@gajae-code/coding-agent 0.11.4 → 0.11.5

package/src/session/agent-session.ts

@@ -245,7 +245,6 @@ import {
 	persistCoordinatorRuntimeStateFromEvent,
 	registerCoordinatorRuntimeStateFinalizer,
 } from "../gjc-runtime/session-state-sidecar";
-import { writeArtifact } from "../gjc-runtime/state-writer";
 import { requestGjcWorkerIntegrationAttempt } from "../gjc-runtime/team-runtime";
 import { GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
@@ -295,8 +294,10 @@ import {
 	isMCPBridgeTool,
 	isMCPToolName,
 	selectDiscoverableToolNamesByServer,
+	selectRestorableDiscoveredBuiltinToolNames,
 } from "../tool-discovery/tool-index";
 import type { AskAnswerSource, ToolSession } from "../tools";
+import { computeEssentialBuiltinNames } from "../tools";
 import { AskTool } from "../tools/ask";
 import {
 	getAskAnswerSource as getAskAnswerSourceFromRegistry,
@@ -366,6 +367,8 @@ import type {
 	CompactionEntry,
 	DefaultModelSelectionStage,
 	NewSessionOptions,
+	RecoveryHydrationContext,
+	RecoveryHydrationPromotionFence,
 	SessionContext,
 	SessionEntry,
 	SessionManager,
@@ -432,11 +435,6 @@ export type AgentSessionEvent =
 	| { type: "thinking_level_changed"; thinkingLevel: ThinkingLevel | undefined }
 	| { type: "goal_updated"; goal: Goal | null; state?: GoalModeState };
 
-function isUnderProjectGjc(cwd: string, targetPath: string): boolean {
-	const relative = path.relative(path.join(path.resolve(cwd), ".gjc"), path.resolve(targetPath));
-	return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
-}
-
 /** Listener function for agent session events */
 export type AgentSessionEventListener = (event: AgentSessionEvent) => void;
 export type AsyncJobSnapshotItem = Pick<
@@ -529,12 +527,31 @@ export interface AgentSessionConfig {
 	discoveryMode?: "off" | "mcp-only" | "all";
 	/** MCP tool names to activate for the current session when discovery mode is enabled. */
 	initialSelectedMCPToolNames?: string[];
-	/** Whether constructor-provided MCP defaults should be persisted immediately. */
+	/** Built-in discoverable tool names restored for the current all-discovery session. */
+	initialSelectedDiscoveredBuiltinToolNames?: string[];
+	/** Discoverable built-ins active for configured or explicit reasons independently of persisted discovery selection. */
+	initialBaselineDiscoveredBuiltinToolNames?: string[];
+	/** Whether an MCP selection was explicitly supplied to the constructor, including an empty selection. */
+	initialMCPToolSelectionIsExplicit?: boolean;
+	/** Whether a discoverable built-in selection was explicitly supplied to the constructor, including an empty selection. */
+	initialDiscoveredBuiltinToolSelectionIsExplicit?: boolean;
+
+	/** Whether constructor-provided MCP selections should be persisted immediately. */
 	persistInitialMCPToolSelection?: boolean;
+	/** Whether constructor-provided discovered-built-in selections should be persisted immediately. */
+	persistInitialDiscoveredBuiltinToolSelection?: boolean;
+	/** Explicit MCP authority to write for a new session; distinct from active fallback tools. */
+	initialPersistedMCPToolNames?: string[];
+	/** Explicit discovered built-in authority to write for a new session; distinct from active fallback tools. */
+	initialPersistedDiscoveredBuiltinToolNames?: string[];
+	/** Immutable predecessor authority while a recovery host is read-only. */
+	recoveryHydrationContext?: RecoveryHydrationContext;
 	/** MCP server names whose tools should seed discovery-mode sessions whenever those servers are connected. */
 	defaultSelectedMCPServerNames?: string[];
 	/** MCP tool names that should seed brand-new sessions created from this AgentSession. */
 	defaultSelectedMCPToolNames?: string[];
+	/** MCP capabilities that are always active and never part of persisted user selection. */
+	mandatoryMCPToolNames?: string[];
 	/** TTSR manager for time-traveling stream rules */
 	ttsrManager?: TtsrManager;
 	/** Secret obfuscator for deobfuscating streaming edit content */
@@ -754,6 +771,30 @@ type RetryErrorClassification =
 	| "local_unavailable"
 	| "unknown";
 
+const BARE_DEFAULT_WATCHDOG_ERROR =
+	/^(?:[A-Za-z][A-Za-z0-9-]*(?: [A-Za-z][A-Za-z0-9-]*){0,3} )stream (?:timed out while waiting for the first event|stalled while waiting for the next event)$/;
+
+function hasBareDefaultRetryDisqualifyingFacts(message: AssistantMessage): boolean {
+	if (message.errorKind !== undefined || message.errorStatus !== undefined) return true;
+	const facts = message.transportFailure;
+	if (!facts) return false;
+	if (classifyFallbackTrigger(facts).class !== "other") return true;
+	return (
+		facts.status !== undefined ||
+		facts.providerCode !== undefined ||
+		facts.anthropicErrorType !== undefined ||
+		facts.openaiErrorCode !== undefined ||
+		(facts.headers !== undefined && Object.keys(facts.headers).length > 0)
+	);
+}
+
+function assistantMessageHasVisibleOrToolContent(message: AssistantMessage): boolean {
+	return message.content.some(content => {
+		if (content.type === "text") return content.text.length > 0;
+		return content.type === "thinking" || content.type === "redactedThinking" || content.type === "toolCall";
+	});
+}
+
 function isLocalModelEndpoint(model: Model | undefined): boolean {
 	if (!model) return false;
 	if (model.provider === "ollama" || model.provider === "lm-studio" || model.provider === "llama.cpp") {
@@ -949,11 +990,6 @@ function createHandoffContext(document: string): string {
 	return `<handoff-context>\n${document}\n</handoff-context>\n\nThe above is a handoff document from a previous session. Use this context to continue the work seamlessly.`;
 }
 
-function createHandoffFileName(date = new Date()): string {
-	const fileTimestamp = date.toISOString().replace(/[:.]/g, "-");
-	return `handoff-${fileTimestamp}.md`;
-}
-
 // ============================================================================
 // ACP Permission Gate
 // ============================================================================
@@ -1474,6 +1510,30 @@ export class AgentSession {
 	#lastMidRunMaintenanceAnchorSignature: string | undefined = undefined;
 	#resourceSampler: () => EmergencyCompactionSample = () => this.#defaultResourceSample();
 	#retainedMemorySampler: (() => RetainedMemorySample) | undefined;
+
+	/** Replay safety for the currently admitted top-level prompt/custom-message run. */
+	#retryReplayEpoch = 0;
+	#retryReplayUnsafeEpoch: number | undefined;
+
+	#resetRetryReplaySafety(): void {
+		this.#retryReplayEpoch++;
+		this.#retryReplayUnsafeEpoch = undefined;
+		if (
+			this.#extensionRunner?.hasHandlers("context") ||
+			this.#extensionRunner?.hasHandlers("before_provider_request") ||
+			this.#extensionRunner?.hasHandlers("after_provider_response")
+		) {
+			this.#markRetryReplayUnsafe();
+		}
+	}
+
+	#markRetryReplayUnsafe(): void {
+		if (this.#retryReplayEpoch > 0) this.#retryReplayUnsafeEpoch = this.#retryReplayEpoch;
+	}
+
+	get #hasCleanRetryReplaySafety(): boolean {
+		return this.#retryReplayEpoch > 0 && this.#retryReplayUnsafeEpoch !== this.#retryReplayEpoch;
+	}
 	#prePromptContextCheckPromise: Promise<void> | undefined = undefined;
 	/** Display-only context snapshot; pre-prompt compaction estimates deliberately remain uncached. */
 	#contextUsageCache: { key: string; value: ContextUsage } | undefined;
@@ -1612,12 +1672,17 @@ export class AgentSession {
 	// Generic tool discovery (covers built-in + MCP + extension when tools.discoveryMode === "all")
 	#discoverableToolSearchIndex: DiscoverableToolSearchIndex | null = null;
 	#selectedDiscoveredToolNames = new Set<string>();
+	#baselineDiscoveredBuiltinToolNames = new Set<string>();
 	#discoverableToolAllowedNames: ReadonlySet<string> | undefined;
 	#gjcSubskillToolNames = new Set<string>();
 	#gjcSubskillToolSignature: string | undefined;
 	#defaultSelectedMCPServerNames = new Set<string>();
 	#defaultSelectedMCPToolNames = new Set<string>();
-	#sessionDefaultSelectedMCPToolNames = new Map<string, string[]>();
+	#mandatoryMCPToolNames = new Set<string>();
+	/** Constructor authority applies only while this AgentSession instance remains alive. */
+	#constructorMCPToolSelection: string[] | undefined;
+	#constructorDiscoveredBuiltinToolSelection: string[] | undefined;
+	#recoveryHydrationContext: RecoveryHydrationContext | undefined;
 
 	// TTSR manager for time-traveling stream rules
 	#ttsrManager: TtsrManager | undefined = undefined;
@@ -2021,6 +2086,7 @@ export class AgentSession {
 		});
 		// Power assertions are taken per turn (see #beginInFlight); nothing acquired here.
 		this.#evalKernelOwnerId = config.evalKernelOwnerId ?? `agent-session:${Snowflake.next()}`;
+		this.#recoveryHydrationContext = config.recoveryHydrationContext;
 		this.#ownedAsyncJobManager = config.ownedAsyncJobManager;
 		this.#retainedMemorySampler = config.retainedMemorySampler;
 		this.#ownedMcpManager = config.ownedMcpManager;
@@ -2112,24 +2178,53 @@ export class AgentSession {
 			: undefined;
 		this.#setDiscoverableMCPTools(this.#collectDiscoverableMCPToolsFromRegistry());
 		this.#selectedMCPToolNames = new Set(config.initialSelectedMCPToolNames ?? []);
+		this.#selectedDiscoveredToolNames = new Set(
+			this.#selectRestorableDiscoveredBuiltinToolNames(config.initialSelectedDiscoveredBuiltinToolNames ?? []),
+		);
+		this.#baselineDiscoveredBuiltinToolNames = new Set(
+			selectRestorableDiscoveredBuiltinToolNames(
+				config.initialBaselineDiscoveredBuiltinToolNames ?? [],
+				this.#toolRegistry,
+				this.#discoverableToolAllowedNames,
+			),
+		);
 		this.#defaultSelectedMCPServerNames = new Set(config.defaultSelectedMCPServerNames ?? []);
 		this.#defaultSelectedMCPToolNames = new Set(config.defaultSelectedMCPToolNames ?? []);
+		this.#mandatoryMCPToolNames = new Set(
+			(config.mandatoryMCPToolNames ?? [])
+				.map(name => name.toLowerCase())
+				.filter(name => this.#toolRegistry.has(name)),
+		);
+		this.#constructorMCPToolSelection =
+			config.initialMCPToolSelectionIsExplicit === true
+				? this.#filterSelectableMCPToolNames(config.initialPersistedMCPToolNames ?? [])
+				: undefined;
+		this.#constructorDiscoveredBuiltinToolSelection =
+			config.initialDiscoveredBuiltinToolSelectionIsExplicit === true
+				? this.#selectRestorableDiscoveredBuiltinToolNames(config.initialPersistedDiscoveredBuiltinToolNames ?? [])
+				: undefined;
 		this.#pruneSelectedMCPToolNames();
-		const persistedSelectedMCPToolNames = this.buildDisplaySessionContext().selectedMCPToolNames;
-		const currentSelectedMCPToolNames = this.getSelectedMCPToolNames();
 		const persistInitialMCPToolSelection =
-			config.persistInitialMCPToolSelection ?? this.sessionManager.getBranch().length === 0;
+			config.persistInitialMCPToolSelection === true && config.initialMCPToolSelectionIsExplicit !== false;
+		const persistInitialDiscoveredBuiltinToolSelection =
+			config.persistInitialDiscoveredBuiltinToolSelection === true &&
+			config.initialDiscoveredBuiltinToolSelectionIsExplicit !== false;
 		if (
-			this.#mcpDiscoveryEnabled &&
-			persistInitialMCPToolSelection &&
-			!this.#selectedMCPToolNamesMatch(persistedSelectedMCPToolNames, currentSelectedMCPToolNames)
+			!this.#recoveryHydrationContext &&
+			(this.#mcpDiscoveryEnabled || this.#resolveEffectiveDiscoveryMode() === "all") &&
+			persistInitialMCPToolSelection
 		) {
-			this.sessionManager.appendMCPToolSelection(currentSelectedMCPToolNames);
+			this.sessionManager.appendMCPToolSelection(config.initialPersistedMCPToolNames ?? []);
+		}
+		if (
+			!this.#recoveryHydrationContext &&
+			this.#resolveEffectiveDiscoveryMode() === "all" &&
+			persistInitialDiscoveredBuiltinToolSelection
+		) {
+			this.sessionManager.appendDiscoveredBuiltinToolSelection(
+				config.initialPersistedDiscoveredBuiltinToolNames ?? [],
+			);
 		}
-		this.#rememberSessionDefaultSelectedMCPToolNames(
-			this.sessionManager.getSessionFile(),
-			this.#getConfiguredDefaultSelectedMCPToolNames(),
-		);
 		this.#ttsrManager = config.ttsrManager;
 		this.#obfuscator = config.obfuscator;
 		this.#agentId = config.agentId;
@@ -2187,11 +2282,37 @@ export class AgentSession {
 		// Re-evaluate append-only context mode when the setting changes at runtime.
 		this.#unsubscribeAppendOnly = onAppendOnlyModeChanged(_value => this.#syncAppendOnlyContext(this.model));
 		// SDK ToolSession callbacks capture the just-constructed session. Defer the
-		// initial ask-tool attachment until that capture has been assigned by the
+		// initial ask-tool registration until that capture has been assigned by the
 		// session factory, while retaining the durable emitter created above.
-		queueMicrotask(() => {
-			if (!this.#isDisposed) this.#ensureWorkflowGateAskTool();
+		this.#workflowGateToolRestoration = new Promise<void>((resolve, reject) => {
+			queueMicrotask(() => {
+				if (this.#isDisposed) {
+					resolve();
+					return;
+				}
+				try {
+					this.#registerWorkflowGateAskTool();
+					this.#attachAskToolIfWorkflowActive().then(resolve, reject);
+				} catch (error) {
+					reject(error instanceof Error ? error : new Error(String(error)));
+				}
+			});
 		});
+		// Non-SDK embedders may never observe the getter; a swallowed handler
+		// prevents an unhandled rejection while later awaits still reject.
+		this.#workflowGateToolRestoration.catch(() => {});
+	}
+
+	#workflowGateToolRestoration: Promise<void> = Promise.resolve();
+
+	/**
+	 * Resolves when constructor-time workflow-gate tool restoration (ask
+	 * registration plus durable active-workflow attachment) has settled. The
+	 * SDK factory awaits this so a resumed canonical workflow session is
+	 * returned with `ask` already resident.
+	 */
+	get workflowGateToolRestoration(): Promise<void> {
+		return this.#workflowGateToolRestoration;
 	}
 
 	/** Model registry for API key resolution and model discovery */
@@ -2900,17 +3021,16 @@ export class AgentSession {
 		if (thresholdTokens <= 0 || estimateTextTokensHeuristic(fullText) <= thresholdTokens) return;
 
 		try {
-			const artifact = await this.sessionManager.allocateArtifactPath("tool-result");
-			if (!artifact.id || !artifact.path) return;
-			await Bun.write(artifact.path, fullText);
+			const artifactId = await this.sessionManager.saveArtifact(fullText, "tool-result");
+			if (!artifactId) return;
 			const digest = crypto.createHash("sha256").update(fullText).digest("hex");
-			const preview = createPreAdmissionArtifactSpillPreview(fullText, artifact.id, digest);
+			const preview = createPreAdmissionArtifactSpillPreview(fullText, artifactId, digest);
 			const spillMeta = outputMeta()
 				.truncationFromText(preview, {
 					direction: "middle",
 					totalLines: fullText.split("\n").length,
 					totalBytes: Buffer.byteLength(fullText, "utf-8"),
-					artifactId: artifact.id,
+					artifactId,
 				})
 				.get();
 			const existingDetails = message.details;
@@ -2950,6 +3070,38 @@ export class AgentSession {
 
 	/** Internal handler for agent events - shared by subscribe and reconnect */
 	#handleAgentEvent = async (event: AgentEvent): Promise<void> => {
+		if (this.#extensionRunner?.hasHandlers(event.type)) this.#markRetryReplayUnsafe();
+		if (
+			event.type === "tool_execution_start" ||
+			event.type === "tool_execution_update" ||
+			event.type === "tool_execution_end"
+		) {
+			this.#markRetryReplayUnsafe();
+		} else if (event.type === "message_end") {
+			if (
+				event.message.role === "toolResult" ||
+				(event.message.role === "assistant" && assistantMessageHasVisibleOrToolContent(event.message))
+			) {
+				this.#markRetryReplayUnsafe();
+			}
+		} else if (event.type === "message_update") {
+			const update = event.assistantMessageEvent;
+			if (
+				update.type === "toolcall_start" ||
+				update.type === "toolcall_delta" ||
+				update.type === "toolcall_end" ||
+				((update.type === "text_delta" ||
+					update.type === "thinking_delta" ||
+					update.type === "reasoning_summary_delta") &&
+					update.delta.length > 0) ||
+				((update.type === "text_end" ||
+					update.type === "thinking_end" ||
+					update.type === "reasoning_summary_end") &&
+					update.content.length > 0)
+			) {
+				this.#markRetryReplayUnsafe();
+			}
+		}
 		// Record a successful final yield before any asynchronous extension work so a
 		// concurrently delivered agent_end cannot start post-turn maintenance first.
 		if (event.type === "tool_execution_end" && event.toolName === "yield" && !event.isError) {
@@ -3096,7 +3248,7 @@ export class AgentSession {
 		// Deobfuscate assistant message content for display emission — the LLM echoes back
 		// obfuscated placeholders, but listeners (TUI, extensions, exporters) must see real
 		// values. The original event.message stays obfuscated so the canonical persistence path above
-		// writes `#HASH#` tokens to the session file; convertToLlm re-obfuscates outbound
+		// writes authenticated placeholder tokens to the session file; convertToLlm re-obfuscates outbound
 		// traffic on the next turn. Walks text, thinking, and toolCall arguments/intent.
 		let displayEvent: AgentEvent = event;
 		const obfuscator = this.#obfuscator;
@@ -3621,6 +3773,7 @@ export class AgentSession {
 		suppressPredecessorAgentEnd?: boolean;
 		shouldContinue?: () => boolean;
 		onSkip?: (reason: "generation_changed" | "aborted_signal" | "queue_drained") => void;
+		allowDuringCancelAndSubmit?: boolean;
 		onError?: (error: unknown) => void;
 	}): Promise<void> {
 		const predecessorAgentEndHold = options?.suppressPredecessorAgentEnd
@@ -3655,7 +3808,7 @@ export class AgentSession {
 						skip("generation_changed");
 						return false;
 					}
-					if (this.#cancelAndSubmitInProgress) {
+					if (this.#cancelAndSubmitInProgress && !options?.allowDuringCancelAndSubmit) {
 						skip("queue_drained");
 						return false;
 					}
@@ -4291,6 +4444,7 @@ export class AgentSession {
 	#localProtocolOptions(): LocalProtocolOptions {
 		return {
 			getArtifactsDir: () => this.sessionManager.getArtifactsDir(),
+			isManagedDestination: () => this.sessionManager.isManagedDestination(),
 			getSessionId: () => this.sessionManager.getSessionId(),
 		};
 	}
@@ -4583,6 +4737,7 @@ export class AgentSession {
 					message: event.message,
 					contentIndex: event.assistantMessageEvent.contentIndex,
 				};
+				if (this.#extensionRunner.hasHandlers("reasoning_summary_start")) this.#markRetryReplayUnsafe();
 				await this.#extensionRunner.emit(reasoningEvent, continueWhile);
 			} else if (event.assistantMessageEvent.type === "reasoning_summary_delta") {
 				const reasoningEvent: ReasoningSummaryDeltaEvent = {
@@ -4591,6 +4746,7 @@ export class AgentSession {
 					contentIndex: event.assistantMessageEvent.contentIndex,
 					delta: event.assistantMessageEvent.delta,
 				};
+				if (this.#extensionRunner.hasHandlers("reasoning_summary_delta")) this.#markRetryReplayUnsafe();
 				await this.#extensionRunner.emit(reasoningEvent, continueWhile);
 			} else if (event.assistantMessageEvent.type === "reasoning_summary_end") {
 				const reasoningEvent: ReasoningSummaryEndEvent = {
@@ -4599,6 +4755,7 @@ export class AgentSession {
 					contentIndex: event.assistantMessageEvent.contentIndex,
 					content: event.assistantMessageEvent.content,
 				};
+				if (this.#extensionRunner.hasHandlers("reasoning_summary_end")) this.#markRetryReplayUnsafe();
 				await this.#extensionRunner.emit(reasoningEvent, continueWhile);
 			}
 		} else if (event.type === "message_end") {
@@ -4652,6 +4809,7 @@ export class AgentSession {
 				continuationSkipReason: event.continuationSkipReason,
 			});
 		} else if (event.type === "auto_retry_start") {
+			if (this.#extensionRunner.hasHandlers("auto_retry_start")) this.#markRetryReplayUnsafe();
 			await this.#extensionRunner.emit({
 				type: "auto_retry_start",
 				attempt: event.attempt,
@@ -5090,29 +5248,66 @@ export class AgentSession {
 		return left.length === right.length && left.every((name, index) => name === right[index]);
 	}
 
-	#rememberSessionDefaultSelectedMCPToolNames(
-		sessionFile: string | null | undefined,
-		toolNames: Iterable<string>,
-	): void {
-		if (!sessionFile) return;
-		this.#sessionDefaultSelectedMCPToolNames.set(
-			path.resolve(sessionFile),
-			this.#filterSelectableMCPToolNames(toolNames),
+	#resolveConstructorMCPToolSelection(): string[] | undefined {
+		return this.#constructorMCPToolSelection
+			? this.#filterSelectableMCPToolNames(this.#constructorMCPToolSelection)
+			: undefined;
+	}
+
+	#selectRestorableDiscoveredBuiltinToolNames(toolNames: Iterable<string>): string[] {
+		return selectRestorableDiscoveredBuiltinToolNames(
+			toolNames,
+			this.#toolRegistry,
+			this.#discoverableToolAllowedNames,
+			new Set(computeEssentialBuiltinNames(this.settings)),
 		);
 	}
 
-	#getSessionDefaultSelectedMCPToolNames(sessionFile: string | null | undefined): string[] {
-		if (!sessionFile) return [];
-		return this.#sessionDefaultSelectedMCPToolNames.get(path.resolve(sessionFile)) ?? [];
+	#resolveConstructorDiscoveredBuiltinToolSelection(): string[] | undefined {
+		return this.#constructorDiscoveredBuiltinToolSelection
+			? this.#selectRestorableDiscoveredBuiltinToolNames(this.#constructorDiscoveredBuiltinToolSelection)
+			: undefined;
+	}
+
+	#clearConstructorToolSelectionAuthority(): void {
+		this.#constructorMCPToolSelection = undefined;
+		this.#constructorDiscoveredBuiltinToolSelection = undefined;
 	}
 
-	#persistSelectedMCPToolNamesIfChanged(previousSelectedMCPToolNames: string[]): void {
-		if (!this.#mcpDiscoveryEnabled) return;
+	#getSelectedDiscoveredBuiltinToolNames(): string[] {
+		return this.#selectRestorableDiscoveredBuiltinToolNames(this.#selectedDiscoveredToolNames).filter(name =>
+			this.getActiveToolNames().includes(name),
+		);
+	}
+
+	#persistSelectedMCPToolNamesIfChanged(
+		previousSelectedMCPToolNames: string[],
+		previousSelectedDiscoveredBuiltinToolNames: string[],
+	): void {
+		if (!this.#mcpDiscoveryEnabled && this.#resolveEffectiveDiscoveryMode() !== "all") return;
 		const nextSelectedMCPToolNames = this.getSelectedMCPToolNames();
-		if (this.#selectedMCPToolNamesMatch(previousSelectedMCPToolNames, nextSelectedMCPToolNames)) {
-			return;
+		const nextSelectedDiscoveredBuiltinToolNames = this.#getSelectedDiscoveredBuiltinToolNames();
+		const mcpSelectionChanged = !this.#selectedMCPToolNamesMatch(
+			previousSelectedMCPToolNames,
+			nextSelectedMCPToolNames,
+		);
+		const discoveredBuiltinSelectionChanged =
+			this.#resolveEffectiveDiscoveryMode() === "all" &&
+			!this.#selectedMCPToolNamesMatch(
+				previousSelectedDiscoveredBuiltinToolNames,
+				nextSelectedDiscoveredBuiltinToolNames,
+			);
+		const mutationCorrelationId =
+			mcpSelectionChanged && discoveredBuiltinSelectionChanged ? crypto.randomUUID() : undefined;
+		if (mcpSelectionChanged) {
+			this.sessionManager.appendMCPToolSelection(nextSelectedMCPToolNames, mutationCorrelationId);
+		}
+		if (discoveredBuiltinSelectionChanged) {
+			this.sessionManager.appendDiscoveredBuiltinToolSelection(
+				nextSelectedDiscoveredBuiltinToolNames,
+				mutationCorrelationId,
+			);
 		}
-		this.sessionManager.appendMCPToolSelection(nextSelectedMCPToolNames);
 	}
 
 	#getActiveNonMCPToolNames(): string[] {
@@ -5291,30 +5486,13 @@ export class AgentSession {
 
 	getSelectedMCPToolNames(): string[] {
 		if (!this.#mcpDiscoveryEnabled) {
-			return this.getActiveToolNames().filter(name => isMCPToolName(name) && this.#toolRegistry.has(name));
-		}
-		return this.#filterSelectableMCPToolNames(this.#selectedMCPToolNames);
-	}
-
-	async #activateDiscoveredMCPTools(toolNames: string[]): Promise<string[]> {
-		const nextSelectedMCPToolNames = new Set(this.#selectedMCPToolNames);
-		const activated: string[] = [];
-		for (const name of toolNames) {
-			if (!this.#discoverableMCPTools.has(name) || !this.#toolRegistry.has(name)) {
-				continue;
-			}
-			nextSelectedMCPToolNames.add(name);
-			activated.push(name);
-		}
-		if (activated.length === 0) {
-			return [];
+			return this.getActiveToolNames().filter(
+				name => isMCPToolName(name) && this.#toolRegistry.has(name) && !this.#mandatoryMCPToolNames.has(name),
+			);
 		}
-		const nextActive = [
-			...this.#getActiveNonMCPToolNames(),
-			...this.#filterSelectableMCPToolNames(nextSelectedMCPToolNames),
-		];
-		await this.setActiveToolsByName(nextActive);
-		return [...new Set(activated)];
+		return this.#filterSelectableMCPToolNames(this.#selectedMCPToolNames).filter(
+			name => !this.#mandatoryMCPToolNames.has(name),
+		);
 	}
 
 	// ── Generic tool discovery (covers built-in + MCP + extension) ────────────
@@ -5362,54 +5540,44 @@ export class AgentSession {
 		return this.#discoverableToolSearchIndex;
 	}
 
-	/** Invalidate the generic search index cache (call after tool set changes).
-	 *  Delegates to {@link #invalidateDiscoveryCaches} so all discovery-related caches stay in sync. */
-	#invalidateDiscoverableToolSearchIndex(): void {
-		this.#invalidateDiscoveryCaches();
-	}
-
 	getSelectedDiscoveredToolNames(): string[] {
-		// Union of MCP-selected and generic non-MCP selected. Non-MCP selections are only
-		// selected while they are still active; otherwise BM25 must be able to rediscover them.
-		const activeNames = new Set(this.getActiveToolNames());
 		const mcpSelected = this.getSelectedMCPToolNames();
-		const nonMcpSelected = Array.from(this.#selectedDiscoveredToolNames).filter(
-			name => activeNames.has(name) && this.#toolRegistry.has(name) && !isMCPToolName(name),
-		);
-		return [...new Set([...mcpSelected, ...nonMcpSelected])];
+		return [...new Set([...mcpSelected, ...this.#getSelectedDiscoveredBuiltinToolNames()])];
 	}
 
 	async activateDiscoveredTools(toolNames: string[]): Promise<string[]> {
-		const mcpNames = toolNames.filter(name => this.#discoverableMCPTools.has(name));
-		const nonMcpNames = toolNames.filter(name => !this.#discoverableMCPTools.has(name));
+		const previousSelectedMCPToolNames = this.getSelectedMCPToolNames();
+		const previousSelectedDiscoveredBuiltinToolNames = this.#getSelectedDiscoveredBuiltinToolNames();
+		const nextActiveToolNames = this.getActiveToolNames();
+		const nextActiveNameSet = new Set(nextActiveToolNames);
+		const nextSelectedDiscoveredBuiltinToolNames = new Set(this.#selectedDiscoveredToolNames);
 		const activated: string[] = [];
-
-		// Activate MCP tools via existing path
-		if (mcpNames.length > 0) {
-			const activatedMcp = await this.#activateDiscoveredMCPTools(mcpNames);
-			activated.push(...activatedMcp);
-		}
-
-		// Activate non-MCP tools (built-ins that are in the registry but not currently active)
-		if (nonMcpNames.length > 0) {
-			const currentActiveNames = new Set(this.getActiveToolNames());
-			const newlyAdded: string[] = [];
-			for (const name of nonMcpNames) {
-				if (this.#discoverableToolAllowedNames && !this.#discoverableToolAllowedNames.has(name)) continue;
-				if (this.#toolRegistry.has(name) && !currentActiveNames.has(name)) {
-					newlyAdded.push(name);
-					this.#selectedDiscoveredToolNames.add(name);
+		for (const name of new Set(toolNames)) {
+			if (this.#discoverableMCPTools.has(name) && this.#toolRegistry.has(name)) {
+				if (!nextActiveNameSet.has(name)) {
+					nextActiveToolNames.push(name);
+					nextActiveNameSet.add(name);
 					activated.push(name);
 				}
+				continue;
 			}
-			if (newlyAdded.length > 0) {
-				const nextActive = [...this.getActiveToolNames(), ...newlyAdded];
-				await this.setActiveToolsByName(nextActive);
-				this.#invalidateDiscoverableToolSearchIndex();
-			}
+			if (this.#discoverableToolAllowedNames && !this.#discoverableToolAllowedNames.has(name)) continue;
+			const tool = this.#toolRegistry.get(name);
+			if (tool?.loadMode === "discoverable" && !nextActiveNameSet.has(name)) {
+				nextActiveToolNames.push(name);
+				nextActiveNameSet.add(name);
+				nextSelectedDiscoveredBuiltinToolNames.add(name);
+				activated.push(name);
+			}
+		}
+		if (activated.length > 0) {
+			await this.#applyActiveToolsByName(nextActiveToolNames, {
+				previousSelectedMCPToolNames,
+				previousSelectedDiscoveredBuiltinToolNames,
+				nextSelectedDiscoveredBuiltinToolNames: [...nextSelectedDiscoveredBuiltinToolNames],
+			});
 		}
-
-		return [...new Set(activated)];
+		return activated;
 	}
 
 	/** Wrap guarded tools so SDK permission modes remain fail-closed without a reverse provider. */
@@ -5597,10 +5765,17 @@ export class AgentSession {
 
 	async #applyActiveToolsByName(
 		toolNames: string[],
-		options?: { persistMCPSelection?: boolean; previousSelectedMCPToolNames?: string[] },
+		options?: {
+			persistMCPSelection?: boolean;
+			previousSelectedMCPToolNames?: string[];
+			previousSelectedDiscoveredBuiltinToolNames?: string[];
+			nextSelectedDiscoveredBuiltinToolNames?: string[];
+		},
 	): Promise<void> {
-		toolNames = [...new Set(toolNames.map(name => name.toLowerCase()))];
+		toolNames = [...new Set([...toolNames.map(name => name.toLowerCase()), ...this.#mandatoryMCPToolNames])];
 		const previousSelectedMCPToolNames = options?.previousSelectedMCPToolNames ?? this.getSelectedMCPToolNames();
+		const previousSelectedDiscoveredBuiltinToolNames =
+			options?.previousSelectedDiscoveredBuiltinToolNames ?? this.#getSelectedDiscoveredBuiltinToolNames();
 		const tools: AgentTool[] = [];
 		const validToolNames: string[] = [];
 		for (const name of toolNames) {
@@ -5610,37 +5785,29 @@ export class AgentSession {
 				validToolNames.push(name);
 			}
 		}
-		if (this.#mcpDiscoveryEnabled) {
-			this.#selectedMCPToolNames = new Set(
-				validToolNames.filter(
-					name => isMCPToolName(name) && this.#discoverableMCPTools.has(name) && this.#toolRegistry.has(name),
-				),
-			);
-		}
+		const nextSelectedMCPToolNames = this.#mcpDiscoveryEnabled
+			? new Set(
+					validToolNames.filter(
+						name =>
+							isMCPToolName(name) &&
+							!this.#mandatoryMCPToolNames.has(name) &&
+							this.#discoverableMCPTools.has(name) &&
+							this.#toolRegistry.has(name),
+					),
+				)
+			: this.#selectedMCPToolNames;
 		const activeNameSet = new Set(validToolNames);
-		for (const name of Array.from(this.#selectedDiscoveredToolNames)) {
+		const nextSelectedDiscoveredBuiltinToolNames = new Set(
+			options?.nextSelectedDiscoveredBuiltinToolNames ?? this.#selectedDiscoveredToolNames,
+		);
+		for (const name of nextSelectedDiscoveredBuiltinToolNames) {
 			if (!activeNameSet.has(name) || this.#discoverableMCPTools.has(name) || !this.#toolRegistry.has(name)) {
-				this.#selectedDiscoveredToolNames.delete(name);
+				nextSelectedDiscoveredBuiltinToolNames.delete(name);
 			}
 		}
 		const signature = this.#computeAppliedToolSignature(validToolNames, tools);
 		const promptRelevantToolsChanged =
 			signature !== (this.#pendingAppliedToolSignature ?? this.#lastAppliedToolSignature);
-		if (promptRelevantToolsChanged) {
-			this.#defaultModelSelectionMutationRevision++;
-			this.#pendingAppliedToolSignature = signature;
-		}
-		this.#setGuardedAgentTools(tools);
-
-		// Active tool set changed → discoverable tool list (which excludes already-active tools)
-		// is now stale. Invalidate before any prompt-template hook reads the discovery list.
-		this.#invalidateDiscoveryCaches();
-
-		// Rebuild base system prompt with new tool set, but only when the tool set
-		// actually changed. MCP servers can reconnect at arbitrary times and call
-		// `refreshMCPTools` -> `#applyActiveToolsByName` even though the resulting
-		// tool list is byte-identical. Skipping the rebuild keeps the system prompt
-		// stable, which is required for Anthropic prompt caching to keep hitting.
 		if (promptRelevantToolsChanged && this.#rebuildSystemPrompt) {
 			const generation = this.#reserveBaseSystemPromptGeneration();
 			try {
@@ -5663,8 +5830,16 @@ export class AgentSession {
 			this.#lastAppliedToolSignature = signature;
 			this.#pendingAppliedToolSignature = undefined;
 		}
+		if (promptRelevantToolsChanged) this.#defaultModelSelectionMutationRevision++;
+		this.#selectedMCPToolNames = nextSelectedMCPToolNames;
+		this.#selectedDiscoveredToolNames = nextSelectedDiscoveredBuiltinToolNames;
+		this.#setGuardedAgentTools(tools);
+		this.#invalidateDiscoveryCaches();
 		if (options?.persistMCPSelection !== false) {
-			this.#persistSelectedMCPToolNamesIfChanged(previousSelectedMCPToolNames);
+			this.#persistSelectedMCPToolNamesIfChanged(
+				previousSelectedMCPToolNames,
+				previousSelectedDiscoveredBuiltinToolNames,
+			);
 		}
 	}
 
@@ -5717,24 +5892,33 @@ export class AgentSession {
 		await this.#applyActiveToolsByName(toolNames);
 	}
 
-	async #restoreMCPSelectionsForSessionContext(
-		sessionContext: SessionContext,
-		options?: { fallbackSelectedMCPToolNames?: Iterable<string> },
-	): Promise<void> {
-		if (!this.#mcpDiscoveryEnabled) return;
-		const nextActiveNonMCPToolNames = this.#getActiveNonMCPToolNames();
-		const fallbackSelectedMCPToolNames =
-			options?.fallbackSelectedMCPToolNames ?? this.#getConfiguredDefaultSelectedMCPToolNames();
+	async #restoreMCPSelectionsForSessionContext(sessionContext: SessionContext): Promise<void> {
+		if (!this.#mcpDiscoveryEnabled && this.#resolveEffectiveDiscoveryMode() !== "all") {
+			await this.#attachAskToolIfWorkflowActive();
+			return;
+		}
+		const selectionOnlyDiscoveredBuiltinToolNames = new Set(
+			this.#getSelectedDiscoveredBuiltinToolNames().filter(
+				name => !this.#baselineDiscoveredBuiltinToolNames.has(name),
+			),
+		);
+		const nextActiveNonMCPToolNames = this.#getActiveNonMCPToolNames().filter(
+			name => name !== "ask" && !selectionOnlyDiscoveredBuiltinToolNames.has(name),
+		);
+		const constructorMCPToolNames = this.#resolveConstructorMCPToolSelection();
 		const restoredMCPToolNames = sessionContext.hasPersistedMCPToolSelection
 			? this.#filterSelectableMCPToolNames(sessionContext.selectedMCPToolNames)
-			: this.#filterSelectableMCPToolNames(fallbackSelectedMCPToolNames);
-		this.#rememberSessionDefaultSelectedMCPToolNames(
-			this.sessionFile,
-			this.#getConfiguredDefaultSelectedMCPToolNames(),
+			: (constructorMCPToolNames ?? this.#getConfiguredDefaultSelectedMCPToolNames());
+		const constructorDiscoveredBuiltinToolNames = this.#resolveConstructorDiscoveredBuiltinToolSelection();
+		const restoredDiscoveredBuiltinToolNames = sessionContext.hasPersistedDiscoveredBuiltinToolSelection
+			? this.#selectRestorableDiscoveredBuiltinToolNames(sessionContext.selectedDiscoveredBuiltinToolNames ?? [])
+			: (constructorDiscoveredBuiltinToolNames ?? []);
+		this.#selectedDiscoveredToolNames = new Set(restoredDiscoveredBuiltinToolNames);
+		await this.#applyActiveToolsByName(
+			[...nextActiveNonMCPToolNames, ...restoredMCPToolNames, ...restoredDiscoveredBuiltinToolNames],
+			{ persistMCPSelection: false },
 		);
-		await this.#applyActiveToolsByName([...nextActiveNonMCPToolNames, ...restoredMCPToolNames], {
-			persistMCPSelection: false,
-		});
+		await this.#attachAskToolIfWorkflowActive();
 	}
 	/** Rebuild the base system prompt using the current active tool set. */
 	async refreshBaseSystemPrompt(): Promise<void> {
@@ -5878,19 +6062,17 @@ export class AgentSession {
 
 		this.#setDiscoverableMCPTools(this.#collectDiscoverableMCPToolsFromRegistry());
 		this.#pruneSelectedMCPToolNames();
-		if (!this.buildDisplaySessionContext().hasPersistedMCPToolSelection) {
-			this.#selectedMCPToolNames = new Set([
-				...this.#selectedMCPToolNames,
-				...this.#getConfiguredDefaultSelectedMCPToolNames(),
-			]);
+		const hasPersistedMCPToolSelection = this.buildDisplaySessionContext().hasPersistedMCPToolSelection;
+		if (!hasPersistedMCPToolSelection) {
+			this.#selectedMCPToolNames = new Set(
+				this.#resolveConstructorMCPToolSelection() ?? this.#getConfiguredDefaultSelectedMCPToolNames(),
+			);
 		}
-		this.#rememberSessionDefaultSelectedMCPToolNames(
-			this.sessionFile,
-			this.#getConfiguredDefaultSelectedMCPToolNames(),
-		);
-
 		const nextActive = [...this.#getActiveNonMCPToolNames(), ...this.getSelectedMCPToolNames()];
-		await this.#applyActiveToolsByName(nextActive, { previousSelectedMCPToolNames });
+		await this.#applyActiveToolsByName(nextActive, {
+			previousSelectedMCPToolNames,
+			persistMCPSelection: hasPersistedMCPToolSelection,
+		});
 	}
 
 	async #hasActiveGjcSubskillTools(parent: string, sessionId: string | undefined): Promise<boolean> {
@@ -6035,8 +6217,29 @@ export class AgentSession {
 		return this.#promptGeneration;
 	}
 
+	/** The immutable recovery authority, present only before external ownership promotion. */
+	get recoveryHydrationContext(): RecoveryHydrationContext | undefined {
+		return this.#recoveryHydrationContext;
+	}
+
+	/** Enables normal session mutations after the owner has published its durable fence and writer lease. */
+	async promoteRecoveryHydrationAfterOwnershipReadyFence(fence: RecoveryHydrationPromotionFence): Promise<void> {
+		const context = this.#recoveryHydrationContext;
+		if (!context) throw new Error("Agent session is not awaiting recovery hydration promotion.");
+		await this.sessionManager.promoteRecoveryHydrationAfterOwnershipReadyFence(context, fence);
+		this.#recoveryHydrationContext = undefined;
+	}
+
+	/** Recovery hydration must not start a continuation before ownership promotion. */
+	#assertRecoveryHydrationPromoted(): void {
+		if (this.#recoveryHydrationContext) {
+			throw new Error("Recovery hydration has not been promoted to a writer-owning session.");
+		}
+	}
+
 	/** Main startup calls this exactly once, after a strict open returned `kind: "opened"`. */
 	async continuePersistedHistory(): Promise<void> {
+		this.#assertRecoveryHydrationPromoted();
 		this.#removeEphemeralCustomMessages();
 
 		if (!canContinuePersistedHistory(this.agent.state.messages)) {
@@ -6392,33 +6595,70 @@ export class AgentSession {
 		this.#workflowGateEmitter = emitter;
 		notifyWorkflowGateEmitterChanged(this.sessionId, emitter);
 		if (emitter) {
-			this.#ensureWorkflowGateAskTool();
+			this.#registerWorkflowGateAskTool();
 		}
 	}
 
-	#ensureWorkflowGateAskTool(): void {
-		if (this.#toolRegistry.has("ask")) return;
+	#registerWorkflowGateAskTool(): void {
 		if (!this.#workflowGateToolSession) return;
 
-		const askTool = AskTool.createIf(this.#workflowGateToolSession);
-		if (!askTool) return;
+		let askTool = this.#toolRegistry.get("ask");
+		if (!askTool) {
+			const createdAskTool = AskTool.createIf(this.#workflowGateToolSession);
+			if (!createdAskTool) return;
+			const wrappedTool = wrapToolWithMetaNotice(createdAskTool as unknown as AgentTool);
+			askTool = this.#extensionRunner ? new ExtensionToolWrapper(wrappedTool, this.#extensionRunner) : wrappedTool;
+			this.#toolRegistry.set(askTool.name, askTool);
+		}
 
-		const wrappedTool = wrapToolWithMetaNotice(askTool as unknown as AgentTool);
-		const finalTool: AgentTool = this.#extensionRunner
-			? new ExtensionToolWrapper(wrappedTool, this.#extensionRunner)
-			: wrappedTool;
-		this.#toolRegistry.set(finalTool.name, finalTool);
+		try {
+			if ((this.#workflowGateEmitter?.listPendingGates?.().length ?? 0) > 0) {
+				this.#attachAskTool();
+			}
+		} catch (error) {
+			logger.warn("Failed to inspect pending workflow gates; activating ask tool conservatively", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+			this.#attachAskTool();
+		}
+	}
 
-		if (!this.getActiveToolNames().includes(finalTool.name)) {
-			const activeTools = [...this.agent.state.tools, finalTool];
-			this.#setGuardedAgentTools(activeTools);
-			this.#invalidateDiscoveryCaches();
-			void this.refreshBaseSystemPrompt().catch(error => {
-				logger.warn("Failed to refresh system prompt after workflow gate ask tool registration", {
+	async #attachAskToolIfWorkflowActive(): Promise<void> {
+		const sessionId = this.sessionManager.getSessionId();
+		const inMemoryActiveSkill =
+			this.#activeSkillState && (!this.#activeSkillState.sessionId || this.#activeSkillState.sessionId === sessionId)
+				? this.#activeSkillState.skill
+				: undefined;
+		let activeSkill = inMemoryActiveSkill;
+		if (!activeSkill) {
+			try {
+				const activeState = await readVisibleSkillActiveState(this.sessionManager.getCwd(), sessionId);
+				activeSkill =
+					activeState?.skill ?? activeState?.active_skills?.find(entry => entry.active !== false)?.skill;
+			} catch (error) {
+				logger.warn("Failed to read durable workflow skill state while restoring ask tool", {
 					error: error instanceof Error ? error.message : String(error),
 				});
-			});
+				return;
+			}
+			// Identity fence: the durable read is async — the session may have been
+			// disposed or switched to a different identity meanwhile. Never attach
+			// a predecessor session's workflow state to the current identity.
+			if (this.#isDisposed || this.sessionManager.getSessionId() !== sessionId) return;
 		}
+		if (activeSkill && isCanonicalGjcWorkflowSkill(activeSkill.trim())) this.#attachAskTool();
+	}
+
+	#attachAskTool(): void {
+		const askTool = this.#toolRegistry.get("ask");
+		if (!askTool || this.getActiveToolNames().includes(askTool.name)) return;
+		this.#setGuardedAgentTools([...this.agent.state.tools, askTool]);
+		this.#invalidateDiscoveryCaches();
+		void this.refreshBaseSystemPrompt().catch(error => {
+			logger.warn("Failed to refresh system prompt after workflow gate ask tool activation", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+		});
 	}
 
 	get goalRuntime(): GoalRuntime {
@@ -6894,6 +7134,7 @@ export class AgentSession {
 					...options,
 					prependMessages: eagerTodoPrelude ? [eagerTodoPrelude.message] : undefined,
 					admissionLease: admission,
+					resetRetryReplaySafety: true,
 				});
 			} finally {
 				// Clean up residual eager-todo directive if the prompt never consumed it
@@ -6916,6 +7157,11 @@ export class AgentSession {
 		const name = (details as { name?: unknown }).name;
 		if (typeof name !== "string" || !name.trim()) return;
 		const skill = name.trim();
+		// Functional tool availability must not depend on the best-effort
+		// observational state-sync below (whose failures are swallowed by
+		// #syncSkillPromptActiveStateSafely): attach ask first so canonical
+		// workflow skills can always call it.
+		if (active && isCanonicalGjcWorkflowSkill(skill)) this.#attachAskTool();
 		const sessionId = this.sessionManager.getSessionId();
 		// Canonical GJC workflow skills (deep-interview, ralplan, ultragoal, team)
 		// own their `.gjc/state/skill-active-state.json` row through the
@@ -7021,7 +7267,11 @@ export class AgentSession {
 
 			await this.#syncSkillPromptActiveStateSafely(customMessage, true);
 			try {
-				await this.#promptWithMessage(customMessage, textContent, { ...options, admissionLease: admission });
+				await this.#promptWithMessage(customMessage, textContent, {
+					...options,
+					admissionLease: admission,
+					resetRetryReplaySafety: true,
+				});
 			} finally {
 				await this.#syncSkillPromptActiveStateSafely(customMessage, false);
 			}
@@ -7037,6 +7287,7 @@ export class AgentSession {
 			predecessorAgentEndHold?: symbol;
 			admissionLease?: SessionAdmissionLease;
 			onRunAccepted?: () => void;
+			resetRetryReplaySafety?: boolean;
 		},
 	): Promise<void> {
 		await this.#agentEndPublicationPromise;
@@ -7049,6 +7300,7 @@ export class AgentSession {
 		let hindsightRecall: string | undefined;
 		try {
 			this.#throwIfPromptPreflightCancelled(generation, preflightSignal);
+			if (options?.resetRetryReplaySafety) this.#resetRetryReplaySafety();
 			if (message.role === "user") {
 				await this.#resetDefaultFallbackForNewTurn();
 				await this.#ensureDefaultFallbackResolution();
@@ -7188,6 +7440,8 @@ export class AgentSession {
 
 			// Emit before_agent_start extension event. Race hook completion with prompt
 			// cancellation so a wedged hook cannot retain SDK prompt authority.
+			if (this.#extensionRunner?.hasHandlers("before_agent_start")) this.#markRetryReplayUnsafe();
+
 			if (this.#extensionRunner) {
 				const result = await this.#awaitPromptPreflight(
 					generation,
@@ -7458,6 +7712,8 @@ export class AgentSession {
 		} as unknown as HookCommandContext;
 
 		try {
+			this.#markRetryReplayUnsafe();
+
 			const args = parseCommandArgs(argsString);
 			const result = await loaded.command.execute(args, ctx);
 			// If result is a string, it's a prompt to send to LLM
@@ -8188,6 +8444,7 @@ export class AgentSession {
 				: undefined;
 		this.#abortActiveMidRunBarriers();
 		this.#silentAbortPending = options?.silent === true;
+		this.#markRetryReplayUnsafe();
 		this.abortRetry();
 		this.#promptGeneration++;
 		this.#promptPreflightAbortController.abort();
@@ -8426,6 +8683,7 @@ export class AgentSession {
 					try {
 						await this.#promptWithMessage(message, messageText, {
 							admissionLease: admission,
+							resetRetryReplaySafety: true,
 							onRunAccepted: () => {
 								runAccepted = true;
 								if (selected) {
@@ -8481,10 +8739,17 @@ export class AgentSession {
 	async #runNewSessionTransition(options?: NewSessionOptions): Promise<boolean> {
 		const previousSessionFile = this.sessionFile;
 		const previousWorkflowGateSessionId = this.sessionId;
+		const selectionOnlyDiscoveredBuiltinToolNames = new Set(
+			this.#getSelectedDiscoveredBuiltinToolNames().filter(
+				name => !this.#baselineDiscoveredBuiltinToolNames.has(name),
+			),
+		);
 		const nextDiscoverySessionToolNames = this.#mcpDiscoveryEnabled
 			? [
-					...this.#getActiveNonMCPToolNames(),
-					...this.#filterSelectableMCPToolNames(this.#defaultSelectedMCPToolNames),
+					...this.#getActiveNonMCPToolNames().filter(
+						name => name !== "ask" && !selectionOnlyDiscoveredBuiltinToolNames.has(name),
+					),
+					...this.#getConfiguredDefaultSelectedMCPToolNames(),
 				]
 			: undefined;
 
@@ -8626,6 +8891,7 @@ export class AgentSession {
 		nextDiscoverySessionToolNames: string[] | undefined,
 		previousSessionFile: string | undefined,
 	): Promise<void> {
+		this.#clearConstructorToolSelectionAuthority();
 		const inheritedThinkingLevel = resolveThinkingLevelForModel(this.model, this.#getInheritedThinkingLevel());
 		this.#thinkingLevel = inheritedThinkingLevel;
 		this.agent.setThinkingLevel(toReasoningEffort(inheritedThinkingLevel));
@@ -8635,15 +8901,11 @@ export class AgentSession {
 		}
 		this.sessionManager.appendServiceTierChange(this.serviceTier ?? null);
 		if (nextDiscoverySessionToolNames) {
-			await this.#applyActiveToolsByName(nextDiscoverySessionToolNames, { persistMCPSelection: false });
-			if (this.getSelectedMCPToolNames().length > 0) {
-				this.sessionManager.appendMCPToolSelection(this.getSelectedMCPToolNames());
-			}
+			await this.#applyActiveToolsByName(nextDiscoverySessionToolNames, {
+				persistMCPSelection: false,
+				nextSelectedDiscoveredBuiltinToolNames: [],
+			});
 		}
-		this.#rememberSessionDefaultSelectedMCPToolNames(
-			this.sessionFile,
-			this.#getConfiguredDefaultSelectedMCPToolNames(),
-		);
 		this.#todoReminderCount = 0;
 		this.#planReferenceSent = false;
 		this.#planReferencePath = "local://PLAN.md";
@@ -8731,25 +8993,6 @@ export class AgentSession {
 			return false;
 		}
 
-		// Copy artifacts directory if it exists
-		const oldArtifactDir = forkResult.oldSessionFile.slice(0, -6);
-		const newArtifactDir = forkResult.newSessionFile.slice(0, -6);
-
-		try {
-			const oldDirStat = await fs.promises.stat(oldArtifactDir);
-			if (oldDirStat.isDirectory()) {
-				await fs.promises.cp(oldArtifactDir, newArtifactDir, { recursive: true });
-			}
-		} catch (err) {
-			if (!isEnoent(err)) {
-				logger.warn("Failed to copy artifacts during fork", {
-					oldArtifactDir,
-					newArtifactDir,
-					error: err instanceof Error ? err.message : String(err),
-				});
-			}
-		}
-
 		// Update agent session ID
 		this.#syncAgentSessionId();
 		this.#bindWorkflowGateEmitter(previousWorkflowGateSessionId);
@@ -10092,27 +10335,13 @@ export class AgentSession {
 			await this.sessionManager.ensureOnDisk();
 			let savedPath: string | undefined;
 			if (options?.autoTriggered && this.settings.get("compaction.handoffSaveToDisk")) {
-				const artifactsDir = this.sessionManager.getArtifactsDir();
-				if (artifactsDir) {
-					const handoffFilePath = path.join(artifactsDir, createHandoffFileName());
-					try {
-						if (isUnderProjectGjc(this.sessionManager.getCwd(), handoffFilePath)) {
-							await writeArtifact(handoffFilePath, `${handoffText}\n`, {
-								cwd: this.sessionManager.getCwd(),
-								audit: { category: "artifact", verb: "write", owner: "gjc-runtime" },
-							});
-						} else {
-							await Bun.write(handoffFilePath, `${handoffText}\n`);
-						}
-						savedPath = handoffFilePath;
-					} catch (error) {
-						logger.warn("Failed to save handoff document to disk", {
-							path: handoffFilePath,
-							error: error instanceof Error ? error.message : String(error),
-						});
-					}
-				} else {
-					logger.debug("Skipping handoff document save because session is not persisted");
+				try {
+					const artifactId = await this.sessionManager.saveArtifact(`${handoffText}\n`, "handoff");
+					savedPath = `artifact://${artifactId}`;
+				} catch (error) {
+					logger.warn("Failed to save handoff document", {
+						error: error instanceof Error ? error.message : String(error),
+					});
 				}
 			}
 
@@ -10638,6 +10867,8 @@ export class AgentSession {
 			return;
 		}
 
+		this.#attachAskTool();
+
 		const reminder = prompt.render(planModeToolDecisionReminderPrompt, {
 			askToolName: "ask",
 		});
@@ -12489,23 +12720,33 @@ export class AgentSession {
 	): Promise<boolean | ManagedAttemptDecision> {
 		const controller = this.#defaultFallbackChain();
 		const managedFallback = controller.chain.entries.length > 1;
-		const trigger = this.#fallbackTriggerFor(message, !managedFallback, transportFailure);
-		if (!trigger) {
-			return managedOutcome
-				? this.#managedFallbackExhaustionDecision(message, message.errorMessage || "Model fallback attempt failed")
-				: false;
-		}
 		const retrySettings = this.settings.getGroup("retry");
 		const legacyRetryConfigured =
 			this.settings.has("retry.enabled") ||
 			this.settings.has("retry.maxRetries") ||
 			this.settings.has("retry.baseDelayMs") ||
 			this.settings.has("retry.maxDelayMs");
-		// A bare default retry configuration must preserve the historical
-		// fail-closed behavior for generic provider errors. Explicit retry
-		// settings opt into the resilient legacy retry path.
-		if (!managedFallback && (!retrySettings.enabled || !legacyRetryConfigured)) return false;
+		// retry.enabled=false always surfaces immediately, matching the explicit
+		// user opt-out.
+		if (!managedFallback && !retrySettings.enabled) return false;
 		const classification = managedFallback ? undefined : this.#classifyErrorForRetry(message);
+		// Bare defaults admit only clean, side-effect-free canonical stream watchdog failures.
+		if (!managedFallback && !legacyRetryConfigured) {
+			if (
+				hasBareDefaultRetryDisqualifyingFacts(message) ||
+				(classification !== "transient" && classification !== "first_event_timeout") ||
+				!BARE_DEFAULT_WATCHDOG_ERROR.test(message.errorMessage ?? "") ||
+				!this.#hasCleanRetryReplaySafety
+			) {
+				return false;
+			}
+		}
+		const trigger = this.#fallbackTriggerFor(message, !managedFallback, transportFailure);
+		if (!trigger) {
+			return managedOutcome
+				? this.#managedFallbackExhaustionDecision(message, message.errorMessage || "Model fallback attempt failed")
+				: false;
+		}
 		const legacyUnbounded = classification === "transient";
 		const attemptsUsed = managedFallback ? controller.attemptsUsed || 1 : this.#retryAttempt + 1;
 		const failedSelector = managedFallback ? controller.currentSelector() : undefined;
@@ -12678,6 +12919,7 @@ export class AgentSession {
 			this.#scheduleAgentContinue({
 				delayMs: 1,
 				generation,
+				allowDuringCancelAndSubmit: true,
 				onError: () => this.#failRetryRecovery("Retry continuation failed to start"),
 				onSkip: () => this.#failRetryRecovery("Retry continuation was superseded"),
 			});
@@ -12860,6 +13102,8 @@ export class AgentSession {
 		options?: { excludeFromContext?: boolean },
 	): Promise<BashResult> {
 		const excludeFromContext = options?.excludeFromContext === true;
+		this.#markRetryReplayUnsafe();
+
 		const cwd = this.sessionManager.getCwd();
 
 		if (this.#extensionRunner?.hasHandlers("user_bash")) {
@@ -12889,7 +13133,7 @@ export class AgentSession {
 				cwd,
 				timeout: clampTimeout("bash") * 1000,
 				env: buildGjcRuntimeSessionEnv({
-					sessionFile: this.sessionManager.getSessionFile(),
+					sessionFile: null,
 					sessionId: this.sessionId,
 					cwd,
 				}),
@@ -12991,6 +13235,7 @@ export class AgentSession {
 		options?: { excludeFromContext?: boolean },
 	): Promise<PythonResult> {
 		const excludeFromContext = options?.excludeFromContext === true;
+		this.#markRetryReplayUnsafe();
 		const cwd = this.sessionManager.getCwd();
 		this.assertEvalExecutionAllowed();
 
@@ -13755,9 +14000,6 @@ export class AgentSession {
 		const previousTools = [...this.agent.state.tools];
 		const previousBaseSystemPrompt = this.#baseSystemPrompt;
 		const previousSystemPrompt = this.agent.state.systemPrompt;
-		const previousFallbackSelectedMCPToolNames = previousSessionFile
-			? this.#getSessionDefaultSelectedMCPToolNames(previousSessionFile)
-			: undefined;
 		const previousAgentSteeringQueue = this.agent.snapshotSteering();
 		const previousAgentFollowUpQueue = this.agent.snapshotFollowUp();
 
@@ -13779,8 +14021,7 @@ export class AgentSession {
 			const didReloadConversationChange =
 				!switchingToDifferentSession &&
 				this.#didSessionMessagesChange(previousSessionContext.messages, sessionContext.messages);
-			const fallbackSelectedMCPToolNames = this.#getSessionDefaultSelectedMCPToolNames(sessionPath);
-			await this.#restoreMCPSelectionsForSessionContext(sessionContext, { fallbackSelectedMCPToolNames });
+			await this.#restoreMCPSelectionsForSessionContext(sessionContext);
 
 			// The target session is loaded and MCP selections are restored: discard
 			// pre-switch delivery queues before completing the restored agent state.
@@ -13852,6 +14093,11 @@ export class AgentSession {
 			}
 
 			this.#reconnectToAgent();
+			// Fence predecessor continuations before session_switch starts SDK runtime
+			// teardown. The previous runtime waits for those continuations to settle;
+			// waiting to transfer authority until after hooks creates a circular wait.
+			if (suspendedWorkflowGateEmitter)
+				this.#bindWorkflowGateEmitter(previousSessionState.sessionId, suspendedWorkflowGateEmitter);
 			// session_switch is the post-commit identity signal. SDK authority and
 			// other identity-bound integrations must not observe the successor until
 			// messages, model state, MCP selections, and the agent subscription are live.
@@ -13862,8 +14108,6 @@ export class AgentSession {
 					previousSessionFile,
 				});
 			}
-			if (suspendedWorkflowGateEmitter)
-				this.#bindWorkflowGateEmitter(previousSessionState.sessionId, suspendedWorkflowGateEmitter);
 			return true;
 		} catch (error) {
 			this.sessionManager.restoreState(previousSessionState);
@@ -13873,9 +14117,7 @@ export class AgentSession {
 			this.#rekeyHindsightMemoryForCurrentSessionId();
 			let restoreMcpError: unknown;
 			try {
-				await this.#restoreMCPSelectionsForSessionContext(previousSessionContext, {
-					fallbackSelectedMCPToolNames: previousFallbackSelectedMCPToolNames,
-				});
+				await this.#restoreMCPSelectionsForSessionContext(previousSessionContext);
 			} catch (mcpError) {
 				restoreMcpError = mcpError;
 				logger.warn("Failed to restore MCP selections after switch error", {