@sumicom/quicksave 0.8.2 → 0.8.4

package/dist/ai/sessionManager.js

@@ -9,6 +9,8 @@ import { StreamCardBuilder, buildCardsFromHistory, loadPersistedCards } from './
 import { SANDBOX_BASH_TOOL, UPDATE_SESSION_STATUS_TOOL } from './sandboxMcp.js';
 import { getSessionRegistry } from './sessionRegistry.js';
 import { getEventStore } from '../storage/eventStore.js';
+import { buildSystemPrompt } from './systemPrompt.js';
+import { defaultPermissionLevelForAgent, isFullAccessPermission, isPermissionLevelAcceptedForAgent, normalizePermissionLevelForAgent, } from './provider.js';
 /**
  * Events emitted:
  *   'card-event'             (event: CardEvent)
@@ -20,7 +22,7 @@ import { getEventStore } from '../storage/eventStore.js';
  *   'session-config-updated' ({ sessionId, config: Record<string, ConfigValue> })
  */
 /** Tools auto-approved at each permission level (no user prompt). */
-const AUTO_APPROVE = {
+const CLAUDE_AUTO_APPROVE = {
     bypassPermissions: new Set([
         'Edit', 'Write', 'NotebookEdit', 'TodoWrite', 'Agent', 'EnterWorktree', 'ExitWorktree',
         'WebFetch', 'WebSearch', 'Bash',
@@ -34,15 +36,19 @@ const AUTO_APPROVE = {
     plan: new Set(['EnterPlanMode']),
     auto: new Set(['TodoWrite', 'EnterWorktree', 'ExitWorktree', 'Agent', 'EnterPlanMode']),
 };
-const DEFAULT_SYSTEM_PROMPT = [
-    'For non-destructive shell commands (ls, cat, find, git log, git status, git diff, etc.), prefer `mcp__quicksave-sandbox__SandboxBash` over Bash. SandboxBash runs in a sandboxed environment. Use Bash only for commands that modify state.',
-    // Ticket-model status updates. Sessions surface on the user\'s home screen as tickets; keep this metadata fresh.
-    'Treat each session as a ticket. The `mcp__quicksave-sandbox__UpdateSessionStatus` MCP tool is already loaded and available — call it directly, do NOT use ToolSearch. On your FIRST response in a new session, call it with at minimum `subject` and `stage` before doing other work. `subject` is what the user is trying to solve (e.g. "Fix auth token expiring early"), not what you are doing (not "Debugging jwt.ts"). On RESUME, if you do not see a prior `mcp__quicksave-sandbox__UpdateSessionStatus` tool_use in the conversation history, call it ONCE with no arguments as a dry-run to read the current stored status; if the returned subject is empty OR does not match what the user is now asking for, follow up with a real call to set/correct it.',
-    'Re-call `mcp__quicksave-sandbox__UpdateSessionStatus` whenever the stage changes (investigating → working → verifying → done), whenever work becomes blocked or unblocked (set `blocked` true/false without changing `stage`), or when a one-line `note` would give the user useful progress signal. `note` is an append-only event log — each call adds one entry — so for long-running tasks (research, large refactors) emit a fresh `note` every time you rule out an approach, cross a sub-goal, or hit a blocker. Do not skip `verifying` when you have tests/build/repro running. Do not declare `done` until the user\'s problem is fully resolved.',
-].join('\n\n');
-function buildSystemPrompt(extra) {
-    return extra ? `${DEFAULT_SYSTEM_PROMPT}\n\n${extra}` : DEFAULT_SYSTEM_PROMPT;
-}
+const CODEX_AUTO_APPROVE = {
+    'read-only': new Set(['EnterPlanMode']),
+    default: new Set(['TodoWrite', 'EnterWorktree', 'ExitWorktree', 'Agent', 'EnterPlanMode']),
+    'auto-review': new Set(['TodoWrite', 'EnterWorktree', 'ExitWorktree', 'Agent', 'EnterPlanMode']),
+    'full-access': new Set([
+        'Edit', 'Write', 'NotebookEdit', 'TodoWrite', 'Agent', 'EnterWorktree', 'ExitWorktree',
+        'WebFetch', 'WebSearch', 'Bash',
+        'Skill', 'ToolSearch', 'Config',
+        'CronCreate', 'CronDelete', 'CronList', 'RemoteTrigger',
+        'EnterPlanMode', 'ExitPlanMode',
+        'TaskOutput', 'TaskStop',
+    ]),
+};
 const SESSION_STAGES = [
     'investigating',
     'working',
@@ -52,6 +58,13 @@ const SESSION_STAGES = [
 function isSessionStage(value) {
     return SESSION_STAGES.includes(value);
 }
+function autoApproveToolsFor(agentId, level) {
+    const normalized = normalizePermissionLevelForAgent(agentId, level);
+    if (agentId === 'codex') {
+        return CODEX_AUTO_APPROVE[normalized];
+    }
+    return CLAUDE_AUTO_APPROVE[normalized];
+}
 /**
  * Map a user response string back to each question in an AskUserQuestion call.
  *
@@ -88,6 +101,18 @@ function normalizeAgentId(value) {
     }
     return undefined;
 }
+/** How often we record a `cache_touched` event to the event store. Anthropic's
+ *  cache TTL is 5min (default) or 1h (extended), so 30s persistence resolution
+ *  is more than enough; the live PWA countdown still ticks per second off the
+ *  in-memory `lastCacheTouchAt`. Lower values mean tighter post-restart accuracy
+ *  at the cost of more DB writes during long agentic loops. */
+const CACHE_TOUCH_PERSIST_INTERVAL_MS = 30_000;
+/** Max of optional numbers, dropping `undefined`. Returns `undefined` when both
+ *  inputs are undefined (or 0) so we don't render a stale "1970" anchor. */
+function maxDefined(a, b) {
+    const v = Math.max(a ?? 0, b ?? 0);
+    return v > 0 ? v : undefined;
+}
 /** Absolute path to the per-session bypass sentinel file. Hook command checks
  *  `[ -f <path> ]` — presence means auto-approve every tool. */
 export function bypassFlagPath(token) {
@@ -167,6 +192,22 @@ export class SessionManager extends EventEmitter {
         }
         return this.defaultAgentId;
     }
+    resolveKnownSessionAgentId(sessionId) {
+        const activeAgent = this.sessions.get(sessionId)?.agentId;
+        if (activeAgent)
+            return activeAgent;
+        const rememberedAgent = this.sessionAgents.get(sessionId);
+        if (rememberedAgent)
+            return rememberedAgent;
+        const rawConfig = this.sessionConfigs.get(sessionId);
+        const configAgent = normalizeAgentId(rawConfig?.agent ?? rawConfig?.provider);
+        if (configAgent && this.providers.has(configAgent))
+            return configAgent;
+        const registryAgent = normalizeAgentId(getSessionRegistry().findBySessionId(sessionId)?.agent);
+        if (registryAgent && this.providers.has(registryAgent))
+            return registryAgent;
+        return this.defaultAgentId;
+    }
     // ── Preferences ──
     async initPreferences() {
         // Model is tracked from the last session's init event via onModelDetected callback.
@@ -185,6 +226,10 @@ export class SessionManager extends EventEmitter {
             next.reasoningEffort = prefs.reasoningEffort;
             changed = true;
         }
+        if (prefs.contextWindow !== undefined && prefs.contextWindow !== this.preferences.contextWindow) {
+            next.contextWindow = prefs.contextWindow;
+            changed = true;
+        }
         if (changed) {
             this.preferences = next;
             this.emit('preferences-updated', this.preferences);
@@ -209,14 +254,26 @@ export class SessionManager extends EventEmitter {
         const next = { ...prev, [key]: value };
         this.sessionConfigs.set(sessionId, next);
         if (key === 'model' && typeof value === 'string') {
-            this.setPreferences({ model: value });
+            // model/effort are session-scoped — do NOT mirror into the
+            // SessionManager's global `preferences` bag. Doing so used to broadcast
+            // them on `/preferences`, which the PWA writes into the *claude-code*
+            // agent prefs bucket — causing a Codex GPT pick to corrupt the user's
+            // saved Claude default and leak across sessions on resume.
+            // Codex app-server sessions pick the change up on the next turn/start
+            // via the runtime override pipeline. Claude's model is fixed per
+            // session; the value here is consumed by the next cold resume.
+            this.enqueueCodexOverrideIfApplicable(sessionId, { model: value });
+            this.persistRegistryField(sessionId, 'model', value);
         }
         else if (key === 'reasoningEffort' && (typeof value === 'string' || value === null)) {
-            this.setPreferences({ reasoningEffort: value });
+            const effort = value === null ? null : value;
+            this.enqueueCodexOverrideIfApplicable(sessionId, { effort });
+            this.persistRegistryField(sessionId, 'reasoningEffort', value ?? undefined);
         }
         else if (key === 'permissionMode' && typeof value === 'string') {
             try {
                 await this.setPermissionLevel(sessionId, value);
+                next.permissionMode = this.getPermissionLevel(sessionId);
             }
             catch (err) {
                 // CLI rejected the mode (e.g. auto mode not supported for this model/plan).
@@ -225,7 +282,7 @@ export class SessionManager extends EventEmitter {
                 this.emit('session-config-updated', { sessionId, config: prev });
                 throw err;
             }
-            this.persistRegistryField(sessionId, 'permissionMode', value);
+            this.persistRegistryField(sessionId, 'permissionMode', next.permissionMode);
         }
         else if (key === 'sandboxed' && typeof value === 'boolean') {
             this.sessionSandboxed.set(sessionId, value);
@@ -253,17 +310,15 @@ export class SessionManager extends EventEmitter {
     }
     // ── Session Lifecycle ──
     async startSession(opts) {
-        const validModes = ['default', 'acceptEdits', 'bypassPermissions', 'plan', 'auto'];
-        const level = validModes.includes(opts.permissionMode)
-            ? opts.permissionMode : 'acceptEdits';
-        const sandboxed = !!opts.sandboxed;
-        const systemPrompt = buildSystemPrompt(opts.systemPrompt);
         const provider = this.getProvider(opts.agent);
+        const level = normalizePermissionLevelForAgent(provider.id, opts.permissionMode);
+        const sandboxed = !!opts.sandboxed;
+        const systemPrompt = buildSystemPrompt(provider.id, opts.systemPrompt);
         // Mint a per-session bypass token up front. The CLI bakes its path into
         // the PermissionRequest hook at spawn time; later toggles just touch/rm
         // the sentinel file without a respawn.
         const bypassToken = randomUUID();
-        applyBypassFlag(bypassToken, level === 'bypassPermissions');
+        applyBypassFlag(bypassToken, isFullAccessPermission(provider.id, level));
         // Create cardBuilder with 'pending' sessionId — will be updated after provider returns real one
         const cardBuilder = new StreamCardBuilder('pending', opts.streamId, opts.cwd);
         const callbacks = this.makeCallbacks(provider.id);
@@ -275,6 +330,8 @@ export class SessionManager extends EventEmitter {
             permissionLevel: level,
             sandboxed,
             systemPrompt,
+            reasoningEffort: opts.reasoningEffort,
+            contextWindow: opts.contextWindow,
             bypassFlagPath: bypassFlagPath(bypassToken),
         }, cardBuilder, callbacks);
         // Update cardBuilder with real sessionId — new session has no prior JSONL
@@ -289,14 +346,19 @@ export class SessionManager extends EventEmitter {
         if (sandboxed)
             this.sessionSandboxed.set(sessionId, true);
         const prevConfig = this.sessionConfigs.get(sessionId) ?? {};
+        // Resolve the model that was actually used for the spawn so the PWA can
+        // render the right model immediately (no waiting for onModelDetected).
+        // For codex we still record the user's requested model — the codex
+        // provider will overwrite via onModelDetected once it reports back.
+        const recordedModel = opts.model
+            ?? (typeof prevConfig.model === 'string' ? prevConfig.model : undefined)
+            ?? (provider.id !== 'codex' ? DEFAULT_MODEL : undefined);
         this.sessionConfigs.set(sessionId, {
             ...prevConfig,
             agent: provider.id,
-            ...((provider.id !== 'codex' && opts.model)
-                ? { model: opts.model }
-                : (provider.id !== 'codex' && !prevConfig.model)
-                    ? { model: DEFAULT_MODEL }
-                    : {}),
+            ...(recordedModel !== undefined ? { model: recordedModel } : {}),
+            ...(opts.reasoningEffort !== undefined ? { reasoningEffort: opts.reasoningEffort } : {}),
+            ...(opts.contextWindow !== undefined ? { contextWindow: opts.contextWindow } : {}),
             permissionMode: level,
             sandboxed,
         });
@@ -310,6 +372,7 @@ export class SessionManager extends EventEmitter {
             sandboxed,
             cardBuilder,
             spawnedModel: opts.model,
+            spawnedContextWindow: opts.contextWindow,
             bypassToken,
         };
         this.sessions.set(sessionId, managed);
@@ -319,17 +382,28 @@ export class SessionManager extends EventEmitter {
     async resumeSession(opts) {
         const existing = this.sessions.get(opts.sessionId);
         const agentId = this.resolveAgentId(opts.sessionId, opts.cwd, opts.agent);
-        // Force cold resume if the user changed model since the session was spawned.
-        // The active provider process was started with `--model X`, so changing model
-        // requires killing it and respawning with the new flag.
-        const desiredModel = this.sessionConfigs.get(opts.sessionId)?.model
+        // Force cold resume if the user changed model OR context window since the
+        // session was spawned. The active provider process was started with
+        // `--model X` and the auto-compact env var; changing either requires
+        // killing it and respawning with the new value.
+        const sessionCfg = this.sessionConfigs.get(opts.sessionId);
+        const desiredModel = sessionCfg?.model
             ?? this.preferences.model;
+        const desiredContextWindow = sessionCfg?.contextWindow
+            ?? this.preferences.contextWindow;
         const modelChanged = existing?.providerSession?.alive
             && existing.spawnedModel !== undefined
             && desiredModel !== undefined
             && existing.spawnedModel !== desiredModel;
-        if (modelChanged) {
-            console.log(`[session-manager] model changed (${existing.spawnedModel} → ${desiredModel}) — killing provider for cold resume session=${opts.sessionId.slice(0, 8)}`);
+        const contextWindowChanged = existing?.providerSession?.alive
+            && existing.spawnedContextWindow !== undefined
+            && desiredContextWindow !== undefined
+            && existing.spawnedContextWindow !== desiredContextWindow;
+        if (modelChanged || contextWindowChanged) {
+            const reason = modelChanged
+                ? `model changed (${existing.spawnedModel} → ${desiredModel})`
+                : `context window changed (${existing.spawnedContextWindow} → ${desiredContextWindow})`;
+            console.log(`[session-manager] ${reason} — killing provider for cold resume session=${opts.sessionId.slice(0, 8)}`);
             existing.providerSession.kill();
             existing.streaming = false;
             existing.providerSession = null;
@@ -338,9 +412,6 @@ export class SessionManager extends EventEmitter {
         // consumeStream picks it up after the current turn's result event.
         if (existing?.streaming && existing.providerSession?.alive) {
             console.log(`[session-manager] hot resume (active) session=${opts.sessionId.slice(0, 8)}`);
-            if (existing.cardBuilder) {
-                existing.cardBuilder.userMessage(opts.prompt);
-            }
             const ps = existing.providerSession;
             if (ps.pendingStreamIds) {
                 ps.pendingStreamIds.push(opts.streamId);
@@ -352,16 +423,22 @@ export class SessionManager extends EventEmitter {
         // instead of cold-resuming. Saves a kill+spawn per follow-up prompt and
         // avoids the brief isActive=false window that caused the "ghost inactive"
         // badge flicker between turns.
-        if (existing?.providerSession?.alive && !modelChanged) {
+        if (existing?.providerSession?.alive && !modelChanged && !contextWindowChanged) {
             console.log(`[session-manager] hot resume (idle) session=${opts.sessionId.slice(0, 8)}`);
             const ps = existing.providerSession;
             if (existing.cardBuilder) {
                 existing.cardBuilder.cancelDeferredClear?.();
-                existing.cardBuilder.userMessage(opts.prompt);
-                existing.cardBuilder.startNewTurn(opts.streamId);
             }
             ps.currentStreamId = opts.streamId;
             ps.resultEmitted = false;
+            // Codex app-server session: queue the streamId so its sendUserMessage
+            // emits cards under the streamId the PWA is watching. Without this,
+            // the session mints a synthetic streamId and applySessionCards drops
+            // every event. Other providers ignore the field (CLI uses
+            // currentStreamId above, which it reads directly).
+            if (Array.isArray(ps.pendingStreamIds)) {
+                ps.pendingStreamIds.push(opts.streamId);
+            }
             existing.streaming = true;
             existing.providerSession.sendUserMessage(opts.prompt);
             this.emitSessionUpdate(opts.sessionId);
@@ -382,22 +459,30 @@ export class SessionManager extends EventEmitter {
             // Restore session settings from in-memory maps, falling back to persisted
             // registry (survives daemon restarts).
             const registryEntry = getSessionRegistry().getEntry(opts.cwd, opts.sessionId);
-            const validModes = ['default', 'acceptEdits', 'bypassPermissions', 'plan', 'auto'];
-            const restoredLevel = this.sessionPermissions.get(opts.sessionId)
-                ?? (validModes.includes(registryEntry?.permissionMode) ? registryEntry.permissionMode : undefined);
-            const level = restoredLevel ?? 'acceptEdits';
             const sandboxed = this.sessionSandboxed.get(opts.sessionId) ?? registryEntry?.sandboxed ?? false;
             const provider = this.getProvider(agentId);
+            const level = normalizePermissionLevelForAgent(provider.id, this.sessionPermissions.get(opts.sessionId) ?? registryEntry?.permissionMode);
             const cardBuilder = existing?.cardBuilder ?? new StreamCardBuilder(opts.sessionId, opts.streamId, opts.cwd);
             await cardBuilder.snapshotCutoff();
             const callbacks = this.makeCallbacks(provider.id);
             const sessionConfig = this.sessionConfigs.get(opts.sessionId);
-            const resumeModel = sessionConfig?.model ?? this.preferences.model;
+            // Resolution order: in-memory session config > persisted registry entry
+            // > daemon's global preference fallback. Registry persistence is what
+            // makes per-session settings survive a daemon restart.
+            const resumeModel = sessionConfig?.model
+                ?? registryEntry?.model
+                ?? this.preferences.model;
+            const resumeReasoningEffort = sessionConfig?.reasoningEffort
+                ?? registryEntry?.reasoningEffort
+                ?? this.preferences.reasoningEffort;
+            const resumeContextWindow = sessionConfig?.contextWindow
+                ?? registryEntry?.contextWindow
+                ?? this.preferences.contextWindow;
             // Reuse the existing session's bypass token if present; otherwise mint a
             // fresh one (happens when cold-resuming a session we don't have in memory,
             // e.g. after a daemon restart).
             const bypassToken = existing?.bypassToken ?? randomUUID();
-            applyBypassFlag(bypassToken, level === 'bypassPermissions');
+            applyBypassFlag(bypassToken, isFullAccessPermission(provider.id, level));
             const { sessionId, session: providerSession } = await provider.resumeSession({
                 sessionId: opts.sessionId,
                 prompt: opts.prompt,
@@ -406,9 +491,32 @@ export class SessionManager extends EventEmitter {
                 model: resumeModel,
                 permissionLevel: level,
                 sandboxed,
-                systemPrompt: buildSystemPrompt(),
+                systemPrompt: buildSystemPrompt(provider.id),
+                reasoningEffort: resumeReasoningEffort,
+                contextWindow: resumeContextWindow,
                 bypassFlagPath: bypassFlagPath(bypassToken),
             }, cardBuilder, callbacks);
+            // Seed sessionConfigs so /sessions/config snapshot reflects the
+            // settings the session was actually resumed with — important when the
+            // session was loaded purely from the registry (no prior in-memory
+            // config) and the PWA has nothing to show otherwise.
+            const resumedConfig = {
+                ...(this.sessionConfigs.get(sessionId) ?? {}),
+                agent: provider.id,
+                permissionMode: level,
+                sandboxed,
+                ...(resumeModel !== undefined ? { model: resumeModel } : {}),
+                ...(resumeReasoningEffort !== undefined ? { reasoningEffort: resumeReasoningEffort } : {}),
+                ...(resumeContextWindow !== undefined ? { contextWindow: resumeContextWindow } : {}),
+            };
+            this.sessionConfigs.set(sessionId, resumedConfig);
+            // If the CLI forked to a new session id, also key the config under the
+            // requested id so older subscribers that haven't seen the rekey still
+            // resolve to the right config.
+            if (sessionId !== opts.sessionId) {
+                this.sessionConfigs.set(opts.sessionId, resumedConfig);
+            }
+            this.emit('session-config-updated', { sessionId, config: resumedConfig });
             // Update or create session entry
             this.sessionAgents.set(sessionId, provider.id);
             if (existing) {
@@ -417,6 +525,7 @@ export class SessionManager extends EventEmitter {
                 existing.providerSession = providerSession;
                 existing.streaming = true;
                 existing.spawnedModel = resumeModel;
+                existing.spawnedContextWindow = resumeContextWindow;
                 // Cold resume can fork a new CLI session_id. Rekey the map + side
                 // maps to the new ID so emitSessionUpdate finds the entry and the
                 // PWA sees isActive=true (the ghost-inactive bug otherwise).
@@ -440,6 +549,7 @@ export class SessionManager extends EventEmitter {
                     sandboxed,
                     cardBuilder,
                     spawnedModel: resumeModel,
+                    spawnedContextWindow: resumeContextWindow,
                     bypassToken,
                 };
                 this.sessions.set(sessionId, managed);
@@ -511,22 +621,27 @@ export class SessionManager extends EventEmitter {
         }
     }
     // ── Permission ──
-    async setPermissionLevel(sessionId, level) {
+    async setPermissionLevel(sessionId, requestedLevel) {
         const ps = this.sessions.get(sessionId);
-        const prevLevel = ps?.permissionLevel ?? this.sessionPermissions.get(sessionId) ?? 'acceptEdits';
+        const agentId = this.resolveKnownSessionAgentId(sessionId);
+        if (!isPermissionLevelAcceptedForAgent(agentId, requestedLevel)) {
+            throw new Error(`Permission mode "${requestedLevel}" is not valid for ${agentId}`);
+        }
+        const level = normalizePermissionLevelForAgent(agentId, requestedLevel);
+        const prevLevel = normalizePermissionLevelForAgent(agentId, ps?.permissionLevel ?? this.sessionPermissions.get(sessionId));
         if (ps)
             ps.permissionLevel = level;
         this.sessionPermissions.set(sessionId, level);
         // bypass is driven by the daemon-owned sentinel file the CLI's hook
         // checks. Toggle it first so the next tool call sees the right state.
         if (ps?.bypassToken) {
-            applyBypassFlag(ps.bypassToken, level === 'bypassPermissions');
+            applyBypassFlag(ps.bypassToken, isFullAccessPermission(agentId, level));
         }
         const session = ps?.providerSession;
         if (session?.alive && typeof session.sendControlRequest === 'function') {
             // bypassPermissions is handled entirely on the daemon side (hook + AUTO_APPROVE).
             // Send `default` to the CLI so it never enters its own bypass mode.
-            const cliMode = level === 'bypassPermissions' ? 'default' : level;
+            const cliMode = isFullAccessPermission(agentId, level) ? 'default' : level;
             try {
                 await session.sendControlRequest('set_permission_mode', { mode: cliMode });
             }
@@ -536,12 +651,31 @@ export class SessionManager extends EventEmitter {
                     ps.permissionLevel = prevLevel;
                 this.sessionPermissions.set(sessionId, prevLevel);
                 if (ps?.bypassToken) {
-                    applyBypassFlag(ps.bypassToken, prevLevel === 'bypassPermissions');
+                    applyBypassFlag(ps.bypassToken, isFullAccessPermission(agentId, prevLevel));
                 }
                 this.emitSessionUpdate(sessionId);
                 throw err;
             }
         }
+        else if (session?.alive && typeof session.enqueueRuntimeOverride === 'function') {
+            // Codex app-server: queue approvalPolicy/sandboxPolicy/approvalsReviewer
+            // changes that take effect on the next turn/start. We import the
+            // mapping lazily to avoid pulling the full app-server module into
+            // the SDK-only build path.
+            try {
+                const { permissionLevelToOverrides } = await import('./codexAppServer/permissionMapping.js');
+                const sandboxed = ps?.sandboxed ?? this.sessionSandboxed.get(sessionId) ?? true;
+                const cwd = ps?.cwd;
+                session.enqueueRuntimeOverride(permissionLevelToOverrides(level, { sandboxed, cwd }));
+            }
+            catch (err) {
+                if (ps)
+                    ps.permissionLevel = prevLevel;
+                this.sessionPermissions.set(sessionId, prevLevel);
+                this.emitSessionUpdate(sessionId);
+                throw err;
+            }
+        }
         if (ps) {
             this.emitSessionUpdate(sessionId);
         }
@@ -556,7 +690,30 @@ export class SessionManager extends EventEmitter {
         return true;
     }
     getPermissionLevel(sessionId) {
-        return this.sessions.get(sessionId)?.permissionLevel ?? 'acceptEdits';
+        const agentId = this.resolveKnownSessionAgentId(sessionId);
+        return this.sessions.get(sessionId)?.permissionLevel
+            ?? this.sessionPermissions.get(sessionId)
+            ?? defaultPermissionLevelForAgent(agentId);
+    }
+    /**
+     * Forward a runtime override to a Codex `app-server` session if the
+     * active session has one. Detected by duck-typing the
+     * `enqueueRuntimeOverride` method (defined on
+     * `CodexAppServerProviderSession`). Other provider sessions silently
+     * ignore — Claude's mid-session model swap is impossible, and the
+     * SDK Codex provider doesn't have a runtime path.
+     */
+    enqueueCodexOverrideIfApplicable(sessionId, patch) {
+        const ps = this.sessions.get(sessionId);
+        const session = ps?.providerSession;
+        if (!session || typeof session.enqueueRuntimeOverride !== 'function')
+            return;
+        try {
+            session.enqueueRuntimeOverride(patch);
+        }
+        catch {
+            // best-effort; the next turn/start surfaces any real failure
+        }
     }
     resolveUserInput(response) {
         const pending = this.pendingInputRequests.get(response.requestId);
@@ -655,6 +812,10 @@ export class SessionManager extends EventEmitter {
                     ?? this.sessionPermissions.get(entry.sessionId),
                 lastPromptAt: stats.lastPromptAt ?? undefined,
                 lastTurnEndedAt: stats.lastTurnEndedAt ?? undefined,
+                // Prefer the in-memory anchor when available (it ticks per-message;
+                // the event-store value is throttled to once per 30s) and fall back
+                // to the persisted value for sessions that are registry-only.
+                lastCacheTouchAt: maxDefined(this.sessions.get(entry.sessionId)?.lastCacheTouchAt, stats.lastCacheTouchAt ?? undefined),
                 turnCount: stats.turnCount,
                 totalInputTokens: stats.totalInputTokens,
                 totalOutputTokens: stats.totalOutputTokens,
@@ -799,6 +960,24 @@ export class SessionManager extends EventEmitter {
                     this.updateSessionStatus(sessionId, toolInput);
                 }
             },
+            onCacheTouch: (sessionId) => {
+                const ps = this.sessions.get(sessionId);
+                if (!ps)
+                    return;
+                const now = Date.now();
+                ps.lastCacheTouchAt = now;
+                const lastPersisted = ps.lastPersistedCacheTouchAt ?? 0;
+                if (now - lastPersisted >= CACHE_TOUCH_PERSIST_INTERVAL_MS) {
+                    getEventStore().record({
+                        type: 'cache_touched',
+                        sessionId,
+                        cwd: ps.cwd,
+                        time: now,
+                    });
+                    ps.lastPersistedCacheTouchAt = now;
+                }
+                this.emitSessionUpdate(sessionId);
+            },
             onModelDetected: (model) => {
                 console.log(`[session-manager] model detected: ${model} (agent=${agentId})`);
                 if (agentId === 'claude-code') {
@@ -906,9 +1085,11 @@ export class SessionManager extends EventEmitter {
             toolName = 'Bash'; // fall through to permission check as Bash
         }
         // Check permission level auto-approve set
+        const agentId = this.resolveKnownSessionAgentId(sessionId);
         const level = this.sessions.get(sessionId)?.permissionLevel
-            ?? this.sessionPermissions.get(sessionId) ?? 'acceptEdits';
-        if (!AUTO_APPROVE[level].has(toolName))
+            ?? this.sessionPermissions.get(sessionId)
+            ?? defaultPermissionLevelForAgent(agentId);
+        if (!autoApproveToolsFor(agentId, level).has(toolName))
             return false;
         // For file-writing tools, restrict to project cwd
         const FILE_WRITE_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit']);
@@ -1045,12 +1226,15 @@ export class SessionManager extends EventEmitter {
             // The "idle" semantic (awaiting user input) is the isActive && !isStreaming
             // substate; consumers derive it rather than receiving it as its own flag.
             isActive: !!ps,
-            // `archived` = session has been removed from the in-memory map
-            // (cold-resume rekey, onSessionExited, or closeSession). PWA uses this
-            // as a signal to navigate away from the now-defunct session page.
-            // Note: isActive=false alone is ambiguous (can also mean "emitted for
-            // an unknown id during reconcile"); archived=true is the strong signal.
-            archived: !ps,
+            // `archived` = session has been retired in the registry (the user ran
+            // End Task, project:delete, or the entry was never created). It is
+            // distinct from `!isActive`: a session that just had its CLI process
+            // killed (claude:close / cold-resume rekey / onSessionExited) is
+            // !isActive but still has an active registry entry, so the PWA must
+            // keep the entry visible and let a follow-up prompt cold-resume it.
+            // PWA uses `archived=true` as the strong "navigate away from the
+            // defunct session page" signal.
+            archived: !ps && !getSessionRegistry().findBySessionId(sessionId),
             agent: ps?.agentId ?? this.sessionAgents.get(sessionId),
             isStreaming: ps?.streaming ?? false,
             hasPendingInput,
@@ -1058,6 +1242,7 @@ export class SessionManager extends EventEmitter {
             sandboxed: ps?.sandboxed ?? this.sessionSandboxed.get(sessionId) ?? false,
             lastPromptAt: stats.lastPromptAt ?? undefined,
             lastTurnEndedAt: stats.lastTurnEndedAt ?? undefined,
+            lastCacheTouchAt: maxDefined(ps?.lastCacheTouchAt, stats.lastCacheTouchAt ?? undefined),
             turnCount: stats.turnCount,
             totalInputTokens: stats.totalInputTokens,
             totalOutputTokens: stats.totalOutputTokens,