@huynle/hub 0.9.2 → 0.10.1

package/src/spoke/spoke.ts

@@ -2,7 +2,7 @@
 // keeps the WebSocket to the central server, forwards exposed events, and executes the server's
 // requests (voice turns, permission replies, context reads) through the plugin context.
 import path from "node:path"
-import { defaults, readConfig, setSession, withServer, writeConfig, type LaunchConfig, type Mode, type VoiceConfig, explicitVariant, formatModelRef, parseModelRef, plainModelRef, type ModelRef } from "../config"
+import { defaults, readConfig, setSession, withServer, writeConfig, type LaunchConfig, type Mode, type VoiceConfig, parseModelRef, type ModelRef } from "../config"
 import { isLoopbackURL } from "../loopback"
 import {
   compactActivity,
@@ -12,6 +12,7 @@ import {
   isLaunchCreate,
   SEED_JOBS_MAX,
   SPOKE_FEATURES,
+  RELAY_TEXT_MAX,
   type DeliverRequest,
   type DeliverResult,
   type DeliveryMode,
@@ -27,6 +28,7 @@ import {
   type SessionTokensRequest,
   type ActTokensRequest,
   type CreateRequest,
+  type ModelSelection,
   type SessionModelPrefs,
   type SpokeRequest,
   type TerminalInfo,
@@ -39,7 +41,7 @@ import { TimelineCache, boundedTimelinePart, newestPage, timelineFile, timelineI
 import { MediaCache, timelineMedia, type MediaMessages } from "./media"
 import { BundleCache, previewBundle } from "./preview-bundle"
 import { CodedError, SpokeConnection, type Backoff, type ConnectionState } from "./client"
-import { isHubPrompt, PROMPT_SOURCE, VOICE_AGENT } from "./conversation"
+import { isHubPrompt, LEGACY_VOICE_AGENT, PROMPT_SOURCE } from "./conversation"
 import { DeliveryLedger, deferredWhileBusy, deliverDescription, deliverMetadata, deliverText, harnessMessageID, InboxOrigins, planDelivery, QUIET_WHILE_BUSY, REVERT_STAGED } from "./deliver"
 import { pollEnrollment, startEnrollment } from "./enroll"
 import { HerdrWatcher, openInHerdr, type HerdrRunner } from "./herdr"
@@ -50,10 +52,10 @@ import { OpenCodeProfiles } from "./profile-apply"
 import { SessionTokenStore } from "./session-tokens"
 import { SessionContexts } from "./session-context"
 import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge.ts"
-import { changeStats, contextUsage, filePatch, mcpServers } from "./summary"
+import { changeStats, contextUsage, filePatch, mcpServers, sessionModel } from "./summary"
 import { browserSessions, eventSessionID, isExposed, isReported, SessionTracker, shouldForward, type EventLike, type SessionDetails } from "./tracker"
 import { renderTaskBoard, TaskBoard } from "./taskboard"
-import { FRONT_TITLE_PREFIX, frontTitle, relayDelivery, trimText, VOICE_FRONT_AGENT, VoiceFronts } from "./voice-front"
+import { FRONT_RELAY_TOOL, FRONT_TITLE_PREFIX, frontTitle, noThinkingOptions, relayDelivery, trimText, VOICE_FRONT_AGENT, VoiceFronts, type FrontMode, type FrontModelInfo } from "./voice-front"
 import { watchConfig, type ConfigWatcher } from "./watch"
 
 export type SpokeErrorName = "not_connected" | "not_enrolled" | "invalid" | "unreachable"
@@ -112,6 +114,8 @@ export interface SpokeHost {
   synthetic?(input: { sessionID: string; id: string; text: string; description?: string; metadata: Record<string, unknown>; delivery: DeliveryMode; resume: boolean }): Promise<{ id?: string }>
   context(sessionID: string): Promise<ReadonlyArray<unknown>>
   listModels?(): Promise<ReadonlyArray<unknown>>
+  /** The default model at `directory` (OpenCode's model.default, a catalog entry with providerID and id); undefined: none. */
+  defaultModel?(directory: string): Promise<unknown>
   getSession(sessionID: string): Promise<HostSession>
   /**
    * Replies to a pending permission; "gone" when it is not pending here any more (answered, expired).
@@ -161,6 +165,11 @@ export interface SpokeHost {
   listRecent?(options?: { days: number; max: number; include: readonly string[]; signal?: AbortSignal }): Promise<Array<{ id: string } & SessionDetails>>
   /** Creates a session in a directory (the create op: service processes only; voice fronts: any process). */
   createSession?(input: { directory: string; title?: string }): Promise<{ id: string }>
+  /**
+   * (voice front) The IDs of a session's inbox items still waiting (OpenCode's session.inbox.list, own server only):
+   * relays no longer listed were delivered or cancelled while events were missed.
+   */
+  inboxIDs?(sessionID: string): Promise<string[]>
   /** Deletes a session (OpenCode's session.remove); a voice front when its conversation ends. */
   removeSession?(sessionID: string): Promise<unknown>
   /** MCP servers and their status for a directory (raw OpenCode McpServer list). */
@@ -370,7 +379,7 @@ export class Spoke {
    * ever gets one. Only actIdentity reads them (the OpenCode hub tool). Never logged, never in any environment.
    */
   private readonly actTokens = new SessionTokenStore()
-  /** The background workers each session started (the voice agent's task board). */
+  /** The background workers each session started (the task board its voice front reads). */
   private readonly tasks = new TaskBoard()
   private readonly turns = new TurnTracker()
   /** Timeline rows of sessions being paged through (30 s, dropped on any event of the session). */
@@ -388,17 +397,15 @@ export class Spoke {
   /** Who put each inbox item into a session (forwarded with session.inbox.delivered). */
   private readonly origins = new InboxOrigins()
   private readonly infoTried = new Map<string, number>()
-  /** Sessions in conversation mode → the agent to restore when it ends (undefined: the default agent). */
-  private readonly conversations = new Map<string, { previous?: string; previousModel?: ModelRef; voiceModel?: ModelRef }>()
-  /** Per-session selections supplied by the hub; the hub persists them per user. */
-  private readonly modelPrefs = new Map<string, SessionModelPrefs>()
-  /** Per session with a Voice override applied: the model to restore when it is cleared, and the override. */
-  private readonly voiceOverrides = new Map<string, { readonly previous?: ModelRef; readonly applied: ModelRef }>()
   /**
-   * Session → its current model as last seen (getSession, our switchModel, OpenCode's session.model.selected),
-   * so an utterance needs no getSession round trip. Cleared when the event stream restarts (events may be lost).
+   * Sessions in conversation mode without a voice front (an older hub, no front, or one that could not be made): the
+   * hub talks to them directly and their turns are voice turns. Their agent and model are never switched.
    */
-  private readonly sessionModels = new Map<string, { readonly model?: ModelRef }>()
+  private readonly conversations = new Set<string>()
+  /** Sessions checked for the removed "voice" agent (a turn on a missing agent fails in OpenCode 2.2.3). */
+  private readonly agentChecked = new Set<string>()
+  /** Per-session selections supplied by the hub; the hub persists them per user. */
+  private readonly modelPrefs = new Map<string, SessionModelPrefs>()
   /** Session → callbacks waiting for its next session.renamed event (autoName). */
   private readonly renameWaiters = new Map<string, Set<(title: string) => void>>()
   private conversationChain: Promise<unknown> = Promise.resolve()
@@ -424,6 +431,8 @@ export class Spoke {
    */
   private readonly voiceTitled = new Map<string, "checking" | "user" | "front" | "hidden">()
   private readonly frontFallbacks = new Set<string>()
+  /** (fix D) The catalog entry of each front model seen: provider package and variants. */
+  private readonly frontModelInfo = new Map<string, FrontModelInfo | undefined>()
   private readonly unlinkedFronts = new Set<string>()
   private frontWakes = 0
   private readonly abort = new AbortController()
@@ -549,21 +558,19 @@ export class Spoke {
     this.fronts.stop()
   }
 
-  /** A voice-styled turn: a hub /turn asked for it, or the session's voice front failed (the hub talks to it now). */
+  /**
+   * A voice-styled turn: a hub /turn asked for it, or the hub talks to the session directly in conversation mode (no
+   * voice front: an older hub, none could be made, or it failed).
+   */
   isVoiceTurn(sessionID: string): boolean {
-    return (this.voiceTurns.get(sessionID) ?? 0) > 0 || this.frontFallbacks.has(sessionID)
+    return (this.voiceTurns.get(sessionID) ?? 0) > 0 || this.frontFallbacks.has(sessionID) || this.conversations.has(sessionID)
   }
 
-  /** Conversation mode is on: the agent swap (or its context-hook fallback), or a voice front (also a failed one). */
+  /** Conversation mode is on: with a voice front (also a failed one), or talking to the session directly. */
   inConversation(sessionID: string): boolean {
     return this.conversations.has(sessionID) || this.fronts.frontOf(sessionID) !== undefined || this.frontFallbacks.has(sessionID)
   }
 
-  /** The session itself is the voice orchestrator (today's agent swap): the context hook adds its parts. */
-  orchestrates(sessionID: string): boolean {
-    return this.conversations.has(sessionID)
-  }
-
   /**
    * voice_main_send: relays the user's request from a voice front to its main session, as the user's (hub-sourced)
    * prompt. "auto": idle starts a turn, busy steers; "queue" waits behind main's running turn.
@@ -576,11 +583,40 @@ export class Spoke {
     const busy = this.running.has(main) || this.tracker.isBusy(main)
     const delivery = relayDelivery(input.delivery, busy)
     const inbox = await this.host.prompt({ sessionID: main, text, delivery, metadata: { source: PROMPT_SOURCE, kind: "voice-front" } })
-    if (delivery === "queue") {
-      this.fronts.queued(main, inbox.id, text)
-      return { text: "Queued for the main session; it runs after its current turn.", inboxID: inbox.id }
+    this.fronts.relayed(main, inbox.id, text, delivery)
+    const done = delivery === "queue" ? "Queued for the session; it runs after its current turn." : busy ? "Steered into the session's running turn." : "Sent; the session started working on it."
+    return { text: `${done} ${HANDOFF_DONE}`, inboxID: inbox.id }
+  }
+
+  /**
+   * (P2) relay_to_session: a Concierge-mode front hands the user's request to one of the user's existing sessions,
+   * through the hub (relayToSession), which checks the front, the utterance and the target. Refused here, with no hub
+   * request, when the front's latest input is a hub wake (only the user's speech may relay) or the hub cannot relay.
+   * A refusal re-opens the front's turn (its next step may say why).
+   */
+  async frontRelay(callerID: string, input: { session?: unknown; text?: unknown; previous?: unknown; confirm?: unknown }): Promise<{ text: string; sessionID?: string }> {
+    const refuse = (text: string) => (this.fronts.handoffFailed(callerID), { text })
+    if (this.fronts.mode(callerID) !== "concierge") return { text: "This session is not a Concierge front; nothing was sent." }
+    const session = typeof input.session === "string" ? input.session.trim() : ""
+    const text = typeof input.text === "string" ? input.text.trim() : ""
+    if (!session) return refuse("Name the session: its ID or @name from the board. Nothing was sent.")
+    if (!text) return refuse("Pass the request as text. Nothing was sent.")
+    if (!this.hubSupports("frontRelay")) return refuse("This hub cannot relay to other sessions: pass the request to the Concierge instead. Nothing was sent.")
+    if (this.fronts.lastInput(callerID) !== "user") return refuse(`${FRONT_RELAY_TOOL} is only for what the user just said, never for an update. Nothing was sent.`)
+    try {
+      const result = await this.ask({ op: "relayToSession", frontID: callerID, session, text: text.slice(0, RELAY_TEXT_MAX), ...(input.previous === true ? { previous: true } : {}), ...(input.confirm === true ? { confirm: true } : {}) })
+      const name = result.title?.trim() || "the session"
+      const done = result.mode === "steer" ? `Steered into ${name}'s running turn.` : `Sent to ${name}; it started working on it.`
+      return { text: `${done} ${HANDOFF_DONE}`, sessionID: result.sessionID }
+    } catch (cause) {
+      return refuse(`Not sent: ${errorText(cause)}. Do what that says now (you may answer the user), or tell them in one short sentence why nothing was sent.`)
     }
-    return { text: busy ? "Steered into the main session's running turn." : "Sent; the main session started working on it.", inboxID: inbox.id }
+  }
+
+  /** (P2) The tools a front keeps this turn (none for any other session); the relay only when the hub relays. */
+  frontTools(sessionID: string): string[] {
+    const tools = this.fronts.tools(sessionID)
+    return this.hubSupports("frontRelay") ? tools : tools.filter((name) => name !== FRONT_RELAY_TOOL)
   }
 
   /** voice_main_stop: interrupts the front's main session and everything running below it (as the stop op). */
@@ -589,7 +625,7 @@ export class Spoke {
     if (!main) return { text: "This session is not a voice front; nothing was stopped.", stopped: [] }
     this.fronts.stopRequested(main)
     const { stopped } = await this.stopTree(main)
-    return { text: "Stopped the main session's work.", stopped: [...stopped] }
+    return { text: `Stopped the session's work. ${HANDOFF_DONE}`, stopped: [...stopped] }
   }
 
   /** The voice front's per-turn note about its main session; undefined for any other session. */
@@ -598,7 +634,37 @@ export class Spoke {
     if (!main) return undefined
     const title = this.tracker.snapshot(Date.now()).find((s) => s.id === main)?.title
     const workers = this.taskBoard(main)
-    return this.fronts.context(sessionID, { ...(title ? { title } : {}), busy: this.running.has(main) || this.tracker.isBusy(main), ...(workers ? { workers } : {}) })
+    const board = this.fronts.mode(sessionID) === "concierge" ? this.contexts.frontBoard(main) : undefined
+    return this.fronts.context(sessionID, { ...(title ? { title } : {}), busy: this.running.has(main) || this.tracker.isBusy(main), ...(workers ? { workers } : {}), ...(board ? { board } : {}) })
+  }
+
+  /**
+   * (fix D) Request options that turn a front's model thinking off (src/spoke/voice-front.ts noThinkingOptions), from
+   * OpenCode's model catalog, cached per model. A catalog that cannot be read gives none.
+   */
+  async frontModelOptions(model: { providerID: string; id: string }): Promise<Record<string, unknown>> {
+    const key = `${model.providerID}/${model.id}`
+    if (!this.frontModelInfo.has(key)) {
+      const listed = await Promise.resolve(this.host.listModels?.()).catch(() => undefined)
+      const info = (listed ?? []).find((m: any) => m?.providerID === model.providerID && m?.id === model.id) as FrontModelInfo | undefined
+      if (!listed) return {}
+      this.frontModelInfo.set(key, info)
+      if (this.frontModelInfo.size > 50) this.frontModelInfo.delete(this.frontModelInfo.keys().next().value!)
+    }
+    return noThinkingOptions(this.frontModelInfo.get(key))
+  }
+
+  /**
+   * Checks the relays the fronts still wait for against their sessions' inboxes (after an event-stream gap): relays
+   * no longer listed are dropped. Without an inbox list, relays older than the hold cap count as resolved.
+   */
+  async reconcileFronts(): Promise<void> {
+    const list = this.host.inboxIDs?.bind(this.host)
+    if (!list) return
+    for (const { main } of this.fronts.pendingRelays()) {
+      const ids = await list(main).catch(() => undefined)
+      if (ids) this.fronts.reconcile(main, new Set(ids))
+    }
   }
 
   /** A hub update for a front (`<system-update>`): admitted as the hub's (never the user's), steered, waking it. */
@@ -616,60 +682,11 @@ export class Spoke {
     }
   }
 
-  /** The agent the voice orchestrator delegates to (per-machine config). */
-  /** The model subagents should work on for a session in conversation mode, as "provider/model[#variant]". */
-  workModelFor(sessionID: string): string | undefined {
-    const selected = this.modelPrefs.get(sessionID)?.worker
-    if (selected) return formatModelRef({ providerID: selected.providerID, id: selected.modelID, ...(selected.variant ? { variant: selected.variant } : {}) })
-    const entry = this.conversations.get(sessionID)
-    if (!entry?.voiceModel) return undefined
-    return this.config.workModel ?? (entry.previousModel ? formatModelRef(entry.previousModel) : undefined)
-  }
-
-  /** The rendered task board of a session's workers (for the voice agent's context); undefined without any. */
+  /** The rendered task board of a session's workers (for its voice front's context); undefined without any. */
   taskBoard(sessionID: string): string | undefined {
     return renderTaskBoard(this.tasks.children(sessionID), Date.now())
   }
 
-  /**
-   * hub_task_stop: interrupts one of `callerID`'s workers (a session below it), or all its running workers, and
-   * whatever runs below them, deepest first. Never the caller itself, nor a session outside its tree.
-   */
-  async stopWorkers(callerID: string, input: { sessionID?: unknown; all?: unknown }): Promise<{ stopped: string[]; text: string }> {
-    let targets: string[]
-    if (input.all === true) {
-      targets = this.tasks
-        .children(callerID)
-        .filter((t) => t.state === "working" || t.state === "blocked")
-        .map((t) => t.id)
-      if (!targets.length) return { stopped: [], text: "None of your workers is running." }
-    } else if (typeof input.sessionID === "string" && input.sessionID) {
-      const id = input.sessionID
-      if (id === callerID || !this.tracker.lineage(id).slice(1).includes(callerID)) {
-        return { stopped: [], text: `${id} is not one of your workers; use a sessionID from your task board.` }
-      }
-      targets = [id]
-    } else return { stopped: [], text: "Pass the worker's sessionID from your task board, or all: true for every worker." }
-    const stopped: string[] = []
-    for (const target of targets) {
-      for (const id of [...this.tracker.runningBelow(target), target]) {
-        if (id === callerID) continue
-        try {
-          await this.host.interrupt(id)
-          stopped.push(id)
-        } catch {
-          // already settled
-        }
-      }
-    }
-    const names = targets.map((id) => `"${this.tasks.get(id)?.title ?? id}"`)
-    return { stopped, text: `Stopped ${names.join(", ")}.` }
-  }
-
-  subagent(): string {
-    return this.config.subagent
-  }
-
   /**
    * TUI presence (RPC voice.presence): the sessions a TUI shows right now (its route and open tabs).
    * `reporter` identifies the TUI; its report replaces its previous one.
@@ -756,10 +773,10 @@ export class Spoke {
   }
 
   /**
-   * Turns conversation mode on or off for a session in this process. On: switch to the "voice"
-   * agent (remembering the previous one) or, without that agent, let the context hook add the
-   * orchestrator prompt. Off: restore the previous agent unless the user picked another meanwhile.
-   * Calls are serialized so a re-sent "on" cannot race an "off".
+   * Turns conversation mode on or off for a session in this process. On with `front`: a hidden voice front answers
+   * for the session. Without a front (an older hub, or none can be made) the hub talks to the session directly and
+   * its turns are voice turns. The session's agent and model are never switched. Calls are serialized so a re-sent
+   * "on" cannot race an "off".
    */
   setConversation(sessionID: string, on: boolean, front = false, frontID?: string): Promise<ResultFor["conversation"]> {
     if (!isExposed(this.config, this.tracker, sessionID)) return Promise.reject(new SpokeError("invalid", NOT_SHARED))
@@ -1113,76 +1130,80 @@ export class Spoke {
   }
 
   private async conversationOn(sessionID: string, front = false, frontID?: string): Promise<ResultFor["conversation"]> {
-    let entry = this.conversations.get(sessionID)
-    let session = await this.host.getSession(sessionID)
+    const session = await this.host.getSession(sessionID)
     // (CON-04) lockAgent: conversation mode is recorded, but the session keeps its agent and model (the Concierge
-    // never escapes its restricted agent, and the context hook adds no orchestrator parts). It never gets a front.
+    // never escapes its restricted agent). (P2) With `front`, a Concierge-mode front answers in front of it; without
+    // one (an older hub, or none could be made) the Concierge answers itself, as before.
     // A session on the concierge agent is locked too (a spoke that restarted before the hub re-sent the context).
     if (this.contexts.locked(sessionID) || session.agent === CONCIERGE_AGENT) {
-      this.conversations.set(sessionID, {})
-      return { agent: session.agent ?? (await this.defaultAgent()) }
+      const agent = session.agent ?? (await this.defaultAgent())
+      const made = front ? await this.frontOn(sessionID, session, frontID, "concierge") : undefined
+      if (made) return { agent, front: { sessionID: made } }
+      this.conversations.add(sessionID)
+      return { agent }
     }
+    const agent = await this.leaveRemovedAgent(sessionID, session.agent)
     // The front failed: the hub talks to main directly and resends on without front (a reconnect). Main keeps its
     // agent and model; its turns stay voice turns (frontFallbacks) until off.
-    if (!front && this.frontFallbacks.has(sessionID)) return { agent: session.agent ?? (await this.defaultAgent()) }
-    if (front) {
-      const live = this.fronts.frontOf(sessionID)
-      if (live && this.tracker.has(live)) return { agent: session.agent ?? (await this.defaultAgent()), front: { sessionID: live } }
-      // A failed front is replaced (deleted first); the session stops being a fallback.
-      await this.endFront(sessionID)
-      // Moving from the agent swap to a front: main gets its own agent and model back first.
-      if (entry) {
-        await this.conversationOff(sessionID)
-        entry = undefined
-        session = await this.host.getSession(sessionID)
-      }
-      // The hub knows this conversation's front (a resend to a restarted process): re-linked if it still exists.
-      const adopted = frontID ? await this.adoptFront(sessionID, frontID) : undefined
-      if (adopted) return { agent: session.agent ?? (await this.defaultAgent()), front: { sessionID: adopted } }
-      const created = await this.createFront(sessionID, session).catch((cause) => {
-        console.error("[hub] could not start a voice front; using the voice agent", errorText(cause))
+    if (!front && this.frontFallbacks.has(sessionID)) return { agent }
+    const made = front ? await this.frontOn(sessionID, session, frontID, "session") : undefined
+    if (made) return { agent, front: { sessionID: made } }
+    // No front: main answers the hub itself, in the voice style. Its agent and model stay as they are.
+    this.conversations.add(sessionID)
+    return { agent }
+  }
+
+  /** The live front of `sessionID`, a re-linked one (`frontID`) or a new one; undefined when none can be made. */
+  private async frontOn(sessionID: string, session: HostSession, frontID: string | undefined, mode: FrontMode): Promise<string | undefined> {
+    const live = this.fronts.frontOf(sessionID)
+    if (live && this.tracker.has(live)) return live
+    // A failed front is replaced (deleted first); the session stops being a fallback.
+    await this.endFront(sessionID)
+    // The hub knows this conversation's front (a resend to a restarted process): re-linked if it still exists.
+    const adopted = frontID ? await this.adoptFront(sessionID, frontID, mode) : undefined
+    const created =
+      adopted ??
+      (await this.createFront(sessionID, session, mode).catch((cause) => {
+        console.error("[hub] could not start a voice front; the hub talks to the session directly", errorText(cause))
         return undefined
-      })
-      if (created) return { agent: session.agent ?? (await this.defaultAgent()), front: { sessionID: created } }
-    }
-    this.rememberModel(sessionID, session.model)
-    const current = session.agent
-    const models = await this.voiceModelOn(sessionID, session, entry)
-    if (!(await this.host.hasAgent(VOICE_AGENT))) {
-      this.conversations.set(sessionID, { ...entry, ...models })
-      return { agent: current ?? (await this.defaultAgent()) }
+      }))
+    if (created) this.conversations.delete(sessionID)
+    return created
+  }
+
+  /**
+   * The session's agent. A session left on older plugins' "voice" agent (a crash mid-conversation) moves to
+   * the default agent: OpenCode 2.2.3 does not fall back, it fails every turn on a missing agent. A "voice" agent the
+   * user defined is theirs and kept.
+   */
+  private async leaveRemovedAgent(sessionID: string, agent: string | undefined): Promise<string> {
+    this.agentChecked.add(sessionID)
+    if (this.agentChecked.size > AGENT_CHECKED_LIMIT) this.agentChecked.delete(this.agentChecked.values().next().value!)
+    if (agent !== LEGACY_VOICE_AGENT) return agent ?? (await this.defaultAgent())
+    if (await this.host.hasAgent(LEGACY_VOICE_AGENT).catch(() => true)) return agent
+    const target = await this.defaultAgent()
+    try {
+      await this.host.switchAgent(sessionID, target)
+      console.warn(`[hub] ${sessionID} was left on the removed voice agent; it now runs ${target}`)
+      return target
+    } catch (cause) {
+      console.error(`[hub] could not move ${sessionID} off the removed voice agent`, errorText(cause))
+      return agent
     }
-    const previous = entry ? entry.previous : current === VOICE_AGENT ? undefined : current
-    this.conversations.set(sessionID, { ...(previous ? { previous } : {}), ...models })
-    if (current !== VOICE_AGENT) await this.host.switchAgent(sessionID, VOICE_AGENT)
-    return { agent: VOICE_AGENT }
-  }
-
-  /** Switches to the configured fast model, remembering the session's model for subagent work and for restoring. */
-  private async voiceModelOn(
-    sessionID: string,
-    session: HostSession,
-    entry: { previousModel?: ModelRef; voiceModel?: ModelRef } | undefined,
-  ): Promise<{ previousModel?: ModelRef; voiceModel?: ModelRef }> {
-    const selected = this.modelPrefs.get(sessionID)?.voice
-    const voiceModel = selected
-      ? { providerID: selected.providerID, id: selected.modelID, ...(selected.variant ? { variant: selected.variant } : {}) }
-      : this.config.voiceModel
-        ? parseModelRef(this.config.voiceModel)
-        : undefined
-    if (!voiceModel) return {}
-    const current = session.model
-    const onVoice = current !== undefined && sameModel(current, voiceModel)
-    const previousModel = entry?.voiceModel ? entry.previousModel : onVoice || !current ? undefined : plainModelRef(current)
-    if (!onVoice) await this.switchModel(sessionID, voiceModel)
-    return { voiceModel, ...(previousModel ? { previousModel } : {}) }
+  }
+
+  /** Before the hub prompts a session: moved off the removed voice agent once per session (see leaveRemovedAgent). */
+  private async checkAgent(sessionID: string): Promise<void> {
+    if (this.agentChecked.has(sessionID)) return
+    const session = await this.host.getSession(sessionID).catch(() => undefined)
+    if (session) await this.leaveRemovedAgent(sessionID, session.agent)
   }
 
   /**
    * Creates main's voice front: a root session in main's directory, titled after it, on the voice-front agent and
    * the voice model, reported with voiceFrontOf. Throws (after removing a half-made front) when it cannot.
    */
-  private async createFront(main: string, session: HostSession): Promise<string> {
+  private async createFront(main: string, session: HostSession, mode: FrontMode = "session"): Promise<string> {
     const create = this.host.createSession?.bind(this.host)
     if (!create) throw new Error("this OpenCode process cannot create sessions")
     if (!(await this.host.hasAgent(VOICE_FRONT_AGENT))) throw new Error(`no ${VOICE_FRONT_AGENT} agent`)
@@ -1202,7 +1223,7 @@ export class Spoke {
         await this.host.removeSession?.(id).catch(() => undefined)
         throw cause
       }
-      this.fronts.link(main, id, await this.lastReply(main))
+      this.fronts.link(main, id, await this.lastReply(main), mode)
     } finally {
       this.frontsCreating--
       if (id !== undefined) this.unlinkedFronts.delete(id)
@@ -1263,11 +1284,11 @@ export class Spoke {
    * Re-links an existing front to main (the hub names it on a resend): only a session on the voice-front agent that
    * this process has not linked to another session. Undefined when it is gone or no front.
    */
-  private async adoptFront(main: string, frontID: string): Promise<string | undefined> {
+  private async adoptFront(main: string, frontID: string, mode: FrontMode = "session"): Promise<string | undefined> {
     if (frontID === main || (this.frontMainOf(frontID) ?? main) !== main) return undefined
     const info = await this.host.getSession(frontID).catch(() => undefined)
     if (info?.agent !== VOICE_FRONT_AGENT || (this.frontMainOf(frontID) ?? main) !== main) return undefined
-    this.fronts.link(main, frontID, await this.lastReply(main))
+    this.fronts.link(main, frontID, await this.lastReply(main), mode)
     this.voiceTitled.delete(frontID)
     const now = Date.now()
     if (!this.tracker.has(frontID)) this.tracker.observe({ type: "session.created", data: { sessionID: frontID, title: info.title, location: info.location } }, now)
@@ -1328,20 +1349,10 @@ export class Spoke {
 
   private async conversationOff(sessionID: string): Promise<ResultFor["conversation"]> {
     await this.endFront(sessionID)
-    const entry = this.conversations.get(sessionID)
     this.conversations.delete(sessionID)
     const session = await this.host.getSession(sessionID)
-    this.rememberModel(sessionID, session.model)
-    // Restore the model only if the session is still on the voice model (the user may have picked another).
-    if (entry?.voiceModel && entry.previousModel && session.model && sameModel(session.model, entry.voiceModel)) {
-      await this.switchModel(sessionID, entry.previousModel)
-    }
-    const current = session.agent
-    if (current !== VOICE_AGENT) return { agent: current ?? (await this.defaultAgent()) }
-    let target = entry?.previous ?? (await this.defaultAgent())
-    if (target === VOICE_AGENT) target = FALLBACK_AGENT
-    await this.host.switchAgent(sessionID, target)
-    return { agent: target }
+    if (this.contexts.locked(sessionID) || session.agent === CONCIERGE_AGENT) return { agent: session.agent ?? (await this.defaultAgent()) }
+    return { agent: await this.leaveRemovedAgent(sessionID, session.agent) }
   }
 
   private async defaultAgent(): Promise<string> {
@@ -1401,17 +1412,16 @@ export class Spoke {
       case "modelPrefs":
         return this.modelPrefsResult(req.sessionID)
       case "setModelPrefs": {
-        const next: { voice?: any; worker?: any } = { ...this.modelPrefs.get(req.sessionID) }
-        for (const key of ["voice", "worker"] as const) {
-          if (!(key in req)) continue
-          if (req[key] === null) delete next[key]
-          else if (req[key] !== undefined) next[key] = req[key]
-        }
-        if (next.voice || next.worker) this.modelPrefs.set(req.sessionID, next)
+        // The Voice model is the voice front's. `worker` (older hubs' complex-worker model) is ignored.
+        const next: { voice?: SessionModelPrefs["voice"] } = { ...this.modelPrefs.get(req.sessionID) }
+        if ("voice" in req && req.voice === null) delete next.voice
+        else if (req.voice) next.voice = req.voice
+        if (next.voice) this.modelPrefs.set(req.sessionID, next)
         else this.modelPrefs.delete(req.sessionID)
-        if (!next.voice && this.voiceOverrides.has(req.sessionID)) await this.applyVoiceModel(req.sessionID)
         return this.modelPrefsResult(req.sessionID)
       }
+      case "setModel":
+        return this.setSessionModel(req.sessionID, req.model)
       case "timeline": {
         // A first page reads OpenCode (it shows the newest state); following pages reuse those rows briefly. A
         // staged revert hides its message and everything after it (OpenCode keeps them until it is committed).
@@ -1450,8 +1460,10 @@ export class Spoke {
           directory: this.directoryOf(req.sessionID),
         })) satisfies ResultFor["previewBundle"]
       case "steer": {
+        // (P2) The user's speech reaches a front only through this op (the hub's utterance route).
+        if (this.fronts.isFront(req.sessionID)) this.fronts.heard(req.sessionID, "user")
         const voice = isExposed(this.config, this.tracker, req.sessionID)
-        if (voice) await this.applyVoiceModel(req.sessionID)
+        await this.checkAgent(req.sessionID)
         const inbox = await this.host.prompt({
           sessionID: req.sessionID,
           text: req.text,
@@ -1468,6 +1480,8 @@ export class Spoke {
         return this.rename(req.sessionID, req.title)
       case "removeFront":
         return this.removeFront(req.sessionID)
+      case "frontUpdate":
+        return { queued: this.fronts.update(req.sessionID, req.text, req.finished === true) } satisfies ResultFor["frontUpdate"]
       case "dismissError":
         this.unheardFailures.delete(req.sessionID)
         return { dismissed: this.tracker.dismissError(req.sessionID) } satisfies ResultFor["dismissError"]
@@ -1862,7 +1876,7 @@ export class Spoke {
       const ref = value ? parseModelRef(value) : undefined
       return ref && { providerID: ref.providerID, modelID: ref.id, ...(ref.variant ? { variant: ref.variant } : {}) }
     }
-    return { ...(convert(this.config.voiceModel) ? { voice: convert(this.config.voiceModel)! } : {}), ...(convert(this.config.workModel) ? { worker: convert(this.config.workModel)! } : {}) }
+    return convert(this.config.voiceModel) ? { voice: convert(this.config.voiceModel)! } : {}
   }
 
   private modelPrefsResult(sessionID: string): ResultFor["modelPrefs"] {
@@ -1885,18 +1899,24 @@ export class Spoke {
       }
     }
     const host = this.host
-    const [messages, models, mcp, diffs, branch] = await Promise.all([
+    const [messages, models, mcp, diffs, branch, session] = await Promise.all([
       optional(() => this.shownMessages(sessionID)),
       optional(host.listModels && (() => host.listModels!())),
       optional(host.mcpList && (() => host.mcpList!(directory))),
       optional(host.vcsDiff && (() => host.vcsDiff!(directory))),
       optional(host.vcsBranch && (() => host.vcsBranch!(directory))),
+      optional(() => host.getSession(sessionID)),
     ])
     const context = messages && contextUsage(messages, models ?? [])
+    // The session's own model: chosen, else what its latest reply ran on; the default model only before any reply.
+    const latest = sessionModel({ chosen: session?.model, ...(messages ? { messages } : {}), models: models ?? [] })
+    const fallback = latest ? undefined : await optional(host.defaultModel && (() => host.defaultModel!(directory)))
+    const model = latest ?? sessionModel({ fallback, models: models ?? [] })
     return {
       directory,
       ...(branch ? { branch } : {}),
       ...(context ? { context } : {}),
+      ...(model ? { model } : {}),
       ...(mcp ? { mcp: mcpServers(mcp) } : {}),
       ...(diffs ? { changes: changeStats(diffs) } : {}),
     }
@@ -1919,57 +1939,24 @@ export class Spoke {
     return { stopped: order }
   }
 
-  /** Applies a saved Voice override at the boundary before the next turn; never changes a running tree. */
-  /**
-   * A cleared override switches back to the model the session had before the first override, unless the
-   * user picked another model meanwhile.
-   */
-  private async applyVoiceModel(sessionID: string): Promise<void> {
-    const selected = this.modelPrefs.get(sessionID)?.voice
-    const override = this.voiceOverrides.get(sessionID)
-    // A session with a voice front keeps its model: the voice selection is the front's.
-    if (this.fronts.frontOf(sessionID)) return
-    if ((!selected && !override) || this.tracker.active().includes(this.tracker.rootOf(sessionID))) return
-    const current = await this.currentModel(sessionID)
-    const onOverride = override !== undefined && current !== undefined && sameModel(current, override.applied)
-    if (!selected) {
-      this.voiceOverrides.delete(sessionID)
-      if (onOverride && override.previous) await this.switchModel(sessionID, override.previous)
-      return
-    }
-    const target = { providerID: selected.providerID, id: selected.modelID, ...(selected.variant ? { variant: selected.variant } : {}) }
-    if (current && sameModel(current, target)) {
-      if (override) this.voiceOverrides.set(sessionID, { ...override, applied: target })
-      return
-    }
-    const previous = onOverride ? override.previous : current ? plainModelRef(current) : undefined
-    this.voiceOverrides.set(sessionID, { ...(previous ? { previous } : {}), applied: target })
-    await this.switchModel(sessionID, target)
-  }
-
-  /** The session's current model: remembered, else asked from OpenCode (and remembered). */
-  private async currentModel(sessionID: string): Promise<ModelRef | undefined> {
-    const known = this.sessionModels.get(sessionID)
-    if (known) return known.model
-    const { model } = await this.host.getSession(sessionID)
-    this.rememberModel(sessionID, model)
-    return model
-  }
-
-  private rememberModel(sessionID: string, model: ModelRef | undefined): void {
-    this.sessionModels.delete(sessionID)
-    this.sessionModels.set(sessionID, model ? { model } : {})
-    if (this.sessionModels.size > SESSION_MODELS_LIMIT) this.sessionModels.delete(this.sessionModels.keys().next().value!)
+  private async switchModel(sessionID: string, model: ModelRef): Promise<void> {
+    await this.host.switchModel(sessionID, model)
   }
 
-  private async switchModel(sessionID: string, model: ModelRef): Promise<void> {
-    try {
-      await this.host.switchModel(sessionID, model)
-      this.rememberModel(sessionID, model)
-    } catch (cause) {
-      this.sessionModels.delete(sessionID) // unknown now: ask next time
-      throw cause
-    }
+  /**
+   * (feature "setModel") The session's own model, as the console picked it: OpenCode's session.switchModel stores it
+   * on the session, so every later turn runs on it whoever prompts (the console, the TUI, a voice relay). Only a
+   * model (and variant) of this OpenCode's catalog; no variant: the model's default.
+   */
+  private async setSessionModel(sessionID: string, model: ModelSelection): Promise<ResultFor["setModel"]> {
+    const catalog = (await this.host.listModels?.()) ?? []
+    const known = catalog.find((value: any) => value?.providerID === model.providerID && (typeof value.id === "string" && value.id ? value.id : value.modelID) === model.modelID) as any
+    const variants: string[] = Array.isArray(known?.variants) ? known.variants.flatMap((v: any) => (typeof v?.id === "string" ? [v.id] : [])) : []
+    const variant = model.variant && model.variant !== "default" ? model.variant : undefined
+    if (!known || (variant && !variants.includes(variant))) throw new Error(`Unknown model ${model.providerID}/${model.modelID}${variant ? `#${variant}` : ""} for this session`)
+    const ref: ModelRef = { providerID: model.providerID, id: model.modelID, ...(variant ? { variant } : {}) }
+    await this.switchModel(sessionID, ref)
+    return { model: sessionModel({ chosen: ref, models: catalog })! }
   }
 
   /** Enables or disables voice for a session this process reported (mode "session" only). */
@@ -2070,7 +2057,7 @@ export class Spoke {
 
   private async turn(sessionID: string, text: string, voiceStyle: boolean, images?: readonly PromptImage[]): Promise<TurnResult> {
     if (this.running.has(sessionID)) throw new Error("A turn is already running for this session")
-    if (isExposed(this.config, this.tracker, sessionID)) await this.applyVoiceModel(sessionID)
+    await this.checkAgent(sessionID)
     this.running.add(sessionID)
     if (voiceStyle) this.voiceTurns.set(sessionID, (this.voiceTurns.get(sessionID) ?? 0) + 1)
     try {
@@ -2096,11 +2083,11 @@ export class Spoke {
 
   private async listen(): Promise<void> {
     while (!this.abort.signal.aborted) {
-      // Model changes may have been missed while the stream was down: ask OpenCode again.
-      this.sessionModels.clear()
       try {
         // Events may have been missed while the stream was down (or before it opened): ask what runs now.
         if (this.connection?.state === "connected") void this.seedActivity()
+        // (voice front) A relay delivered or cancelled in a gap must not hold the front's reports.
+        void this.reconcileFronts()
         for await (const event of this.host.events(this.abort.signal)) this.observe(event)
       } catch (cause) {
         if (this.abort.signal.aborted) return
@@ -2116,7 +2103,6 @@ export class Spoke {
       const sessionID = (event.data as Record<string, unknown> | undefined)?.sessionID
       if (typeof sessionID === "string") this.timelines.invalidate(sessionID)
       this.turns.observe(event)
-      this.observeModel(event)
       this.origins.observe(event)
       if (event.type === "session.deleted" && typeof sessionID === "string") {
         this.tokens.delete(sessionID)
@@ -2140,13 +2126,15 @@ export class Spoke {
       this.trackAsk(event)
       if (this.tracker.observe(event, Date.now())) this.scheduleSnapshot()
       this.observeFronts(event, sessionID)
+      if (typeof sessionID === "string") this.observeAgent(event, sessionID)
       if (REVERT_EVENTS.has(event.type) && typeof sessionID === "string") void this.observeRevert(event, sessionID)
       if (typeof sessionID === "string") this.profiles.settle(sessionID) // a turn boundary makes a staged profile effective
       if (this.host.listRecent && LISTING_EVENTS.has(event.type) && !(event.data as any)?.parentID) {
         this.scheduleSeed()
       }
       void this.fetchInfo()
-      this.forward(event)
+      // (voice front) A front's text after its hand-off in the same run is never spoken: the turn ends there.
+      if (!this.fronts.dropText(event)) this.forward(event)
     } catch (cause) {
       console.error("[hub] event handling failed", cause)
     }
@@ -2180,6 +2168,18 @@ export class Spoke {
     this.voiceTitled.delete(sessionID)
   }
 
+  /**
+   * The removed "voice" agent: a session switched onto it is checked again before the hub's next prompt, and a turn
+   * that failed on it (typed in the TUI) moves the session to the default agent, so the next one runs.
+   */
+  private observeAgent(event: EventLike, sessionID: string): void {
+    const data = event.data as Record<string, unknown> | undefined
+    if (event.type === "session.agent.selected" && data?.agent === LEGACY_VOICE_AGENT) this.agentChecked.delete(sessionID)
+    if (event.type !== "session.execution.failed") return
+    const message = (data?.error as { message?: unknown } | undefined)?.message
+    if (typeof message === "string" && message.includes(`Agent not found: "${LEGACY_VOICE_AGENT}"`)) void this.leaveRemovedAgent(sessionID, LEGACY_VOICE_AGENT)
+  }
+
   /** The main session of a front, also of a failed one (still reported hidden until deleted). */
   private frontMainOf(sessionID: string): string | undefined {
     const main = this.fronts.mainOf(sessionID)
@@ -2301,24 +2301,15 @@ export class Spoke {
 
   /**
    * Adds who put the item in the inbox (user or hub) to session.inbox.delivered, for hubs that route messages
-   * (they reset reply-chain hops on a user's turn); when unknown, the event goes out unchanged.
+   * (they reset reply-chain hops on a user's turn), and `carried` for a user prompt the hub carried (feature
+   * inboxCarried); when unknown, the event goes out unchanged.
    */
   private withOrigin<E extends { type: string; data: Record<string, unknown> }>(event: E | undefined): E | undefined {
     if (event?.type !== "session.inbox.delivered" || typeof event.data.inboxID !== "string") return event
+    const carried = this.origins.carried(event.data.inboxID)
     const origin = this.origins.take(event.data.inboxID)
-    return origin && this.hubSupports("messaging") ? { ...event, data: { ...event.data, origin } } : event
-  }
-
-  /** Keeps the remembered session models current from OpenCode's events. */
-  private observeModel(event: EventLike): void {
-    const data = (event.data ?? {}) as { sessionID?: unknown; model?: unknown }
-    if (typeof data.sessionID !== "string") return
-    if (event.type === "session.deleted") this.sessionModels.delete(data.sessionID)
-    else if (event.type === "session.model.selected") {
-      const model = data.model as Partial<ModelRef> | undefined
-      if (model && typeof model.providerID === "string" && typeof model.id === "string") this.rememberModel(data.sessionID, model as ModelRef)
-      else this.sessionModels.delete(data.sessionID)
-    }
+    // (Session findability) carried: the hub carried this user prompt itself (it is not one typed in the terminal).
+    return origin && this.hubSupports("messaging") ? { ...event, data: { ...event.data, origin, ...(carried ? { carried: true } : {}) } } : event
   }
 
   private async fetchInfo(): Promise<void> {
@@ -2545,9 +2536,8 @@ function limitWorkspaces(workspaces: readonly HerdrWorkspace[]): HerdrWorkspace[
   return workspaces.slice(0, 200).map((w) => ({ id: w.id, label: w.label, directories: w.directories.slice(0, 20) }))
 }
 
-/** Sessions whose current model is remembered. */
-const SESSION_MODELS_LIMIT = 500
+/** The end of a hand-off tool's result: the front's turn is over (anything it writes after is not spoken anyway). */
+const HANDOFF_DONE = "Your turn is over: write nothing more now. You will get a <system-update> when there is news."
 
-function sameModel(a: ModelRef, b: ModelRef): boolean {
-  return a.providerID === b.providerID && a.id === b.id && (explicitVariant(a) ?? "") === (explicitVariant(b) ?? "")
-}
+/** Sessions remembered as checked for the removed voice agent. */
+const AGENT_CHECKED_LIMIT = 500