATED_TASK_PROFILE,
             ...(config.behaviorProfiles ?? []),
             ...(config.extensionModules ?? []).flatMap((module) => module.behaviorProfiles ?? []),
         ].map((profile) => [profile.id, profile]));
@@ -1098,16 +1100,18 @@ export class Engine {
         session = openedResult.opened.session;
         this.stampRunToolContext(toolCtx, session, options);
         const sessionRun = runWithSid(session.state.sessionId, async () => {
-            const hookMessages = await this.runSessionStartHooks({
-                session,
-                task,
-                cwd,
-                runPermissionMode,
-                resumedFromDisk,
-                options,
-                taskText,
-                messages,
-            });
+            const hookMessages = profile?.disableHooks
+                ? []
+                : await this.runSessionStartHooks({
+                    session,
+                    task,
+                    cwd,
+                    runPermissionMode,
+                    resumedFromDisk,
+                    options,
+                    taskText,
+                    messages,
+                });
             const sid = session.state.sessionId;
             const { contextManager, llmClientPromise, toolExecutor } = this.wireRunContextAndPermission({
                 session,
@@ -1935,16 +1939,26 @@ export class Engine {
                 (visibilityStoredGoal !== undefined && visibilityStoredGoal.paused !== true) ||
                 (visibilityDefaultGoal !== undefined && visibilityDefaultGoal.paused !== true));
         const { disabledSkills, disabledPlugins } = this.readDisabledLists(cwd, sessionProfileOverrides);
+        // A profile whose tool allowlist excludes the Skill tool can never invoke
+        // a skill, so the full skills listing would be dead context for every one
+        // of its turns (e.g. the Pet manager) — inject none via an empty allowlist.
+        const runAllowedToolNames = toolCtx.allowedToolNames;
+        const profileCanUseSkills = !runAllowedToolNames || runAllowedToolNames.has(skillToolDef.name);
         const promptComposer = new PromptComposer(buildPromptComposerConfig({
             cwd,
             model: this.config.llm.model,
             preset: this.preset,
-            customSystemPrompt: this.config.customSystemPrompt,
-            appendSystemPrompt: [this.config.appendSystemPrompt, profile?.systemPromptAppend]
+            customSystemPrompt: profile?.disableInstructions
+                ? undefined
+                : this.config.customSystemPrompt,
+            appendSystemPrompt: [
+                profile?.disableInstructions ? undefined : this.config.appendSystemPrompt,
+                profile?.systemPromptAppend,
+            ]
                 .filter(Boolean)
                 .join("\n\n") || undefined,
             responseLanguage: this.config.responseLanguage,
-            userProfile: this.config.userProfile,
+            userProfile: profile?.disableInstructions ? undefined : this.config.userProfile,
             workspaceProfile: runWorkspaceProfile,
             // Read from the Session's own persisted state, so every turn — not just
             // the first — carries the standing brief.
@@ -1954,14 +1968,21 @@ export class Engine {
             instructionBoundaryFinder: (scanCwd) => resolveInstructionBoundary(scanCwd, this.capabilities),
             disabledSkills,
             disabledPlugins,
-            skillAllowlist: this.config.skillAllowlist,
+            skillAllowlist: profileCanUseSkills ? toolCtx.skillAllowlist : [],
             memoriesMaxAgeDays: this.readMemoriesConfig()?.maxAge,
-            goalToolState: !profile?.allowedToolNames ||
-                profile.allowedToolNames.has("complete_goal") ||
-                profile.allowedToolNames.has("cancel_goal")
+            memoryCurrentProjectOnly: profile?.memoryCurrentProjectOnly,
+            disableInstructions: profile?.disableInstructions,
+            disableMemoryContext: profile?.disableMemoryContext,
+            disableCapabilityContext: profile?.disableCapabilityContext,
+            disableSourcesContext: profile?.disableSourcesContext,
+            goalToolState: !runAllowedToolNames ||
+                runAllowedToolNames.has("complete_goal") ||
+                runAllowedToolNames.has("cancel_goal")
                 ? { hasGoal: hasRunnableGoal }
                 : undefined,
-            capabilityPromptSections: this.capabilityPromptSections,
+            capabilityPromptSections: profile?.disableCapabilityContext
+                ? {}
+                : this.capabilityPromptSections,
             dynamicContextProviders: this.capabilityDynamicContextProviders,
             getSettingsManager: () => this.getSettingsManager(),
             toolCatalog: this.toolCatalog,
@@ -2018,7 +2039,7 @@ export class Engine {
             toolRewriters: this.toolRewriters,
             toolFeatureFlags: TOOL_FEATURE_FLAGS,
             applyBuiltinOverrideVisibility,
-            profileAllowedToolNames: profile?.allowedToolNames,
+            profileAllowedToolNames: runAllowedToolNames,
             runPlanMode,
         });
         return { promptComposer, toolDefs };
@@ -2228,13 +2249,28 @@ export class Engine {
      * Switch the active model by pool key. Takes effect on the next run() call.
      * Returns the new model entry.
      *
+     * Per-session switches (`persist:false`) must not mutate the shared
+     * ModelPool active key. Every desktop ChatSession owns an Engine, but those
+     * Engines share one runtime pool; changing the pool selection here made the
+     * next newly-created Session inherit whichever model another Session had
+     * just selected (for example a Mimi manager model leaking into its delegated
+     * Work Session).
+     *
      * Persists settings.defaults.text (= the connection id / pool key) so the
      * next process startup defaults to the same model — without this, switches
      * only live in memory and every restart reverts to the previously persisted
      * defaults.text.
      */
     switchModel(key, opts) {
-        const entry = this.modelPool.switch(key);
+        const perSession = opts?.persist === false;
+        const entry = perSession ? this.modelPool.get(key) : this.modelPool.switch(key);
+        if (!entry) {
+            const available = this.modelPool
+                .list()
+                .map((candidate) => candidate.key)
+                .join(", ");
+            throw new Error(`Model "${key}" not found. Available: ${available}`);
+        }
         // LLMConfig is pure model identity now — rotate it wholesale. Cross-model
         // runtime knobs (temperature/timeout/retryMaxAttempts/imageDetail) live on
         // this.config.clientDefaults and survive the switch untouched.
@@ -2243,7 +2279,7 @@ export class Engine {
         // persist: false is the per-session path (ChatSession) — switching one
         // session's model must not rewrite settings.defaults.text, the boot
         // default every future session inherits.
-        if (opts?.persist !== false)
+        if (!perSession)
             this.persistActiveModel(entry);
         return entry;
     }
@@ -2839,33 +2875,149 @@ export class Engine {
         return contextManager;
     }
     /**
-     * Archive a caller-chosen contiguous message-index window `[range.start,
-     * range.end)` of a session into a single anchored summary, leaving everything
-     * outside the window untouched, and cache the result so a later
-     * forceCompact/resume reads the archived history. This is a generic
-     * range-archival facade over ContextManager.summarizeRange — the caller
-     * decides which span to collapse (the range is a half-open message-index
-     * window, matching summarizeRange). Returns token stats before/after; equal
-     * before/after means the window was empty or the summary was rejected.
-     */
-    async archiveTurnRange(sessionId, range) {
+     * Archive a contiguous message window of a session into a single anchored
+     * summary, leaving everything outside the window untouched, and cache the
+     * result so a later forceCompact/resume reads the archived history. This is
+     * a generic range-archival facade over ContextManager.summarizeRange.
+     * Returns token stats before/after; equal before/after means the window was
+     * empty/unresolvable or the summary was rejected.
+     *
+     * Window resolution depends on whether the caller supplied anchors:
+     * - With `anchors`, the caller's `range` is IGNORED and the window is
+     *   resolved from the client-message-id anchors over a fresh, marker-aware
+     *   transcript replay. Callers (the pet segment closure) compute index
+     *   ranges over the RAW transcript message list, whose indices grow
+     *   forever — but the live list is trimmed by every persisted marker
+     *   (replay after restart) and by each in-process archival, so a raw index
+     *   range clamps to an empty window or, worse, onto the WRONG tail
+     *   messages, which would then be persistently mis-summarized against
+     *   correct anchors. Anchors are the only stable coordinates.
+     * - Without `anchors`, legacy behavior: `range` is a half-open index window
+     *   over the cached/in-process message list, and nothing is persisted.
+     */
+    async archiveTurnRange(sessionId, range, anchors) {
         const effectiveSessionId = sessionId || this.lastSessionId;
         if (!effectiveSessionId)
             return { before: 0, after: 0 };
         const session = this.sessionManager.resume(effectiveSessionId);
-        const sourceMessages = this.compactedMessagesBySession.get(effectiveSessionId) ?? session.transcript.toMessages();
+        let sourceMessages;
+        let window;
+        if (anchors) {
+            const { messages: liveMessages, liveIndexByClientMessageId } = session.transcript.toMessagesWithIndex();
+            sourceMessages = liveMessages;
+            // An absent from-anchor means "from the beginning" — over the live
+            // list that is index 0, which includes any previously replayed
+            // from-less summary at the head, so summarizeRange merge-feeds it
+            // (extractAnchoredSummary) instead of losing it.
+            const start = anchors.fromClientMessageId !== undefined
+                ? liveIndexByClientMessageId.get(anchors.fromClientMessageId)
+                : 0;
+            const end = liveIndexByClientMessageId.get(anchors.toClientMessageId);
+            if (start === undefined || end === undefined || end <= start) {
+                // Fail open: no summarization, no persistence. Falling back to the
+                // caller's raw range is exactly the bug this path exists to fix —
+                // it would summarize the wrong messages and persist that against
+                // the (correct) anchors, with segmentId dedupe blocking correction.
+                logger.warn("engine.archive_range.anchor_window_unresolved", {
+                    sessionId: effectiveSessionId,
+                    segmentId: anchors.segmentId,
+                    fromClientMessageId: anchors.fromClientMessageId,
+                    toClientMessageId: anchors.toClientMessageId,
+                });
+                const before = estimateTokens(sourceMessages);
+                return { before, after: before };
+            }
+            window = { start, end };
+        }
+        else {
+            sourceMessages =
+                this.compactedMessagesBySession.get(effectiveSessionId) ?? session.transcript.toMessages();
+            window = range;
+        }
         const before = estimateTokens(sourceMessages);
         const contextManager = await this.prepareContextManagerForSession(effectiveSessionId, session, sourceMessages, "archive_range");
         // Range archival is initiated deliberately, not by a pressure heuristic;
         // don't let a stale run callback retained on lastContextManager double-emit.
         contextManager.setOnCompact(() => { });
-        const archived = await contextManager.summarizeRange(sourceMessages, range);
+        const archived = await contextManager.summarizeRange(sourceMessages, window);
         const after = estimateTokens(archived);
+        // Persist the boundary so a restart replays the trimmed context. Only when
+        // summarizeRange actually replaced the span (identity return means empty
+        // window / rejected summary / no summarizer available) and the caller
+        // supplied stable anchors to record it against.
+        if (anchors && archived !== sourceMessages) {
+            const clampedStart = Math.max(0, Math.min(window.start, archived.length - 1));
+            const summaryMessage = archived[clampedStart];
+            const summaryText = typeof summaryMessage?.content === "string" ? summaryMessage.content : undefined;
+            if (summaryText && this.hasLiveArchiveAnchors(session, anchors)) {
+                session.transcript.appendRangeArchive({ summary: summaryText, ...anchors });
+            }
+        }
+        // In the anchored path this replaces any in-process-only cache state with
+        // the fresh-replay-based result — safe, because the transcript is the
+        // superset of the cache and pressure compaction re-runs if needed.
         this.compactedMessagesBySession.set(effectiveSessionId, archived);
         this.lastSessionId = effectiveSessionId;
         this.lastMessages = archived;
         return { before, after };
     }
+    /**
+     * Guard against writing a marker anchored to a client message id the
+     * transcript doesn't actually contain. toMessages()'s replay silently
+     * ignores a range_archive event whose anchor doesn't resolve (fail open),
+     * so a bad anchor wouldn't corrupt anything on its own — but if the marker
+     * carries a segmentId, appendRangeArchive's idempotency check treats that
+     * segmentId as "already recorded" forever, with no retry path (e.g. a
+     * one-time migration keyed "migration-v1" would be permanently burned on
+     * its first, failed attempt). Reject before writing so the caller can
+     * retry with a corrected anchor. fromClientMessageId is optional in the
+     * data model (absent means "from the beginning"), so only validate it when
+     * present; missing it is fail-open by design, same as the replay path.
+     */
+    hasLiveArchiveAnchors(session, anchors) {
+        if (!session.transcript.hasClientMessageId(anchors.toClientMessageId))
+            return false;
+        if (anchors.fromClientMessageId !== undefined &&
+            !session.transcript.hasClientMessageId(anchors.fromClientMessageId)) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Persist an archive boundary WITHOUT a summarization call — the caller
+     * already has the summary text (e.g. the one-time migration built from
+     * pet journal entries). Wraps the plain text in the anchored-summary
+     * envelope so replay and rolling-merge treat it like a real archive.
+     * Returns false when the segmentId was already recorded (idempotent) OR
+     * when the anchors don't resolve to real messages in this transcript —
+     * see hasLiveArchiveAnchors for why a dead anchor must be rejected before
+     * the (potentially one-shot) segmentId gets burned.
+     */
+    async appendArchiveMarker(sessionId, marker) {
+        const session = this.sessionManager.resume(sessionId);
+        if (!this.hasLiveArchiveAnchors(session, marker)) {
+            logger.warn("engine.archive_marker.dead_anchor", {
+                sessionId,
+                segmentId: marker.segmentId,
+                toClientMessageId: marker.toClientMessageId,
+                fromClientMessageId: marker.fromClientMessageId,
+            });
+            return false;
+        }
+        const wrapped = buildAnchoredSummaryMessage(marker.summary, {
+            ...(session.transcript.isPersistent()
+                ? { transcriptPath: session.transcript.getFilePath() }
+                : {}),
+        });
+        const content = typeof wrapped.content === "string" ? wrapped.content : marker.summary;
+        const appended = session.transcript.appendRangeArchive({ ...marker, summary: content });
+        if (!appended)
+            return false;
+        // The in-memory cache (if any) predates the marker; drop it so the next
+        // run rebuilds from the trimmed transcript replay.
+        this.compactedMessagesBySession.delete(sessionId);
+        return true;
+    }
     recordCacheReadDiagnostics(sessionId, sample) {
         const result = this.promptCacheDiagnostics.record(sessionId, sample);
         if (result.kind === "scope_changed") {

package/dist/engine/run-finalize.js

@@ -88,11 +88,13 @@ export async function finalizeRunSuccess(args) {
     // the turn loop has resolved (completion, error, or abort). Handlers
     // are notify-only — any returned messages are dropped because the run
     // is already over and there's no next turn to inject into.
-    await args.emitHook("on_session_end", {
-        sessionId: session.state.sessionId,
-        reason: result.reason,
-        turnCount,
-    }, options?.signal);
+    if (profile?.disableHooks !== true) {
+        await args.emitHook("on_session_end", {
+            sessionId: session.state.sessionId,
+            reason: result.reason,
+            turnCount,
+        }, options?.signal);
+    }
     // Ephemeral side chats must never leak into durable memory, even after
     // the user explicitly elevates tool permissions for a turn. Lifecycle
     // isolation is independent of the run-scoped behavior/permission mode.
@@ -106,7 +108,7 @@ export async function finalizeRunSuccess(args) {
     // Reuses the already-resolved auxSummaryClient (aux model, cheap). Best-
     // effort: failures never touch the run result. The renderer writes the
     // title into the sidebar on receipt of the session_title stream event.
-    {
+    if (profile?.disableSessionTitle !== true) {
         const messageEvents = session.transcript.getEvents("message");
         const userMsgEvents = messageEvents.filter((e) => e.data.role === "user");
         const userMsgCount = userMsgEvents.length;

package/dist/engine/run-session-open.js

@@ -113,7 +113,7 @@ export function openRunSession(args) {
     else {
         // Cold start: shape (2) reuses the host-supplied sid; shape (3)
         // lets sessionManager generate one with nanoid.
-        session = args.sessionManager.create(args.cwd, args.llmModel, args.llmProvider, options?.sessionId, args.isSubAgent ? getCurrentSid() : undefined, args.isSubAgent ? "subagent" : args.origin, args.sessionKind);
+        session = args.sessionManager.create(args.cwd, args.llmModel, args.llmProvider, options?.sessionId, args.isSubAgent ? getCurrentSid() : undefined, args.isSubAgent ? "subagent" : args.origin, args.sessionKind, options?.ephemeral === true);
         const userMsg = { role: "user", content: args.userMessageContent };
         claimClientMessageId(session, options?.clientMessageId, "submit");
         if (args.parsedTask.hasImages)

package/dist/engine/run-setup.d.ts

@@ -32,6 +32,11 @@ export interface RunPromptComposerConfigInput {
     disabledPlugins: ComposerOptions["disabledPlugins"];
     skillAllowlist: ComposerOptions["skillAllowlist"];
     memoriesMaxAgeDays: ComposerOptions["memoriesMaxAgeDays"];
+    memoryCurrentProjectOnly?: ComposerOptions["memoryCurrentProjectOnly"];
+    disableInstructions?: ComposerOptions["disableInstructions"];
+    disableMemoryContext?: ComposerOptions["disableMemoryContext"];
+    disableCapabilityContext?: ComposerOptions["disableCapabilityContext"];
+    disableSourcesContext?: ComposerOptions["disableSourcesContext"];
     goalToolState: ComposerOptions["goalToolState"];
     capabilityPromptSections: ComposerOptions["capabilityPromptSections"];
     dynamicContextProviders: ComposerOptions["dynamicContextProviders"];

package/dist/engine/run-setup.js

@@ -23,7 +23,7 @@ export function resolveRunProfileState(args) {
 }
 /** Build the prompt-composer options for a run without capturing the Engine facade. */
 export function buildPromptComposerConfig(args) {
-    const { cwd, model, preset, customSystemPrompt, appendSystemPrompt, responseLanguage, userProfile, workspaceProfile, sessionBrief, profileMemoryDir, instructionCompatFileNames, instructionBoundaryFinder, disabledSkills, disabledPlugins, skillAllowlist, memoriesMaxAgeDays, goalToolState, capabilityPromptSections, dynamicContextProviders, getSettingsManager, toolCatalog, } = args;
+    const { cwd, model, preset, customSystemPrompt, appendSystemPrompt, responseLanguage, userProfile, workspaceProfile, sessionBrief, profileMemoryDir, instructionCompatFileNames, instructionBoundaryFinder, disabledSkills, disabledPlugins, skillAllowlist, memoriesMaxAgeDays, memoryCurrentProjectOnly, disableInstructions, disableMemoryContext, disableCapabilityContext, disableSourcesContext, goalToolState, capabilityPromptSections, dynamicContextProviders, getSettingsManager, toolCatalog, } = args;
     return {
         cwd,
         model,
@@ -49,6 +49,11 @@ export function buildPromptComposerConfig(args) {
         disabledPlugins,
         skillAllowlist,
         memoriesMaxAgeDays,
+        memoryCurrentProjectOnly,
+        disableInstructions,
+        disableMemoryContext,
+        disableCapabilityContext,
+        disableSourcesContext,
         goalToolState,
         capabilityPromptSections,
         dynamicContextProviders,

package/dist/engine/run-tooling.js

@@ -51,8 +51,14 @@ export function buildRunToolContext(args) {
                 return reason;
             },
         },
+        skillAllowlist: options?.skillAllowlist !== undefined
+            ? [...options.skillAllowlist]
+            : args.base.skillAllowlist,
     };
-    if (profile?.allowedToolNames) {
+    if (options?.toolAllowlist !== undefined) {
+        toolCtx.allowedToolNames = new Set(options.toolAllowlist);
+    }
+    else if (profile?.allowedToolNames) {
         toolCtx.allowedToolNames = profile.allowedToolNames;
     }
     if (profile?.createRunServices) {

package/dist/engine/run-types.d.ts

@@ -32,6 +32,27 @@ export interface RunBehaviorProfile {
     disablePlanMode?: boolean;
     /** When true, MCP servers are neither connected nor exposed for the run. */
     disableMcp?: boolean;
+    /** Skip repository/user instruction discovery for this run. */
+    disableInstructions?: boolean;
+    /** Skip persistent-memory injection for this run. */
+    disableMemoryContext?: boolean;
+    /** Skip capability-owned volatile context providers for this run. */
+    disableCapabilityContext?: boolean;
+    /** Skip bound-source metadata injection for this run. */
+    disableSourcesContext?: boolean;
+    /** Ignore the project's default digital-human profile for this run. */
+    disableWorkspaceProfile?: boolean;
+    /** Skip SessionStart/UserPromptSubmit/SessionEnd hooks for this run. */
+    disableHooks?: boolean;
+    /** Skip auxiliary title generation for this run. */
+    disableSessionTitle?: boolean;
+    /**
+     * When true, the injected persistent-memory index is trimmed to this run's
+     * project: global-layer project-type / dream-scope records tied to other
+     * projects are dropped. Meant for manager-style profiles whose runs never
+     * work inside other repos.
+     */
+    memoryCurrentProjectOnly?: boolean;
     /**
      * Wrapper tag for host-provided runtime context injected at the system
      * prompt tail (e.g. "pet-world"). Injection happens only when both this tag
@@ -60,6 +81,10 @@ export interface RunBehaviorProfile {
 export declare const QUICK_CHAT_RESTRICTED_SYSTEM_PROMPT = "# Side Conversation Boundary\n\nThis is a side conversation, not the main-thread task execution environment.\n- Treat all content before this boundary as reference history only. Do not proactively continue any earlier plan, task, or modification.\n- Default to answering the user's question directly. Use lightweight read-only exploration only when needed.\n- Do not modify files, git state, configuration, or permissions unless the user explicitly asks after this boundary (for example, \"Allow you to modify files, please help me...\" or \"Please directly edit...\"). When explicitly requested, use the normally available tools subject to the current permission and approval mode.\n- Sub-agents are disabled for this side conversation. Do not create or invoke sub-agents.";
 /** The side-conversation restriction expressed as a generic behavior profile. */
 export declare const QUICK_CHAT_RESTRICTED_PROFILE: RunBehaviorProfile;
+export declare const ISOLATED_TASK_BEHAVIOR_MODE: "isolatedTask";
+export declare const ISOLATED_TASK_SYSTEM_PROMPT = "# Isolated Task Boundary\n\nThis is a bounded Task, not a continuation of any user conversation.\n- Use only the explicit Task input, the visible tool surface, and the selected Skill when one is available.\n- Do not infer or search for prior Session history, persistent memory, unrelated Skills, or other projects.\n- Do not create sub-agents or start unrelated work.\n- Finish the requested outcome, then return a concise result suitable for the owning application.";
+/** Minimal, process-local run profile used by host-owned Tasks. */
+export declare const ISOLATED_TASK_PROFILE: RunBehaviorProfile;
 export interface EngineRunOptions {
     cwd?: string;
     onStream?: StreamCallback;
@@ -76,6 +101,12 @@ export interface EngineRunOptions {
     attachments?: InputAttachmentMeta[];
     /** Named per-run behavior profile supplied by interactive product surfaces. */
     behaviorMode?: RunBehaviorMode;
+    /** Per-run hard tool allowlist. An empty list exposes no tools. */
+    toolAllowlist?: readonly string[];
+    /** Per-run hard Skill allowlist. An empty list exposes no Skills. */
+    skillAllowlist?: readonly string[];
+    /** Keep a fresh Session in process memory only and omit it from Session pickers. */
+    ephemeral?: boolean;
     /**
      * Generic per-run parameters consumed by the active behavior profile
      * (createRunServices / buildVisibilityMeta / runtime-context injection).

package/dist/engine/run-types.js

@@ -10,3 +10,24 @@ export const QUICK_CHAT_RESTRICTED_PROFILE = {
     id: "quickChatRestricted",
     systemPromptAppend: QUICK_CHAT_RESTRICTED_SYSTEM_PROMPT,
 };
+export const ISOLATED_TASK_BEHAVIOR_MODE = "isolatedTask";
+export const ISOLATED_TASK_SYSTEM_PROMPT = `# Isolated Task Boundary
+
+This is a bounded Task, not a continuation of any user conversation.
+- Use only the explicit Task input, the visible tool surface, and the selected Skill when one is available.
+- Do not infer or search for prior Session history, persistent memory, unrelated Skills, or other projects.
+- Do not create sub-agents or start unrelated work.
+- Finish the requested outcome, then return a concise result suitable for the owning application.`;
+/** Minimal, process-local run profile used by host-owned Tasks. */
+export const ISOLATED_TASK_PROFILE = {
+    id: ISOLATED_TASK_BEHAVIOR_MODE,
+    systemPromptAppend: ISOLATED_TASK_SYSTEM_PROMPT,
+    disableMcp: true,
+    disableInstructions: true,
+    disableMemoryContext: true,
+    disableCapabilityContext: true,
+    disableSourcesContext: true,
+    disableWorkspaceProfile: true,
+    disableHooks: true,
+    disableSessionTitle: true,
+};