@maudecode/talaria-web 1.15.0 → 1.17.2

package/sidecar/talaria_sidecar/methods/chat.py

@@ -11,14 +11,18 @@ through ``approval.respond`` / ``clarify.respond``; ``rpc.cancel`` or
 from __future__ import annotations
 
 import contextlib
+import contextvars
+import copy
 import hashlib
 import inspect
 import json
 import logging
+import os
 import threading
 import time
 import uuid
 from collections import OrderedDict
+from pathlib import Path
 from typing import Any
 
 from ..errors import InvalidParams, RpcError
@@ -28,6 +32,10 @@ from ..rpc import CallContext
 log = logging.getLogger("talaria_sidecar.chat")
 
 _AGENT_CACHE_MAX = 32
+# Shutdown waits this long for evicted agents' memory providers; the server kills the sidecar 5 s after closing stdin.
+_AGENT_RELEASE_TIMEOUT = 4.0
+# Profile deletion waits this long for the profile's memory flushes, under the server's 120 s call timeout.
+_PROFILE_RELEASE_TIMEOUT = 60.0
 _TOOL_RESULT_SNIPPET_MAX = 4000
 # Predecessor ``_TOOL_ARG_CONTENT_KEYS`` (#4928): card content / diff-reconstruction inputs keep the long cap.
 _TOOL_ARG_CONTENT_KEYS = frozenset({"command", "cmd", "script", "code", "patch", "diff", "old_string", "new_string", "content", "path", "file_path"})
@@ -64,8 +72,16 @@ _RUNS_BY_SESSION: dict[str, str] = {}
 _APPROVAL_CB_OWNER: dict[str, str] = {}
 _APPROVAL_CB_LOCK = threading.Lock()
 _RUNS_LOCK = threading.Lock()
-_AGENT_CACHE: "OrderedDict[str, tuple[Any, str]]" = OrderedDict()
+# session id -> (agent, signature, profile home).
+_AGENT_CACHE: "OrderedDict[str, tuple[Any, str, Any]]" = OrderedDict()
 _AGENT_CACHE_LOCK = threading.Lock()
+# Running release thread -> the profile home it runs under.
+_RELEASES: dict[threading.Thread, Any] = {}
+_RELEASES_LOCK = threading.Lock()
+# Agents inside ``chat.commit_memory`` (guarded by ``_AGENT_CACHE_LOCK``): like a turn, a commit defers their release.
+_COMMITTING: list = []
+# Set (under ``_RUNS_LOCK``) when shutdown drains: no turn is admitted after the drain's snapshot of ``_RUNS``.
+_DRAINING = threading.Event()
 
 
 def _snippet(raw: Any, limit: int = _TOOL_RESULT_SNIPPET_MAX) -> str:
@@ -87,6 +103,16 @@ _RAW_RESULT_MAX_KEYS = 64
 _RAW_RESULT_OUTCOME_KEYS = ("error", "exit_code", "exitCode", "success")
 
 
+def _result_diff(raw: Any) -> str | None:
+    """A dict (or JSON-object text) result's string ``diff`` field, whole; the server decides what it shows."""
+    try:
+        data = raw if isinstance(raw, dict) else json.loads(str(raw or ""))
+    except Exception:  # noqa: BLE001
+        return None
+    diff = data.get("diff") if isinstance(data, dict) else None
+    return diff if isinstance(diff, str) else None
+
+
 def _raw_result(raw: Any, limit: int = _TOOL_RESULT_SNIPPET_MAX) -> Any:
     """The tool result as the server's outcome rule reads it, bounded: a dict (or JSON-object text) keeps its first
     ``_RAW_RESULT_MAX_KEYS`` top-level fields plus its outcome fields, scalars as they are, text and non-empty nested
@@ -231,6 +257,98 @@ def _context_length(agent: Any) -> dict:
     return out
 
 
+# TAL-539: the hard cap on raw tool output kept in a compressed context (predecessor ``_hard_prune_post_compression_*``).
+_TAIL_TOOL_BUDGET_TOKENS = 4096
+_TAIL_TOOL_MIN_SNIPPET_TOKENS = 256
+_ROUGH_TOKEN_CHARS = 4
+
+
+def _content_text(content: Any) -> str:
+    if isinstance(content, list):
+        return " ".join(str(p.get("text") or "") for p in content if isinstance(p, dict))
+    return str(content or "")
+
+
+def _rough_tokens(text: str) -> int:
+    """The Agent's estimate, which counts CJK and other non-ASCII text as denser; ceil(chars / 4) without it."""
+    try:
+        from agent.model_metadata import estimate_tokens_rough
+
+        return int(estimate_tokens_rough(text))
+    except Exception:  # noqa: BLE001
+        return -(-len(text) // _ROUGH_TOKEN_CHARS)
+
+
+def _capped_tool_result(text: str, tokens: int, keep_tokens: int) -> str:
+    """The kept head of an over-budget tool result plus a note on what the model no longer sees."""
+    prefix = "[Talaria context budget: omitted "
+    suffix = f" (~{tokens} rough tokens) from this tool result; the full output remains in the visible transcript.]"
+    if keep_tokens < _TAIL_TOOL_MIN_SNIPPET_TOKENS:
+        return f"{prefix}{len(text)} chars{suffix}"
+    room = keep_tokens - _rough_tokens(f"{prefix}{len(text)} of {len(text)} chars{suffix}") - 1
+    snippet = text[: len(text) * room // tokens]
+    # Density varies along the text: shrink until the kept head fits the remaining tokens.
+    while snippet and _rough_tokens(snippet) > room:
+        snippet = snippet[: len(snippet) * 3 // 4]
+    snippet = snippet.rstrip()
+    if not snippet:
+        return f"{prefix}{len(text)} chars{suffix}"
+    return f"{snippet}\n\n{prefix}{len(text) - len(snippet)} of {len(text)} chars{suffix}"
+
+
+def _cap_tool_results(messages: list, compressor: Any) -> list:
+    """Newest tool results spend one shared budget; the first one over it is cut to the remainder, older ones to a note."""
+    budget = getattr(compressor, "tail_token_budget", None)
+    budget = budget if isinstance(budget, int) and budget > 0 else _TAIL_TOOL_BUDGET_TOKENS
+    threshold = getattr(compressor, "threshold_tokens", None)
+    if isinstance(threshold, int) and threshold > 0:
+        budget = min(budget, max(512, threshold // 2))
+    budget = max(512, budget)
+    spent = 0
+    out = list(messages)
+    for i in range(len(out) - 1, -1, -1):
+        msg = out[i]
+        if msg.get("role") != "tool":
+            continue
+        text = _content_text(msg.get("content"))
+        if not text.strip():
+            continue
+        tokens = _rough_tokens(text)
+        if tokens <= budget - spent:
+            spent += tokens
+            continue
+        out[i] = {**msg, "content": _capped_tool_result(text, tokens, budget - spent)}
+        spent = budget
+    return out
+
+
+def _post_compression_context(agent: Any, messages: list, system_message: Any) -> tuple[list, int | None]:
+    """TAL-539: tool output produced after a mid-turn compression never went through the compressor's pruning. Run that
+    pruning plus a hard cap on the model context, and estimate the next request from it (predecessor
+    ``_prune_context_tool_results_after_compression`` / ``_estimate_post_compression_context_tokens``)."""
+    compressor = getattr(agent, "context_compressor", None)
+    context = messages
+    prune = getattr(compressor, "_prune_old_tool_results", None)
+    if callable(prune):
+        try:
+            pruned, count = prune(copy.deepcopy(messages), protect_tail_count=getattr(compressor, "protect_last_n", 20), protect_tail_tokens=getattr(compressor, "tail_token_budget", None))
+            if count and isinstance(pruned, list) and len(pruned) == len(messages):
+                context = pruned
+        except Exception:  # noqa: BLE001 - the hard cap below still bounds the context
+            log.debug("post-compression tool-result pruning failed", exc_info=True)
+    context = _cap_tool_results(context, compressor)
+    estimate = None
+    try:
+        from agent.model_metadata import estimate_request_tokens_rough
+
+        # The request carries the ephemeral prompt (surface, personality, delivery) after the system message.
+        prompts = [p for p in (system_message, getattr(agent, "ephemeral_system_prompt", None)) if isinstance(p, str) and p.strip()]
+        estimate = estimate_request_tokens_rough(context, system_prompt="\n\n".join(prompts), tools=getattr(agent, "tools", None) or None)
+    except Exception:  # noqa: BLE001 - display-only figure
+        log.debug("post-compression context estimate failed", exc_info=True)
+    return context, estimate if isinstance(estimate, int) and estimate > 0 else None
+
+
 def _clarify_timeout(params: dict) -> int:
     """Predecessor ``_clarify_timeout_seconds``: an explicit request value wins, else the Agent's resolver over config."""
     explicit = params.get("clarify_timeout_seconds")
@@ -372,7 +490,7 @@ def _resolve_runtime(provider: str | None, model: str) -> dict:
 def _turn_identity(session_id: str, workspace: str):
     """Bind this turn's identity to the calling context the way the predecessor's ``_set_turn_session_identity`` did:
     the approval session key (so ``register_gateway_notify`` cards reach this turn and dangerous commands are gated
-    instead of auto-approved), the gateway session vars (platform ``webui``, chat/ui session ids), and the session cwd
+    instead of auto-approved), the gateway session vars (platform ``webui``, chat/ui session ids, profile), and the session cwd
     (so terminals and AGENTS.md discovery run in the selected workspace, not the sidecar's launch directory). Every
     binding is a context variable, so concurrent turns cannot overwrite each other. Missing Agent surfaces are logged,
     not fatal."""
@@ -388,10 +506,14 @@ def _turn_identity(session_id: str, workspace: str):
         log.debug("per-turn approval session-key bind failed", exc_info=True)
     try:
         from gateway import session_context as sc
+        from hermes_cli.profiles import get_active_profile_name
+        from hermes_constants import get_hermes_home, profile_name_for_home
 
+        # The persistent Docker sandbox is keyed by the profile name; unbound, every profile reuses "default".
+        profile = profile_name_for_home(get_hermes_home()) or get_active_profile_name()
         pairs = [
             (sc._SESSION_KEY, session_id), (sc._SESSION_UI_SESSION_ID, session_id), (sc._SESSION_PLATFORM, "webui"),
-            (sc._SESSION_CHAT_ID, session_id), (sc._SESSION_ID, session_id),
+            (sc._SESSION_CHAT_ID, session_id), (sc._SESSION_ID, session_id), (sc._SESSION_PROFILE, profile),
         ]
         for var, value in pairs:
             tok = var.set(value)
@@ -415,6 +537,87 @@ def _turn_identity(session_id: str, workspace: str):
                 log.debug("per-turn identity reset failed", exc_info=True)
 
 
+#: Older configs named the CLI composite ``hermes``; the Agent registers it split in two (predecessor
+#: ``_LEGACY_CLI_TOOLSET_ALIASES``).
+_LEGACY_TOOLSET_ALIASES = {"hermes": ("hermes-cli", "hermes-api-server")}
+
+
+def _turn_toolsets(toolsets) -> list[str]:
+    """The session's override as sent, else the profile's configured toolsets. ``None`` would hand the Agent every
+    registered toolset."""
+    return toolsets if isinstance(toolsets, list) else _profile_toolsets()
+
+
+def _profile_toolsets() -> list[str]:
+    """The profile's ``platform_toolsets.cli`` through the Agent's own resolver (default-off toolsets stay off), like
+    ``hermes chat``. Runs under the call's ``scoped_home``."""
+    from hermes_cli.config import load_config
+    from hermes_cli.tools_config import _get_platform_tools
+
+    resolved = sorted(_get_platform_tools(load_config() or {}, "cli"))
+    return list(dict.fromkeys(name for raw in resolved for name in _LEGACY_TOOLSET_ALIASES.get(raw, (raw,))))
+
+
+def _discover_mcp_tools(run: _Run) -> None:
+    """Connect the profile's MCP servers before the turn's agent snapshots its tools, like the predecessor's turn start.
+    The Agent keys connections by profile scope and skips live ones, so later turns are cheap. Runs under the call's
+    ``scoped_home``; a failure leaves the turn without MCP tools rather than failing it. A Stop does not wait for a slow
+    server: the turn moves on to its cancelled end while the connect finishes in the background."""
+    from .commands import retire_unscoped_launch_mcp_servers
+
+    done = threading.Event()
+
+    def discover() -> None:
+        try:
+            from tools.mcp_tool_discovery import discover_mcp_tools
+
+            retire_unscoped_launch_mcp_servers()
+            discover_mcp_tools()
+        except Exception:  # noqa: BLE001
+            log.warning("MCP discovery failed", exc_info=True)
+        finally:
+            done.set()
+
+    # The copied context carries the turn's home override and secret scope into the worker.
+    threading.Thread(target=contextvars.copy_context().run, args=(discover,), daemon=True, name=f"chat-mcp-{run.stream_id[:8]}").start()
+    while not done.wait(0.25):
+        if run.cancel.is_set() or run.ctx.cancelled:
+            return
+
+
+def _profile_fallback_chain() -> list[dict] | None:
+    """The profile's fallback routes (``fallback_providers`` first, then legacy ``fallback_model``, deduplicated)
+    through the Agent's own resolver, like the CLI and gateway. Runs under the call's ``scoped_home``."""
+    from hermes_cli.config import load_config
+    from hermes_cli.fallback_config import get_fallback_chain
+
+    return get_fallback_chain(load_config() or {}) or None
+
+
+def _main_model_request_overrides(model: str, provider) -> dict | None:
+    """Predecessor ``_main_model_request_overrides``: the profile's ``model.service_tier`` and ``model.extra_body``
+    (written by ``/api/model/set``) apply only to turns on that configured main model. Runs under ``scoped_home``."""
+    from hermes_cli.config import load_config
+
+    model_cfg = (load_config() or {}).get("model")
+    if not isinstance(model_cfg, dict):
+        return None
+    main_model = str(model_cfg.get("default") or model_cfg.get("name") or "").strip()
+    main_provider = str(model_cfg.get("provider") or "").strip().lower()
+    if not main_model or main_model != model.strip():
+        return None
+    # An unset or ``auto`` main provider resolves at runtime, so the model id alone identifies the main model.
+    if main_provider not in ("", "auto") and main_provider != str(provider or "").strip().lower():
+        return None
+    overrides: dict = {}
+    if str(model_cfg.get("service_tier") or "").strip().lower() == "priority":
+        overrides["service_tier"] = "priority"
+    extra_body = model_cfg.get("extra_body")
+    if isinstance(extra_body, dict) and extra_body:
+        overrides["extra_body"] = extra_body
+    return overrides or None
+
+
 def _agent_signature(model: str, provider, runtime: dict, toolsets, home: str, kwargs: dict) -> str:
     """Cache identity of an ``AIAgent``: everything its constructor bound from the resolved runtime, so a rotated key,
     a different API mode, ACP command, or credential pool never reuses an agent built for the old bundle. The key
@@ -430,6 +633,9 @@ def _agent_signature(model: str, provider, runtime: dict, toolsets, home: str, k
         "max_iterations": kwargs.get("max_iterations"), "max_tokens": kwargs.get("max_tokens"),
         # Bound at construction too: a reasoning-effort change from the composer must build a fresh agent.
         "reasoning_config": kwargs.get("reasoning_config"),
+        "request_overrides": kwargs.get("request_overrides"),
+        # Entries may carry their own ``api_key``.
+        "fallback_model": hashlib.sha256(json.dumps(kwargs.get("fallback_model"), sort_keys=True, default=str).encode("utf-8")).hexdigest()[:16],
     }
     return json.dumps(bundle, sort_keys=True, default=str)
 
@@ -440,19 +646,164 @@ def _evict_idle_agents_locked() -> None:
         return
     with _RUNS_LOCK:
         live = {sid for sid, sid_stream in _RUNS_BY_SESSION.items() if (r := _RUNS.get(sid_stream)) is not None and not r.finished.is_set()}
+    dropped = []
     for sid in list(_AGENT_CACHE):
         if len(_AGENT_CACHE) <= _AGENT_CACHE_MAX:
             break
         if sid not in live:
-            _AGENT_CACHE.pop(sid, None)
+            dropped.append(_AGENT_CACHE.pop(sid))
+    _release_agents_locked(dropped)
+
+
+def _release_agent(agent, home) -> threading.Thread:
+    """The gateway's soft eviction on a daemon thread under the owning profile: end the memory session with the
+    transcript (``on_session_end``, then provider shutdown), then release the LLM clients (the Codex app-server child,
+    httpx pools) while session tool state stays for a resumed session."""
+
+    def call(name: str, *args) -> bool:
+        method = getattr(agent, name, None)
+        if not callable(method):
+            return True
+        try:
+            method(*args)
+        except Exception:  # noqa: BLE001 - one failed phase never skips the next
+            log.warning("evicted agent %s() failed", name, exc_info=True)
+            return False
+        return True
+
+    def release() -> None:
+        released = False
+        try:
+            with scoped_home(home):
+                messages = getattr(agent, "_session_messages", None)
+                flushed = call("shutdown_memory_provider", messages if isinstance(messages, list) else None)
+                released = True
+                thread.failed = not (call("release_clients") and flushed)
+        except Exception:  # noqa: BLE001 - the profile scope could not be entered
+            log.warning("releasing an evicted agent under its profile failed", exc_info=True)
+            thread.failed = True
+        finally:
+            if not released:
+                # The memory flush needs the profile; the LLM clients and the Codex child close regardless.
+                call("release_clients")
+            _release_session_db(getattr(agent, "_talaria_session_db", None))
+            with _RELEASES_LOCK:
+                _RELEASES.pop(thread, None)
+
+    thread = threading.Thread(target=release, daemon=True, name="chat-agent-release")
+    thread.failed = False  # type: ignore[attr-defined] - read by profile deletion
+    with _RELEASES_LOCK:
+        _RELEASES[thread] = home
+    thread.start()
+    return thread
+
+
+def _release_agents_locked(entries) -> list[threading.Thread]:
+    """Release cache entries that just left the cache (caller holds ``_AGENT_CACHE_LOCK``). An agent a turn still holds
+    keeps its memory provider and clients; that turn releases it when it ends."""
+    with _RUNS_LOCK:
+        held = [run.agent for run in _RUNS.values()] + _COMMITTING
+    return [_release_agent(agent, home) for agent, _signature, home in entries if not any(agent is other for other in held)]
+
+
+def _release_if_dropped_locked(agent, home) -> None:
+    """A holder (turn or commit) is done with ``agent``: release it if it left the cache meanwhile and nothing else holds
+    it (caller holds ``_AGENT_CACHE_LOCK``)."""
+    if agent is not None and not any(entry[0] is agent for entry in _AGENT_CACHE.values()):
+        _release_agents_locked([(agent, None, home)])
+
+
+def _join(threads, deadline: float) -> None:
+    for thread in threads:
+        thread.join(max(0.0, deadline - time.monotonic()))
 
 
 def evict_all_agents() -> int:
     """Drop every cached agent (credentials or environment changed underneath them)."""
     with _AGENT_CACHE_LOCK:
-        count = len(_AGENT_CACHE)
+        entries = list(_AGENT_CACHE.values())
         _AGENT_CACHE.clear()
-    return count
+        _release_agents_locked(entries)
+    return len(entries)
+
+
+def drain_agents(timeout: float = _AGENT_RELEASE_TIMEOUT) -> None:
+    """Shutdown: release every cached agent, stop running turns (like a Stop) so each releases the agent it holds, and
+    wait, bounded, for those turns and every release still running."""
+    deadline = time.monotonic() + timeout
+    evict_all_agents()
+    with _RUNS_LOCK:
+        _DRAINING.set()
+        runs = list(_RUNS.values())
+    for run in runs:
+        run.cancel.set()
+    while time.monotonic() < deadline:
+        with _AGENT_CACHE_LOCK, _RUNS_LOCK:
+            if not _COMMITTING and not any(_RUNS.get(run.stream_id) is run for run in runs):
+                break
+        time.sleep(0.05)
+    # A turn may have cached its agent after the first eviction.
+    evict_all_agents()
+    with _RELEASES_LOCK:
+        threads = list(_RELEASES)
+    _join(threads, deadline)
+
+
+def release_profile_agents(home) -> None:
+    """Profile deletion: release the profile's cached agents and wait for every release running under its home. Fails
+    rather than let the home go while a memory flush still runs under it."""
+    target = os.path.realpath(home)
+    with _AGENT_CACHE_LOCK:
+        entries = [_AGENT_CACHE.pop(sid) for sid, entry in list(_AGENT_CACHE.items()) if os.path.realpath(entry[2]) == target]
+        _release_agents_locked(entries)
+    with _RELEASES_LOCK:
+        threads = [thread for thread, owner in _RELEASES.items() if os.path.realpath(owner) == target]
+    _join(threads, time.monotonic() + _PROFILE_RELEASE_TIMEOUT)
+    if any(thread.is_alive() for thread in threads):
+        raise RpcError("The profile is still saving memory from its chats. Retry in a moment.")
+    if any(thread.failed for thread in threads):
+        raise RpcError("Memory from the profile's chats could not be saved; see the sidecar log. Retry to delete the profile anyway.")
+
+
+def _acquire_session_db(home):
+    """TAL-529: the profile's ``state.db`` from the Agent's shared-handle registry, one reference per agent (released with
+    it), so the turn's conversation reaches ``hermes sessions``, CLI resume, and ``session_search``. None when it cannot
+    open: the turn runs without it, like the predecessor's ``_build_session_db_for_stream``."""
+    try:
+        from hermes_state_registry import acquire
+
+        return acquire(Path(home) / "state.db")
+    except Exception:  # noqa: BLE001
+        log.warning("state.db unavailable under %s; this agent's turns will not reach it", home, exc_info=True)
+        return None
+
+
+def _release_session_db(db) -> None:
+    if db is None:
+        return
+    try:
+        from hermes_state_registry import release_or_close
+
+        release_or_close(db)
+    except Exception:  # noqa: BLE001
+        log.warning("releasing an agent's state.db handle failed", exc_info=True)
+
+
+def _execution_session_id(db, session_id: str) -> str:
+    """Predecessor ``_resolve_agent_execution_session_id``: a new agent for a session the Agent rotated by compression
+    (the old agent went with a sidecar restart or a runtime change) runs on the live tip, with the server's history,
+    rather than the closed Web id. The tip qualifies as in the Agent's own adoption: a different, still-open row. Any
+    doubt keeps the Web id."""
+    try:
+        tip = db.get_compression_tip(session_id)
+        if tip and tip != session_id:
+            row = db.get_session(tip)
+            if row and row.get("ended_at") is None:
+                log.info("agent for %s runs on its live compression tip %s", session_id, tip)
+                return str(tip)
+    except Exception:  # noqa: BLE001
+        log.warning("compression tip lookup failed for %s", session_id, exc_info=True)
+    return session_id
 
 
 def _agent_class():
@@ -463,6 +814,15 @@ def _agent_class():
     return AIAgent
 
 
+def _max_iterations_summary_request() -> str:
+    """The user row the Agent appends to ask for a summary once its tool budget runs out; the server drops it."""
+    try:
+        from agent.context_compressor import MAX_ITERATIONS_SUMMARY_REQUEST
+    except Exception:  # noqa: BLE001
+        return ""
+    return str(MAX_ITERATIONS_SUMMARY_REQUEST)
+
+
 def _supported(cls, name: str) -> bool:
     """Whether ``cls.__init__`` accepts ``name`` (named, or through ``**kwargs``)."""
     try:
@@ -472,6 +832,64 @@ def _supported(cls, name: str) -> bool:
     return name in parameters or any(p.kind is inspect.Parameter.VAR_KEYWORD for p in parameters.values())
 
 
+def _approval_notifier(session_id: str, emit):
+    """The Agent's gateway notify callback for one turn: emits each parked approval, then ``approval_resolved``
+    (id plus the Agent's reason) once its wait ends by any path, an ``approvals.timeout`` expiry included (TAL-514)."""
+    try:
+        from tools.approval import register_gateway_settle
+    except Exception:  # noqa: BLE001
+        register_gateway_settle = None
+
+    def notify(data):
+        payload = dict(data or {})
+        payload.setdefault("session_id", session_id)
+        payload.setdefault("approval_id", str(payload.get("request_id") or uuid.uuid4().hex))
+        emit("approval", payload)
+        request_id = str(payload.get("request_id") or "")
+        if register_gateway_settle is None or not request_id:
+            return
+        approval_id = payload["approval_id"]
+
+        def settle(reason):
+            emit("approval_resolved", {"approval_id": approval_id, "session_id": session_id, "reason": str(reason or "")})
+
+        # False: the wait already ended between the emit and this registration.
+        if not register_gateway_settle(session_id, request_id, settle):
+            settle("resolved")
+
+    return notify
+
+
+#: The Agent's compression-start lifecycle lines: "Compacting context" (and its heartbeat), pre-API, 413, and too-large
+#: compression. Preflight and idle notices are left out: "Compacting context" follows them once compression proceeds.
+_COMPRESSION_START_MARKERS = ("compacting context", "pre-api compression:", "context too large", "— compressing (", "- compressing (", "compression attempt")
+_COMPRESSION_NOT_STARTED = ("skipping", "defer", "cooldown", "will not start")
+
+
+def _is_compression_start(lower: str) -> bool:
+    """Predecessor ``_is_agent_compression_start_status``: only real start notices, never skips or post-compress chatter."""
+    if any(marker in lower for marker in _COMPRESSION_NOT_STARTED):
+        return False
+    if "compressed" in lower and "compressing" not in lower and "compression attempt" not in lower:
+        return False
+    return any(marker in lower for marker in _COMPRESSION_START_MARKERS)
+
+
+def _status_events(kind, text: str) -> list[str]:
+    """Events for one Agent status line: the compressing card, a fallback warning, and the turn's terminal error."""
+    lower = text.lower()
+    events = ["terminal_error"] if "non-retryable error" in lower else []
+    if str(kind or "").strip().lower() == "lifecycle":
+        if _is_compression_start(lower):
+            return events + ["compressing"]
+        # The Agent's own compression retries ("Compressed N → M messages, retrying...") are not provider fallbacks.
+        if "compress" in lower or "context reduced to" in lower:
+            return events
+    if "fallback" in lower or "rate limit" in lower or ("retry" in lower and "non-retryable" not in lower):
+        events.append("warning")
+    return events
+
+
 def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn, one function
     session_id = str(params.get("session_id") or "").strip()
     stream_id = str(params.get("stream_id") or "").strip()
@@ -487,10 +905,13 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
         history = []
     if not isinstance(history, list):
         raise InvalidParams("conversation_history must be a list")
-    toolsets = params.get("enabled_toolsets")
+    toolsets = _turn_toolsets(params.get("enabled_toolsets"))
     system_message = params.get("system_message")
+    home = profile_home_param(params)
     run = _Run(stream_id, session_id, ctx)
     with _RUNS_LOCK:
+        if _DRAINING.is_set():
+            raise RpcError("The sidecar is shutting down.", condition="sidecar_unavailable")
         prior = _RUNS.get(_RUNS_BY_SESSION.get(session_id) or "")
         # A previous turn for this session that never returned (a tool ignoring its interrupt) still owns the cached
         # agent; this turn must not share, rebind, or un-interrupt that live instance.
@@ -499,17 +920,24 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
         _RUNS_BY_SESSION[session_id] = stream_id
     raw_emit = ctx.emit
     steer_state = {"last": None}
+    usage_state = {"last": None}
 
     def emit(event, data=None):
         """Predecessor ``_webui_steer_events_before``: before content frames, report the Agent's pending steer text
-        whenever it changed so the server can mark consumed steers live rather than only after ``done``."""
+        whenever it changed so the server can mark consumed steers live rather than only after ``done``. TAL-397: the
+        Agent's session counters ride the same boundary, so the server meters cost and tokens while the turn runs."""
         if event in ("token", "reasoning", "interim_assistant", "tool", "tool_complete") and run.agent is not None:
             pending = _agent_pending_steer_text(run.agent)
             if pending != steer_state["last"]:
                 steer_state["last"] = pending
                 raw_emit("steer_pending", {"text": pending})
+            usage = _usage(run.agent)
+            if usage != usage_state["last"]:
+                usage_state["last"] = usage
+                raw_emit("usage", usage)
         raw_emit(event, data)
     try:
+        _discover_mcp_tools(run)
         runtime = _resolve_runtime(provider, model)
         resolved_model = model or str(runtime.get("model") or "")
         resolved_provider = provider or runtime.get("provider")
@@ -560,6 +988,13 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
                     call["snippet"] = snippet
                     break
             payload = {"event_type": "tool.completed", "name": name, "preview": snippet, "args": _args_snapshot(args), "tid": tid, "raw_result": _raw_result(function_result)}
+            # TAL-397: ``raw_result`` caps nested values, so the todo tool's list travels whole for the server's ``todo_state``.
+            if name == "todo" and function_result is not None:
+                payload["todo_result"] = function_result if isinstance(function_result, str) else json.dumps(function_result, default=str)
+            # TAL-448: likewise a result's unified ``diff``, so the server's ``edit_diff`` counts cover the whole change.
+            diff = _result_diff(function_result)
+            if diff is not None:
+                payload["result_diff"] = diff
             cost = _delegation_cost_usd(name, function_result)
             if cost is not None:
                 payload["cost_usd"] = cost
@@ -578,15 +1013,13 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
 
         def on_status(kind, message):
             text = str(message or "").strip()
-            if not text:
-                return
-            lower = text.lower()
-            if "compress" in lower and ("start" in lower or "compressing" in lower):
-                emit("compressing", {"session_id": session_id, "message": "Compressing context"})
-            elif "fallback" in lower or "rate limit" in lower or "retry" in lower:
-                emit("warning", {"type": "fallback", "message": text})
-            elif "non-retryable error" in lower:
-                emit("status", {"kind": "terminal_error", "message": text})
+            for event in _status_events(kind, text):
+                if event == "compressing":
+                    emit("compressing", {"session_id": session_id, "message": "Compressing context"})
+                elif event == "warning":
+                    emit("warning", {"type": "fallback", "message": text})
+                else:
+                    emit("status", {"kind": "terminal_error", "message": text})
 
         def clarify_callback(question, choices, multi_select=False, questions=None):
             choices_list = [str(c) for c in (choices or [])]
@@ -626,15 +1059,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             from tools.approval import register_gateway_notify, unregister_gateway_notify
         except Exception:  # noqa: BLE001
             register_gateway_notify = unregister_gateway_notify = None
-        if register_gateway_notify is not None:
-            def _approval_cb(data):
-                payload = dict(data or {})
-                payload.setdefault("session_id", session_id)
-                payload.setdefault("approval_id", str(payload.get("request_id") or uuid.uuid4().hex))
-                emit("approval", payload)
-            approval_cb = _approval_cb
-        else:
-            approval_cb = None
+        approval_cb = _approval_notifier(session_id, emit) if register_gateway_notify is not None else None
 
         kwargs: dict = dict(
             model=resolved_model,
@@ -643,7 +1068,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             api_key=runtime.get("api_key"),
             platform="webui",
             quiet_mode=True,
-            enabled_toolsets=toolsets if isinstance(toolsets, list) else None,
+            enabled_toolsets=toolsets,
             session_id=session_id,
             stream_delta_callback=on_token,
             reasoning_callback=on_reasoning,
@@ -671,23 +1096,48 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
         reasoning_config = params.get("reasoning_config")
         if isinstance(reasoning_config, dict) and _supported(AIAgent, "reasoning_config"):
             kwargs["reasoning_config"] = reasoning_config
+        fallback_chain = _profile_fallback_chain()
+        if fallback_chain and _supported(AIAgent, "fallback_model"):
+            kwargs["fallback_model"] = fallback_chain
+        request_overrides = _main_model_request_overrides(resolved_model, resolved_provider)
+        if request_overrides and _supported(AIAgent, "request_overrides"):
+            kwargs["request_overrides"] = request_overrides
         signature = _agent_signature(resolved_model, resolved_provider, runtime, toolsets, str(params.get("profile_home")), kwargs)
         agent = None
+
+        def bind(bound) -> None:
+            """Claim the agent for this run under ``_AGENT_CACHE_LOCK``, so an eviction never releases it mid-turn."""
+            run.prior_messages = getattr(bound, "_session_messages", None)
+            run.agent = bound
+
         if not session_busy:
             with _AGENT_CACHE_LOCK:
                 cached = _AGENT_CACHE.get(session_id)
                 if cached and cached[1] == signature:
                     agent = cached[0]
                     _AGENT_CACHE.move_to_end(session_id)
+                    bind(agent)
         if agent is not None:
             for name in ("stream_delta_callback", "reasoning_callback", "tool_progress_callback", "clarify_callback", "interim_assistant_callback", "tool_start_callback", "tool_complete_callback", "status_callback"):
                 if name in kwargs and hasattr(agent, name):
                     setattr(agent, name, kwargs[name])
         else:
-            agent = AIAgent(**kwargs)
+            # A ``/btw`` side question's throwaway session stays out of state.db.
+            session_db = _acquire_session_db(home) if not params.get("ephemeral") and _supported(AIAgent, "session_db") else None
+            if session_db is not None:
+                kwargs["session_db"] = session_db
+                kwargs["session_id"] = _execution_session_id(session_db, session_id)
+            try:
+                agent = AIAgent(**kwargs)
+            except BaseException:
+                _release_session_db(session_db)
+                raise
+            agent._talaria_session_db = session_db  # released with the agent (``_release_agent``)
             with _AGENT_CACHE_LOCK:
-                _AGENT_CACHE[session_id] = (agent, signature)
-                _AGENT_CACHE.move_to_end(session_id)
+                bind(agent)
+                replaced = _AGENT_CACHE.pop(session_id, None)
+                _AGENT_CACHE[session_id] = (agent, signature, home)
+                _release_agents_locked([replaced] if replaced else [])
                 _evict_idle_agents_locked()
         # Predecessor ``agent.ephemeral_system_prompt``: personality, surface context, progress guidance, and delivery
         # hints travel as runtime instructions that are never persisted to history.
@@ -701,8 +1151,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             with _APPROVAL_CB_LOCK:
                 register_gateway_notify(session_id, approval_cb)
                 _APPROVAL_CB_OWNER[session_id] = stream_id
-        run.prior_messages = getattr(agent, "_session_messages", None)
-        run.agent = agent
+        usage_state["last"] = _usage(agent)
         compressions_before = int(getattr(getattr(agent, "context_compressor", None), "compression_count", 0) or 0)
 
         # A cached agent may still carry the interrupt a previous cancel left behind; the Agent keeps a pending
@@ -742,8 +1191,12 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             run_params = set()
         if system_message and ("system_message" in run_params or not run_params):
             run_kwargs["system_message"] = system_message
-        if "persist_user_message" in run_params and isinstance(user_message, str):
-            run_kwargs["persist_user_message"] = user_message
+        # The server's clean user text (no workspace prefix) is what state.db stores; the Agent keeps the sent bytes beside it.
+        persist = params.get("persist_user_message")
+        if not (isinstance(persist, str) and persist.strip()):
+            persist = user_message if isinstance(user_message, str) else None
+        if "persist_user_message" in run_params and persist is not None:
+            run_kwargs["persist_user_message"] = persist
         error: str | None = None
         result: dict = {}
         try:
@@ -772,30 +1225,48 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             error = str(last_error)
         if not error and isinstance(result.get("error"), str) and result.get("error"):
             error = str(result["error"])
-        status = "cancelled" if cancelled else ("error" if error and not result.get("messages") else "completed")
+        # The Agent ends a failed turn with ``failed``/``partial`` (never ``status``), often after text streamed and with
+        # the turn's messages; a failed turn is an error whatever it carries.
+        failed = bool(result.get("failed"))
+        partial = bool(result.get("partial"))
+        if not error and failed and result.get("final_response"):
+            error = str(result["final_response"])
+        status = "cancelled" if cancelled else ("error" if failed or (error and not result.get("messages")) else "completed")
         pending_steer = str(result.get("pending_steer") or "") if isinstance(result, dict) else ""
+        messages = [m for m in (result.get("messages") or []) if isinstance(m, dict)]
+        compressed = compressions_after > compressions_before
+        context_messages, context_estimate = _post_compression_context(agent, messages, system_message) if compressed and messages and status == "completed" else (None, None)
         return {
             "status": status,
-            "messages": [m for m in (result.get("messages") or []) if isinstance(m, dict)],
+            "messages": messages,
+            "context_messages": context_messages,
+            "post_compression_context_tokens_estimate": context_estimate,
             "final_response": str(result.get("final_response") or ""),
             "error": error,
-            "result_status": str(result.get("status") or result.get("state") or ""),
-            "tool_limit_reached": bool(result.get("tool_limit_reached") or result.get("max_iterations_reached")),
+            "failed": failed,
+            "partial": partial,
+            "compression_exhausted": bool(result.get("compression_exhausted")),
+            # The pinned Agent marks an exhausted tool budget only in ``turn_exit_reason`` (``max_iterations_reached(n/n)``).
+            "tool_limit_reached": bool(result.get("tool_limit_reached") or result.get("max_iterations_reached") or str(result.get("turn_exit_reason") or "").startswith("max_iterations_reached")),
+            "max_iterations_summary_request": _max_iterations_summary_request(),
             "usage": _usage(agent),
             "context": _context_length(agent),
             "model": str(getattr(agent, "model", None) or resolved_model),
             "provider": str(resolved_provider or ""),
-            "compressed": compressions_after > compressions_before,
+            "compressed": compressed,
             "agent_session_id": str(getattr(agent, "session_id", None) or session_id),
             "token_sent": token_sent[0],
             "pending_steer": pending_steer,
             "live_tool_calls": live_tool_calls,
         }
     finally:
-        with _RUNS_LOCK:
-            _RUNS.pop(stream_id, None)
-            if _RUNS_BY_SESSION.get(session_id) == stream_id:
-                _RUNS_BY_SESSION.pop(session_id, None)
+        with _AGENT_CACHE_LOCK:
+            with _RUNS_LOCK:
+                _RUNS.pop(stream_id, None)
+                if _RUNS_BY_SESSION.get(session_id) == stream_id:
+                    _RUNS_BY_SESSION.pop(session_id, None)
+            # An agent evicted or replaced while this turn held it is released now that the turn is over.
+            _release_if_dropped_locked(run.agent, home)
 
 
 def _checkpoint_required() -> bool:
@@ -861,7 +1332,7 @@ def compress(ctx: CallContext, params: dict) -> dict:
     model = str(params.get("model") or "").strip()
     provider = str(params.get("model_provider") or "").strip() or None
     focus_topic = str(params.get("focus_topic") or "").strip()[:500] or None
-    toolsets = params.get("enabled_toolsets")
+    toolsets = _turn_toolsets(params.get("enabled_toolsets"))
     runtime = _resolve_runtime(provider, model)
     if not runtime.get("api_key"):
         raise RpcError("No provider configured -- cannot compress.", condition="credential_missing")
@@ -875,7 +1346,7 @@ def compress(ctx: CallContext, params: dict) -> dict:
         api_key=runtime.get("api_key"),
         platform="webui",
         quiet_mode=True,
-        enabled_toolsets=toolsets if isinstance(toolsets, list) else None,
+        enabled_toolsets=toolsets,
         session_id=session_id,
     )
     for name, value in (
@@ -1017,33 +1488,50 @@ def register(registry) -> None:
 
     @registry.method("chat.evict_agent", requires_agent=False)
     def evict_(ctx: CallContext, params: dict) -> dict:
+        """Drop a session's cached agent. Only delete/clear (``clear_session``) end its approval grants, parked
+        approvals and kernels; a model switch, truncate or compress leaves a running turn's agent in place."""
         session_id = str(params.get("session_id") or "").strip()
+        end_session = params.get("clear_session") is True
         with _AGENT_CACHE_LOCK:
-            evicted = _AGENT_CACHE.pop(session_id, None) is not None
-        try:
-            from tools.approval import clear_session
-            clear_session(session_id)
-        except Exception:  # noqa: BLE001
-            pass
-        return {"evicted": evicted}
+            with _RUNS_LOCK:
+                run = _RUNS.get(_RUNS_BY_SESSION.get(session_id) or "")
+            if not end_session and run is not None and not run.finished.is_set():
+                return {"evicted": False}
+            entry = _AGENT_CACHE.pop(session_id, None)
+            _release_agents_locked([entry] if entry else [])
+        if end_session:
+            try:
+                from tools.approval import clear_session
+                clear_session(session_id)
+            except Exception:  # noqa: BLE001
+                pass
+        return {"evicted": entry is not None}
 
     @registry.method("chat.commit_memory", requires_agent=False)
     def commit_memory_(ctx: CallContext, params: dict) -> dict:
-        """Predecessor ``commit_session_memory``: flush the cached Agent's memory for a session the user just left."""
+        """Predecessor ``commit_session_memory``: flush the cached Agent's memory for a session the user just left.
+        Providers get the session's transcript and run under its profile's ``scoped_home``."""
         session_id = str(params.get("session_id") or "").strip()
+        home = profile_home_param(params)
         with _AGENT_CACHE_LOCK:
             cached = _AGENT_CACHE.get(session_id)
-        with _RUNS_LOCK:
-            busy = (_RUNS_BY_SESSION.get(session_id) or "") in _RUNS
-        agent = cached[0] if cached else None
-        commit = getattr(agent, "commit_memory_session", None) if agent is not None else None
-        if commit is None or busy:
-            return {"committed": False}
+            with _RUNS_LOCK:
+                busy = _DRAINING.is_set() or (_RUNS_BY_SESSION.get(session_id) or "") in _RUNS
+            agent = cached[0] if cached else None
+            commit = getattr(agent, "commit_memory_session", None) if agent is not None else None
+            if commit is None or busy:
+                return {"committed": False}
+            _COMMITTING.append(agent)
         try:
-            commit()
+            with scoped_home(home):
+                commit(list(getattr(agent, "_session_messages", None) or []))
         except Exception as exc:  # noqa: BLE001
             log.warning("commit_memory_session() failed for session %s: %s", session_id, exc)
             return {"committed": False}
+        finally:
+            with _AGENT_CACHE_LOCK:
+                _COMMITTING.remove(agent)
+                _release_if_dropped_locked(agent, cached[2])
         return {"committed": True}
 
     @registry.method("approval.respond", requires_agent=True)
@@ -1101,7 +1589,9 @@ def register(registry) -> None:
         except Exception as exc:  # noqa: BLE001
             raise RpcError(f"approval module unavailable: {exc}", condition="agent_unavailable") from exc
         (enable_session_yolo if enabled else disable_session_yolo)(session_id)
-        released = resolve_gateway_approval(session_id, "session", resolve_all=True) if enabled else 0
+        # Parked approvals are released `once`: a `session` or `always` grant would keep their patterns approved after
+        # YOLO turns off, whatever choice the card that enabled it carried.
+        released = resolve_gateway_approval(session_id, "once", resolve_all=True) if enabled else 0
         return {"yolo_enabled": bool(is_session_yolo_enabled(session_id)), "released": int(released or 0)}
 
     @registry.method("clarify.respond", requires_agent=False)