mixdog 0.9.1 → 0.9.3

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -1,77 +1,90 @@
 import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
 import { randomBytes, createHash } from 'crypto';
-import { join } from 'path';
 import { getProvider, providerInputExcludesCache } from '../providers/registry.mjs';
-import { getModelMetadataSync } from '../providers/model-catalog.mjs';
 import { fetchOAuthUsageSnapshot } from '../providers/oauth-usage.mjs';
 // Image content is kept in-memory and in the model-visible history so multi-turn
-// recognition matches reference agent behavior (live transcript always retains images). The
+// recognition works reliably (live transcript always retains images). The
 // stored-history placeholder swap now happens only at disk-serialization time
 // inside the session store, so it is no longer imported here.
 import {
     recallFastTrackCompactMessages,
     semanticCompactMessages,
+    pruneToolOutputsUnanchored,
+    effectiveBudget as compactEffectiveBudget,
     compactTypeIsRecallFastTrack,
     compactTypeIsSemantic,
     normalizeCompactType,
     DEFAULT_COMPACT_TYPE,
     SUMMARY_PREFIX,
-    DEFAULT_COMPACTION_BUFFER_RATIO,
-    compactionBufferTokensForBoundary,
-    normalizeCompactionBufferRatio,
     drainSessionCycle1,
 } from './compact.mjs';
 import { estimateMessagesTokens, estimateRequestReserveTokens, estimateTranscriptContextUsage } from './context-utils.mjs';
-import { getMcpTools } from '../mcp/client.mjs';
-import { getInternalTools, executeInternalTool } from '../internal-tools.mjs';
-import { BUILTIN_TOOLS } from '../tools/builtin/builtin-tools.mjs';
-import { PATCH_TOOL_DEFS } from '../tools/patch-tool-defs.mjs';
-import { CODE_GRAPH_TOOL_DEFS } from '../tools/code-graph-tool-defs.mjs';
-import { collectSkillsCached, buildSkillManifest, buildSkillToolDefs, composeSystemPrompt } from '../context/collect.mjs';
+import { executeInternalTool } from '../internal-tools.mjs';
+import { collectSkillsCached, buildSkillManifest, composeSystemPrompt } from '../context/collect.mjs';
 import { saveSession, saveSessionAsync, loadSession, listStoredSessionSummaries, sweepStaleSessions, markSessionClosed, publishHeartbeat, deleteHeartbeat, setLiveSession } from './store.mjs';
 import { clearReadDedupSession, tryPrefetchCached, setPrefetchCached } from './read-dedup.mjs';
 import { clearOffloadSession } from './tool-result-offload.mjs';
 import { classifyResultKind } from './result-classification.mjs';
 import { createAbortController } from '../../../shared/abort-controller.mjs';
-import { isInternalRuntimeNotificationText as contractIsInternalRuntimeNotificationText } from '../../../shared/tool-execution-contract.mjs';
 import { logLlmCall } from '../../../shared/llm/usage-log.mjs';
-import { resolvePluginData, mixdogRoot } from '../../../shared/plugin-paths.mjs';
-import { updateJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { appendAgentTrace } from '../agent-trace.mjs';
 import { isAgentOwner } from '../agent-owner.mjs';
-import { maxMtimeRecursive } from '../cache-mtime.mjs';
-import { getHiddenRole, getRoleInstructionDir, listHiddenRoleNames } from '../internal-roles.mjs';
+import { getHiddenAgent } from '../internal-agents.mjs';
 import { DEFAULT_ACTIVITY_HEARTBEAT_MS } from '../stall-policy.mjs';
 import {
     buildGatewayLimits,
     recordGatewayUsageEvent,
     summarizeGatewayUsage,
 } from '../providers/statusline-route-meta.mjs';
-// Phase B: Pool B Tier 2 content builder (common rules only).
-// Loaded once per process via createRequire so the CJS module reaches us.
-const _require = createRequire(import.meta.url);
-const _rulesBuilder = (() => {
-    const candidates = [
-        join(mixdogRoot(), 'lib', 'rules-builder.cjs'),
-    ].filter(Boolean);
-    for (const p of candidates) {
-        try { return _require(p); } catch { /* fall through */ }
-    }
-    // Fallback: walk up from this file's location to find lib/rules-builder.cjs.
-    try { return _require('../../../../lib/rules-builder.cjs'); } catch { return null; }
-})();
-
-// BP1/BP2/BP3 prompt-layer caches — invalidated by source file mtime, not a
-// timer. Cheap: O(sentinel-count) stat calls on each session creation, no file
-// I/O when warm.
-let _sharedRulesCache = null;
-let _sharedRulesMtime = 0;
-const _agentRulesCacheByProfile = new Map();
-let _leadRulesCache = null;
-let _leadRulesMtime = 0;
-let _leadMetaCache = null;
-let _leadMetaMtime = 0;
+// Split modules — see manager/ directory. manager.mjs is now a thin facade that
+// orchestrates these cohesive units while keeping the exact public surface.
+import {
+    _buildSharedRules,
+    _buildAgentRules,
+    _buildLeadRules,
+    _buildLeadMetaContext,
+    _buildAgentSpecific,
+} from './manager/rules-cache.mjs';
+import {
+    applyToolPermissionNarrowing,
+    finalizeSessionToolList,
+    resolveSessionTools,
+    previewSessionTools,
+    permissionFromToolSpec,
+} from './manager/tool-resolution.mjs';
+import {
+    guessContextWindow,
+    positiveContextWindow,
+    preserveBufferConfigFields,
+    resolveSessionContextMeta,
+    compactTriggerForSession,
+    compactTargetBudget,
+    semanticCompactionEnabledForSession,
+    compactTypeForSession,
+} from './manager/context-meta.mjs';
+import {
+    promptContentText,
+    hasModelVisiblePromptContent,
+    promptContentBytes,
+    prefixUserTurnContent,
+    prefixSessionStartContent,
+    buildCurrentTimeBlock,
+    buildSessionStartBlock,
+    hasUserConversationMessage,
+    isInternalRuntimeNotificationText,
+} from './manager/prompt-utils.mjs';
+import {
+    _mergePendingMessageEntries,
+    enqueuePendingMessage,
+    drainPendingMessages,
+    _dropPendingMessageState,
+} from './manager/pending-messages.mjs';
+// Re-export split-module public/test surface unchanged so every importer of the
+// old symbol names keeps resolving through the facade.
+export { previewSessionTools };
+export { _mergePendingMessageEntries, enqueuePendingMessage, drainPendingMessages };
+export { isInternalRuntimeNotificationText as _isInternalRuntimeNotificationText };
 let _codeGraphRuntimePromise = null;
 let _agentLoopPromise = null;
 let _bashSessionRuntimePromise = null;
@@ -94,127 +107,9 @@ function _closeBashSessionLazy(sessionId, reason) {
         .then((mod) => { if (typeof mod.closeBashSession === 'function') mod.closeBashSession(sessionId, reason); })
         .catch(() => {});
 }
-function _buildSharedRules() {
-    if (!_rulesBuilder || typeof _rulesBuilder.buildSharedToolContent !== 'function') return '';
-    const PLUGIN_ROOT = mixdogRoot();
-    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
-    const mtime = maxMtimeRecursive([
-        join(RULES_DIR, 'shared'),
-    ]);
-    if (_sharedRulesCache !== null && mtime <= _sharedRulesMtime) {
-        return _sharedRulesCache;
-    }
-    try {
-        const built = _rulesBuilder.buildSharedToolContent({ PLUGIN_ROOT, DATA_DIR: resolvePluginData() });
-        _sharedRulesCache = built;
-        _sharedRulesMtime = mtime;
-        return built;
-    } catch (e) {
-        throw new Error(`[session] shared tool rules build failed: ${e.message}`);
-    }
-}
-
-function _buildAgentRules(profile = 'full') {
-    if (!_rulesBuilder || typeof _rulesBuilder.buildAgentRoleContent !== 'function') return '';
-    const key = String(profile || 'full');
-    const PLUGIN_ROOT = mixdogRoot();
-    const DATA_DIR = resolvePluginData();
-    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
-    const mtime = maxMtimeRecursive([
-        join(RULES_DIR, 'agent'),
-        join(DATA_DIR, 'mixdog-config.json'),
-    ]);
-    const cached = _agentRulesCacheByProfile.get(key);
-    if (cached && mtime <= cached.mtime) {
-        return cached.value;
-    }
-    try {
-        const built = _rulesBuilder.buildAgentRoleContent({ PLUGIN_ROOT, DATA_DIR, profile: key });
-        _agentRulesCacheByProfile.set(key, { mtime, value: built });
-        return built;
-    } catch (e) {
-        throw new Error(`[session] agent role rules build failed: ${e.message}`);
-    }
-}
-
-function _buildLeadRules() {
-    if (!_rulesBuilder || typeof _rulesBuilder.buildLeadRoleContent !== 'function') return '';
-    const PLUGIN_ROOT = mixdogRoot();
-    const DATA_DIR = resolvePluginData();
-    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
-    const mtime = maxMtimeRecursive([
-        join(RULES_DIR, 'lead'),
-        join(DATA_DIR, 'mixdog-config.json'),
-    ]);
-    if (_leadRulesCache !== null && mtime <= _leadRulesMtime) {
-        return _leadRulesCache;
-    }
-    try {
-        const built = _rulesBuilder.buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR });
-        _leadRulesCache = built;
-        _leadRulesMtime = mtime;
-        return built;
-    } catch (e) {
-        throw new Error(`[session] lead role rules build failed: ${e.message}`);
-    }
-}
-
-function _buildLeadMetaContext() {
-    if (!_rulesBuilder || typeof _rulesBuilder.buildLeadMetaContent !== 'function') return '';
-    const PLUGIN_ROOT = mixdogRoot();
-    const DATA_DIR = resolvePluginData();
-    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
-    const mtime = maxMtimeRecursive([
-        join(RULES_DIR, 'lead'),
-        join(DATA_DIR, 'history'),
-        join(DATA_DIR, 'mixdog-config.json'),
-        join(DATA_DIR, 'user-workflow.md'),
-        join(PLUGIN_ROOT, 'output-styles'),
-        join(DATA_DIR, 'output-styles'),
-    ]);
-    if (_leadMetaCache !== null && mtime <= _leadMetaMtime) {
-        return _leadMetaCache;
-    }
-    try {
-        const built = _rulesBuilder.buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR });
-        _leadMetaCache = built;
-        _leadMetaMtime = mtime;
-        return built;
-    } catch (e) {
-        throw new Error(`[session] lead meta context build failed: ${e.message}`);
-    }
-}
-
-// BP4-adjacent role-specific data cache — keyed by role. webhook / schedule
-// roles each have their own scoped instruction set; other roles return ''.
-const _roleSpecificCache = new Map(); // role → { value, mtime }
-function _buildRoleSpecific(currentRole) {
-    if (!_rulesBuilder || typeof _rulesBuilder.buildAgentRoleSpecificContent !== 'function') return '';
-    if (!currentRole) return '';
-    const PLUGIN_ROOT = mixdogRoot();
-    const DATA_DIR = resolvePluginData();
-    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
-    const roleInstructionDir = getRoleInstructionDir(currentRole);
-    const mtime = maxMtimeRecursive([
-        join(RULES_DIR, 'shared'),
-        join(DATA_DIR, 'mixdog-config.json'),
-        join(DATA_DIR, 'webhooks'),
-        join(DATA_DIR, 'schedules'),
-        ...(roleInstructionDir ? [join(DATA_DIR, roleInstructionDir)] : []),
-        join(PLUGIN_ROOT, 'defaults', 'hidden-roles.json'),
-    ]);
-    const entry = _roleSpecificCache.get(currentRole);
-    if (entry && mtime <= entry.mtime) {
-        return entry.value;
-    }
-    try {
-        const built = _rulesBuilder.buildAgentRoleSpecificContent({ PLUGIN_ROOT, DATA_DIR, currentRole });
-        _roleSpecificCache.set(currentRole, { mtime, value: built });
-        return built;
-    } catch (e) {
-        throw new Error(`[session] role-specific rules build failed (role: ${currentRole}): ${e.message}`);
-    }
-}
+// Re-export the rules builders so any deep importer of the old symbol names
+// keeps working through the facade.
+export { _buildSharedRules, _buildAgentRules, _buildLeadRules, _buildLeadMetaContext, _buildAgentSpecific };
 
 // Agent Runtime is optional — injected via setAgentRuntime() during plugin init
 // so session creation never depends on a circular import. If never injected,
@@ -259,34 +154,10 @@ const HEARTBEAT_THROTTLE_MS = 60_000; // 60s
 // notification never fires. A slow write finishes in the background.
 const TERMINAL_SAVE_TIMEOUT_MS = nonNegativeIntEnv('MIXDOG_TERMINAL_SAVE_TIMEOUT_MS', 5_000);
 
-// Merge externally-connected MCP tools with the plugin's in-process tools
-// (registered by agent's toolExecutor adapter). Internal tools are exposed
-// under their bare names — no mcp__ prefix, since the dispatcher in
-// server.mjs handles them directly without a transport.
-// Sorted deterministically by name — protects BP_1 hash stability from
-// listTools() ordering churn. Anthropic / OpenAI / Gemini all hash the
-// tools array verbatim, so any reorder rewrites the prefix.
-// No cache: getMcpTools() and getInternalTools() are O(n) in-memory reads;
-// the sort overhead on ~30 tools is negligible.
-function _getMcpTools() {
-    const mcp = getMcpTools() || [];
-    const internalRaw = getInternalTools() || [];
-    const internal = internalRaw.map(t => ({
-        name: t.name,
-        description: typeof t.description === 'string' ? t.description : '',
-        inputSchema: t.inputSchema || { type: 'object', properties: {} },
-        // Keep annotations so the permission filter / role invariants can
-        // tell read-only from write-capable internal tools, and so
-        // agentHidden can be read during deny filtering.
-        annotations: t.annotations || {},
-    }));
-    return [...mcp, ...internal].sort((a, b) => {
-        const an = a?.name || '';
-        const bn = b?.name || '';
-        return an < bn ? -1 : an > bn ? 1 : 0;
-    });
-}
-
+// Session tool resolution + permission narrowing moved to
+// manager/tool-resolution.mjs (imported above). The following section-level
+// docs describe the toolSpec contract those helpers implement.
+//
 // Phase D-2 — profile.tools resolution.
 //
 // `toolSpec` may be:
@@ -309,549 +180,7 @@ function _getMcpTools() {
 // surface intentionally tiny; runtime permission guards in loop.mjs remain
 // the fail-safe either way.
 
-const SESSION_ROUTE_TOOL_ORDER = [
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-    'apply_patch',
-    'shell',
-    'task',
-];
-const SESSION_ROUTE_TOOL_RANK = new Map(SESSION_ROUTE_TOOL_ORDER.map((name, index) => [name, index]));
-const FILESYSTEM_TOOL_NAMES = new Set([
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-    'apply_patch',
-]);
-const READONLY_TOOL_NAMES = new Set([
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-]);
-
-const AGENT_STRING_PERMISSION_READ_ALLOW = Object.freeze([
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-    'explore',
-    'search',
-    'web_fetch',
-]);
-
-function stringToolPermissionAllowList(toolPermission) {
-    if (toolPermission === 'read') return AGENT_STRING_PERMISSION_READ_ALLOW;
-    if (toolPermission === 'read-write') return AGENT_STRING_PERMISSION_READ_WRITE_ALLOW;
-    if (toolPermission === 'none') return [];
-    return null;
-}
-
-const AGENT_STRING_PERMISSION_READ_WRITE_ALLOW = Object.freeze([
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-    'apply_patch',
-    'explore',
-    'search',
-    'web_fetch',
-]);
-
-function applyToolPermissionNarrowing(tools, toolPermission, warnRole = null) {
-    if (toolPermission === 'none') return [];
-    const allowList = stringToolPermissionAllowList(toolPermission);
-    if (allowList) {
-        const allowSet = new Set(allowList.map((n) => String(n).toLowerCase()));
-        return tools.filter((t) => allowSet.has(String(t?.name || '').toLowerCase()));
-    }
-    if (toolPermission && typeof toolPermission === 'object') {
-        const allowSet = Array.isArray(toolPermission.allow) && toolPermission.allow.length > 0
-            ? new Set(toolPermission.allow.map(n => String(n).toLowerCase()))
-            : null;
-        const denySet = Array.isArray(toolPermission.deny) && toolPermission.deny.length > 0
-            ? new Set(toolPermission.deny.map(n => String(n).toLowerCase()))
-            : null;
-        if (allowSet || denySet) {
-            const filtered = tools.filter(t => {
-                const name = String(t?.name || '').toLowerCase();
-                if (denySet && denySet.has(name)) return false;
-                if (allowSet && !allowSet.has(name)) return false;
-                return true;
-            });
-            if (filtered.length === 0) {
-                process.stderr.write(`[session] WARN: role permission intersection produced 0 tools — failing closed (role=${warnRole || 'unknown'})\n`);
-            }
-            return filtered;
-        }
-    }
-    return tools;
-}
-
-function recursiveWrapperToolNameForPublicAgentRole(role) {
-    if (!role) return null;
-    const key = String(role).trim();
-    for (const hiddenName of listHiddenRoleNames()) {
-        const def = getHiddenRole(hiddenName);
-        const invokedBy = typeof def?.invokedBy === 'string' ? def.invokedBy.trim() : '';
-        if (invokedBy && invokedBy === key) return invokedBy;
-    }
-    return null;
-}
-
-function finalizeSessionToolList(tools, {
-    schemaAllowedTools = null,
-    disallowedTools = null,
-    ownerIsAgent = false,
-    resolvedRole = null,
-} = {}) {
-    let out = Array.isArray(tools) ? tools : [];
-    const hasCallerAllow = Array.isArray(schemaAllowedTools);
-    if (hasCallerAllow) {
-        const allowSet = new Set(schemaAllowedTools.map(n => String(n).toLowerCase()));
-        out = out.filter(t => allowSet.has(String(t?.name || '').toLowerCase()));
-    }
-    const callerDeny = Array.isArray(disallowedTools) ? disallowedTools.map(n => String(n)) : [];
-    if (callerDeny.length) {
-        const denySet = new Set(callerDeny.map(n => n.toLowerCase()));
-        out = out.filter(t => !denySet.has(String(t?.name || '').toLowerCase()));
-    }
-    const recursiveDeny = ownerIsAgent ? recursiveWrapperToolNameForPublicAgentRole(resolvedRole) : null;
-    if (recursiveDeny) {
-        const deny = recursiveDeny.toLowerCase();
-        out = out.filter(t => String(t?.name || '').toLowerCase() !== deny);
-    }
-    if (ownerIsAgent) {
-        out = out.filter(t => !t?.annotations?.agentHidden);
-        out = orderSessionTools(out);
-    }
-    return out;
-}
-
-function orderSessionTools(tools) {
-    return tools.map((tool, index) => ({ tool, index }))
-        .sort((a, b) => {
-            const ar = SESSION_ROUTE_TOOL_RANK.get(a.tool?.name) ?? 10_000;
-            const br = SESSION_ROUTE_TOOL_RANK.get(b.tool?.name) ?? 10_000;
-            if (ar !== br) return ar - br;
-            return a.index - b.index;
-        })
-        .map((entry) => entry.tool);
-}
-
-const ALL_BUILTIN_SESSION_TOOLS = orderSessionTools(_dedupByName([
-    ...BUILTIN_TOOLS,
-    ...PATCH_TOOL_DEFS,
-    ...CODE_GRAPH_TOOL_DEFS,
-]));
-
-function resolveSessionTools(toolSpec, skills, { ownerIsAgentSession = false } = {}) {
-    const mcp = _getMcpTools();
-    // Agent sessions freeze the skill meta-tool into the schema
-    // unconditionally — concrete skill resolution is cwd-scoped at tool-call
-    // time (loop.mjs), so the schema bytes stay bit-identical across roles /
-    // cwds and the provider cache shard does not fragment.
-    const skillTools = buildSkillToolDefs(skills, { ownerIsAgentSession });
-    return _computeBaseTools(toolSpec, mcp, skillTools);
-}
-
-export function previewSessionTools(toolSpec, skills = [], options = {}) {
-    return resolveSessionTools(toolSpec, skills, options);
-}
-
-// Dedup by name, first occurrence wins. BUILTIN_TOOLS is passed in ahead
-// of the MCP-registered internal tools so plugin-side definitions take
-// precedence when both surfaces declare the same name (e.g. read / grep / glob).
-// Without this merge, Anthropic rejected the request with
-// "tools: Tool names must be unique" and the orchestrator burned up to
-// 20 iterations retrying before the final answer landed.
-function _dedupByName(tools) {
-    const seen = new Map();
-    for (const t of tools) {
-        const n = t?.name;
-        if (!n || seen.has(n)) continue;
-        seen.set(n, t);
-    }
-    return [...seen.values()];
-}
-
-// Agent visibility is declared per-tool via annotations.agentHidden.
-// Tools with agentHidden:true are stripped from agent sessions at schema
-// build time (see deny filtering below). No code-level name list needed.
-
-function _computeBaseTools(toolSpec, mcp, skillTools) {
-    if (Array.isArray(toolSpec)) {
-        if (toolSpec.length === 0) {
-            // Explicit "no tools" — skill meta tools still travel so the model
-            // can at least discover and invoke skills if that is the one
-            // dynamic surface the profile retains.
-            return _dedupByName([...skillTools]);
-        }
-        if (toolSpec.includes('full')) {
-            return _dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]);
-        }
-        const byName = new Map();
-        const add = (tool) => { if (tool?.name && !byName.has(tool.name)) byName.set(tool.name, tool); };
-        const addMany = (arr) => { for (const t of arr) add(t); };
-        for (const tagRaw of toolSpec) {
-            const tag = String(tagRaw || '').trim();
-            switch (tag) {
-                case 'tools:filesystem':
-                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => FILESYSTEM_TOOL_NAMES.has(t.name)));
-                    break;
-                case 'tools:readonly':
-                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => READONLY_TOOL_NAMES.has(t.name)));
-                    break;
-                case 'tools:shell':
-                case 'tools:git':
-                case 'tools:analysis':
-                    // Shell-class toolset. `tools:git` / `tools:analysis` exist so
-                    // profile authors can name the intent (git workflows / data
-                    // analysis) without inventing new toolset ids.
-                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'shell' || t.name === 'task'));
-                    break;
-                case 'tools:mcp':
-                    addMany(mcp);
-                    break;
-                case 'tools:search':
-                    // Name-pattern match: picks up `search` and any future tool
-                    // whose name contains `search`. `recall` and `explore` deliberately do NOT match
-                    // — they need `tools:mcp` (full mcp surface) or their own
-                    // toolset id if a role wants targeted retrieval. Public agent
-                    // roles never reach the wrapper bodies regardless: see the
-                    // isBlockedPublicWrapperCall guard in session/loop.mjs.
-                    addMany(mcp.filter(t => /search/i.test(t?.name || '')));
-                    break;
-                default:
-                    process.stderr.write(`[session] unknown toolset id "${tag}" (profile.tools); skipping\n`);
-            }
-        }
-        return _dedupByName([...byName.values(), ...skillTools]);
-    }
-
-    switch (toolSpec) {
-        case 'mcp':
-            return _dedupByName([...mcp, ...skillTools]);
-        case 'readonly': {
-            const readTools = ALL_BUILTIN_SESSION_TOOLS.filter(t => READONLY_TOOL_NAMES.has(t.name));
-            return _dedupByName([...readTools, ...mcp, ...skillTools]);
-        }
-        case 'full':
-        default:
-            return _dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]);
-    }
-}
-
-function permissionFromToolSpec(toolSpec) {
-    if (toolSpec === 'readonly') return 'read';
-    if (toolSpec === 'mcp') return 'mcp';
-    if (Array.isArray(toolSpec)) {
-        const tags = new Set(toolSpec.map(t => String(t || '').trim()));
-        const hasWriteOrShell = tags.has('full')
-            || tags.has('tools:filesystem')
-            || tags.has('tools:shell')
-            || tags.has('tools:git')
-            || tags.has('tools:analysis');
-        if (tags.has('tools:readonly') && !hasWriteOrShell) return 'read';
-    }
-    return null;
-}
-
 let nextId = Date.now();
-// Known context windows for the current-generation models this plugin
-// routes to. Anything not listed falls through to guessContextWindow() —
-// local llama/mistral/phi default to 8192, everything else 128000. Keep
-// this map trimmed to live models; older generations slow down reads
-// without buying anything.
-const CONTEXT_WINDOWS = {
-    // OpenAI GPT-5.x family (openai / openai-oauth)
-    'gpt-5.5': 272000,
-    'gpt-5.4': 272000,
-    'gpt-5.4-mini': 272000,
-    'gpt-5.4-nano': 272000,
-    // Anthropic Claude 4.x
-    'claude-opus-4-8': 1000000,
-    'claude-opus-4-7': 1000000,
-    'claude-sonnet-4-6': 1000000,
-    'claude-haiku-4-5-20251001': 200000,
-    // Google Gemini 3.x
-    'gemini-3.1-pro': 1000000,
-    'gemini-3-pro': 1000000,
-    'gemini-3.5-flash': 1000000,
-    'gemini-3-flash': 1000000,
-    // xAI Grok (catalog polyfill mirror — model-catalog PRICING_OVERRIDES)
-    'grok-build-0.1': 256000,
-    'grok-4.20': 1000000,
-};
-// Family-pattern fallback used only when both the provider catalog and the
-// exact-id table miss (cold metadata, before the LiteLLM/models.dev catalog
-// warms). Keep these aligned with the catalog so /context, gateway, and the
-// runtime agree on the boundary the first time a model is routed. Local models
-// (llama/mistral/phi/qwen/gemma) stay small so an unknown local id never claims
-// a giant window.
-function guessContextWindow(model) {
-    if (CONTEXT_WINDOWS[model])
-        return CONTEXT_WINDOWS[model];
-    const m = String(model || '').toLowerCase();
-    // Local/self-hosted families — never inflate an unknown local id.
-    if (m.includes('llama') || m.includes('mistral') || m.includes('mixtral')
-        || m.includes('phi') || m.includes('qwen') || m.includes('gemma')
-        || m.includes('deepseek-r1') || m.includes('codellama'))
-        return 8192;
-    // Current hosted families by name pattern.
-    if (m.startsWith('claude-opus') || m.startsWith('claude-sonnet')) return 1000000;
-    if (m.startsWith('claude-haiku') || m.startsWith('claude-')) return 200000;
-    if (m.startsWith('gemini-3') || m.startsWith('gemini-2')) return 1000000;
-    if (m.startsWith('gpt-5')) return 272000;
-    if (m.startsWith('grok-build')) return 256000;
-    if (m.startsWith('grok-')) return 1000000;
-    if (m.startsWith('deepseek-v')) return 1000000;
-    return 128000;
-}
-function positiveContextWindow(value) {
-    const n = Number(value);
-    return Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
-}
-function envFlag(name, fallback = false) {
-    const v = process.env[name];
-    if (v === undefined) return fallback;
-    return !['0', 'false', 'off', 'no'].includes(String(v).trim().toLowerCase());
-}
-function boundedPercent(value, fallback = null) {
-    const n = Number(value);
-    if (Number.isFinite(n) && n > 0 && n <= 100) return n;
-    return fallback;
-}
-function providerNameOf(provider) {
-    if (typeof provider === 'string') return provider.toLowerCase();
-    return String(provider?.name || provider?.id || '').toLowerCase();
-}
-// Buffer-percent parsing trap: normalizeCompactionBufferRatio treats any value
-// > 1 as a percent (n/100) and any value <= 1 as a literal ratio. That is wrong
-// for percent-NAMED inputs: bufferPercent / bufferPct / *_BUFFER_PERCENT = 1
-// means 1% (0.01), but the shared normalizer would read it as the literal ratio
-// 1.0 (100%). Resolve percent-named and ratio-named inputs with the correct
-// semantics here, before handing a finished ratio to the shared helper:
-//   percent inputs: n  -> n/100   (1 -> 0.01, 10 -> 0.10)
-//   ratio inputs:   n  -> n>1 ? n/100 : n   (0.01 -> 0.01, 10 -> 0.10 legacy)
-function resolveBufferRatioCandidate(percentInputs, ratioInputs) {
-    for (const raw of percentInputs) {
-        const n = Number(raw);
-        if (Number.isFinite(n) && n > 0) return Math.min(1, n / 100);
-    }
-    for (const raw of ratioInputs) {
-        const n = Number(raw);
-        if (Number.isFinite(n) && n > 0) return n > 1 ? n / 100 : n;
-    }
-    return null;
-}
-function compactBufferRatioForConfig(cfg = {}) {
-    const resolved = resolveBufferRatioCandidate(
-        [cfg.bufferPercent, cfg.bufferPct, process.env.MIXDOG_AGENT_COMPACT_BUFFER_PERCENT],
-        [cfg.bufferRatio, cfg.bufferFraction, process.env.MIXDOG_AGENT_COMPACT_BUFFER_RATIO],
-    );
-    return normalizeCompactionBufferRatio(resolved, DEFAULT_COMPACTION_BUFFER_RATIO);
-}
-function compactBufferRatioForSession(session) {
-    return compactBufferRatioForConfig(session?.compaction || {});
-}
-// Carry the percent/ratio-named buffer config from a compaction config object
-// onto session.compaction so downstream parsers (compactBufferRatioForSession,
-// loop.resolveCompactBufferRatio, contextStatus) honor a configured buffer
-// percent/ratio. Only finite positive values are copied; absent fields stay
-// undefined so the default-ratio fallback still applies.
-function preserveBufferConfigFields(cfg = {}) {
-    const out = {};
-    for (const key of ['bufferPercent', 'bufferPct', 'bufferRatio', 'bufferFraction']) {
-        const n = Number(cfg?.[key]);
-        if (Number.isFinite(n) && n > 0) out[key] = n;
-    }
-    return out;
-}
-const LEGACY_DEFAULT_COMPACTION_BUFFER_RATIO = 0.1;
-function isPersistedZeroBufferTelemetry(cfg = {}, boundaryTokens = 0) {
-    const boundary = positiveContextWindow(boundaryTokens);
-    if (!boundary) return false;
-    if (positiveContextWindow(process.env.MIXDOG_AGENT_COMPACT_BUFFER_TOKENS)) return false;
-    if (Number.isFinite(Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_PERCENT)) && Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_PERCENT) > 0) return false;
-    if (Number.isFinite(Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_RATIO)) && Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_RATIO) > 0) return false;
-    for (const key of ['bufferPercent', 'bufferPct', 'bufferFraction']) {
-        const n = Number(cfg?.[key]);
-        if (Number.isFinite(n) && n > 0) return false;
-    }
-    const ratio = Number(cfg?.bufferRatio);
-    if (Number.isFinite(ratio) && ratio > 0) return false;
-    const explicitTokens = Number(cfg?.bufferTokens ?? cfg?.buffer);
-    if (!Number.isFinite(explicitTokens) || explicitTokens !== 0) return false;
-    return true;
-}
-function isLegacyDefaultBufferTelemetry(cfg = {}, boundaryTokens = 0) {
-    const boundary = positiveContextWindow(boundaryTokens);
-    if (!boundary) return false;
-    if (positiveContextWindow(process.env.MIXDOG_AGENT_COMPACT_BUFFER_TOKENS)) return false;
-    if (Number.isFinite(Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_PERCENT)) && Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_PERCENT) > 0) return false;
-    if (Number.isFinite(Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_RATIO)) && Number(process.env.MIXDOG_AGENT_COMPACT_BUFFER_RATIO) > 0) return false;
-    // Percent/fraction-named fields are treated as operator config. The legacy
-    // default telemetry always persisted bufferTokens + bufferRatio after a
-    // check/compact pass, so only that shape is migrated away.
-    for (const key of ['bufferPercent', 'bufferPct', 'bufferFraction']) {
-        const n = Number(cfg?.[key]);
-        if (Number.isFinite(n) && n > 0) return false;
-    }
-    const explicitTokens = positiveContextWindow(cfg?.bufferTokens ?? cfg?.buffer);
-    const ratio = Number(cfg?.bufferRatio);
-    if (!explicitTokens || !Number.isFinite(ratio) || Math.abs(ratio - LEGACY_DEFAULT_COMPACTION_BUFFER_RATIO) > 1e-9) return false;
-    const expectedTokens = Math.floor(boundary * LEGACY_DEFAULT_COMPACTION_BUFFER_RATIO);
-    const cfgBoundary = positiveContextWindow(cfg?.boundaryTokens);
-    const cfgTrigger = positiveContextWindow(cfg?.triggerTokens);
-    return explicitTokens === expectedTokens
-        || (cfgBoundary === boundary && cfgTrigger > 0 && explicitTokens === Math.max(0, boundary - cfgTrigger));
-}
-function compactBufferConfigForBoundary(cfg = {}, boundaryTokens = 0) {
-    const base = cfg || {};
-    if (!isLegacyDefaultBufferTelemetry(base, boundaryTokens)
-        && !isPersistedZeroBufferTelemetry(base, boundaryTokens)) {
-        return base;
-    }
-    return {
-        ...base,
-        bufferTokens: null,
-        buffer: null,
-        bufferRatio: null,
-    };
-}
-function compactBufferTokensForSession(session, boundaryTokens) {
-    const cfg = compactBufferConfigForBoundary(session?.compaction || {}, boundaryTokens);
-    const explicit = positiveContextWindow(cfg.bufferTokens ?? cfg.buffer)
-        || positiveContextWindow(process.env.MIXDOG_AGENT_COMPACT_BUFFER_TOKENS)
-        || 0;
-    return compactionBufferTokensForBoundary(boundaryTokens, {
-        explicitTokens: explicit,
-        ratio: compactBufferRatioForConfig(cfg),
-        maxRatio: 0.25,
-    });
-}
-const COMPACT_TARGET_RATIO = 0.02;
-const COMPACT_TARGET_MIN_TOKENS = 4_000;
-const COMPACT_TARGET_MAX_TOKENS = 16_000;
-function compactTargetRatio() {
-    const raw = process.env.MIXDOG_AGENT_COMPACT_TARGET_PERCENT
-        ?? process.env.MIXDOG_COMPACT_TARGET_PERCENT
-        ?? COMPACT_TARGET_RATIO;
-    const n = Number(raw);
-    if (!Number.isFinite(n) || n <= 0) return COMPACT_TARGET_RATIO;
-    return n > 1 ? n / 100 : n;
-}
-function compactTargetTokensForBoundary(boundaryTokens) {
-    const boundary = positiveContextWindow(boundaryTokens);
-    if (!boundary) return null;
-    const explicit = positiveContextWindow(
-        process.env.MIXDOG_AGENT_COMPACT_TARGET_TOKENS
-            ?? process.env.MIXDOG_COMPACT_TARGET_TOKENS,
-    );
-    if (explicit) return Math.max(1, Math.min(boundary, explicit));
-    const minTarget = Math.min(boundary, positiveContextWindow(process.env.MIXDOG_COMPACT_TARGET_MIN_TOKENS) || COMPACT_TARGET_MIN_TOKENS);
-    const maxTarget = Math.min(boundary, positiveContextWindow(process.env.MIXDOG_COMPACT_TARGET_MAX_TOKENS) || COMPACT_TARGET_MAX_TOKENS);
-    const byRatio = Math.max(1, Math.floor(boundary * compactTargetRatio()));
-    return Math.max(1, Math.min(boundary, maxTarget, Math.max(minTarget, byRatio)));
-}
-function defaultEffectiveContextWindowPercent(provider) {
-    // Gateway/statusline route metadata reserves a universal 10% headroom from
-    // the raw catalog window. Keep session compaction on the same effective
-    // capacity so /context, the TUI statusline, and gateway telemetry agree.
-    return 90;
-}
-function resolveSessionContextMeta(provider, model, seed = {}) {
-    const info = typeof provider?.getCachedModelInfo === 'function'
-        ? provider.getCachedModelInfo(model)
-        : null;
-    const catalogInfo = getModelMetadataSync(model, providerNameOf(provider));
-    const rawContextWindow = positiveContextWindow(info?.contextWindow)
-        || positiveContextWindow(info?.maxContextWindow)
-        || positiveContextWindow(info?.context_window)
-        || positiveContextWindow(info?.max_context_window)
-        || positiveContextWindow(catalogInfo?.contextWindow)
-        || positiveContextWindow(catalogInfo?.maxContextWindow)
-        || positiveContextWindow(catalogInfo?.context_window)
-        || positiveContextWindow(catalogInfo?.max_context_window)
-        || positiveContextWindow(seed.rawContextWindow)
-        || positiveContextWindow(seed.raw_context_window)
-        || positiveContextWindow(seed.contextWindow)
-        || guessContextWindow(model);
-    const effectiveContextWindowPercent = boundedPercent(
-        seed.effectiveContextWindowPercent
-            ?? seed.effective_context_window_percent
-            ?? info?.effectiveContextWindowPercent
-            ?? info?.effective_context_window_percent
-            ?? catalogInfo?.effectiveContextWindowPercent
-            ?? catalogInfo?.effective_context_window_percent,
-        defaultEffectiveContextWindowPercent(provider),
-    );
-    const pct = boundedPercent(effectiveContextWindowPercent, 100);
-    const contextWindow = Math.max(1, Math.floor(rawContextWindow * pct / 100));
-    const compactBoundaryTokens = contextWindow;
-    const rawCompactLimit = positiveContextWindow(
-        seed.autoCompactTokenLimit
-            ?? seed.auto_compact_token_limit
-            ?? info?.autoCompactTokenLimit
-            ?? info?.auto_compact_token_limit
-            ?? catalogInfo?.autoCompactTokenLimit
-            ?? catalogInfo?.auto_compact_token_limit,
-    );
-    // Legacy-data migration: old implementations derived autoCompactTokenLimit
-    // from the full effective/raw window and persisted it onto the session.
-    // A resumed session therefore re-seeds autoCompactTokenLimit == boundary
-    // (or the raw window), which compactTriggerForSession / loop policy used to
-    // honor as an explicit trigger, collapsing the compaction buffer to 0. Only
-    // accept an explicit limit that is STRICTLY BELOW the boundary; a value at
-    // or above the boundary is a derived full-window artifact and is dropped to
-    // null so the trigger falls back to the default boundary trigger.
-    const explicitCompactLimit = rawCompactLimit && rawCompactLimit < compactBoundaryTokens
-        ? rawCompactLimit
-        : null;
-    // Do NOT derive the auto-compact limit from the full effective window.
-    // Setting it to contextWindow makes autoTriggerTokens == boundary and the
-    // compaction buffer collapse to 0 (loop.mjs:708-713 / compactTriggerForSession),
-    // so auto-compact only fires when the context is already at the limit —
-    // at which point semantic compact fails ("result exceeds budget" /
-    // "summary cannot fit") and the turn can no longer be resumed.
-    // Leave it null unless the provider/catalog/seed supplies an explicit
-    // limit; the downstream buffer logic (default 10%, capped 25%) then
-    // triggers compaction with headroom, matching the reference auto-compact threshold.
-    const autoCompactTokenLimit = explicitCompactLimit || null;
-    return {
-        contextWindow,
-        rawContextWindow,
-        effectiveContextWindowPercent,
-        autoCompactTokenLimit: autoCompactTokenLimit || null,
-        compactBoundaryTokens,
-    };
-}
-function compactTriggerForSession(session, boundaryTokens) {
-    const boundary = positiveContextWindow(boundaryTokens);
-    if (!boundary) return null;
-    const autoLimit = positiveContextWindow(session?.autoCompactTokenLimit ?? session?.compaction?.autoCompactTokenLimit);
-    // Only honor an explicit auto-compact limit that sits STRICTLY BELOW the
-    // boundary. A persisted value == boundary (or >=) is a legacy derived
-    // full-window artifact; honoring it collapses the compaction buffer to 0,
-    // so fall through to the default boundary trigger instead.
-    if (autoLimit && autoLimit < boundary) return Math.max(1, autoLimit);
-    const buffer = compactBufferTokensForSession(session, boundary);
-    return Math.max(1, boundary - buffer);
-}
 // Test-only exports for the legacy auto-compact-limit migration + buffer-config
 // preservation (see scripts/compact-trigger-migration-smoke.mjs).
 export const _resolveSessionContextMeta = resolveSessionContextMeta;
@@ -874,40 +203,18 @@ function normalizeStaleCompactingStage(session) {
     c.lastCheckedAt = Date.now();
     return true;
 }
-function compactTargetBudget(boundaryTokens, reserveTokens, _sourceTokens = null, _ratio = null) {
-    const boundary = positiveContextWindow(boundaryTokens);
-    if (!boundary) return null;
-    const reserve = Math.max(0, Number(reserveTokens) || 0);
-    const targetEffective = compactTargetTokensForBoundary(boundary) || boundary;
-    return Math.max(1, Math.min(boundary, targetEffective + reserve));
-}
-function semanticCompactionEnabledForSession(session) {
-    const cfg = session?.compaction || {};
-    if (process.env.MIXDOG_AGENT_COMPACT_SEMANTIC !== undefined) return envFlag('MIXDOG_AGENT_COMPACT_SEMANTIC', true);
-    if (process.env.MIXDOG_COMPACT_SEMANTIC !== undefined) return envFlag('MIXDOG_COMPACT_SEMANTIC', true);
-    if (cfg.semantic === false || cfg.semantic === 'false' || cfg.semantic === 'off') return false;
-    if (cfg.semantic === true || cfg.semantic === 'true' || cfg.semantic === 'on' || cfg.semantic === 'auto') return true;
-    return true;
-}
-function compactTypeForSession(session) {
-    const cfg = session?.compaction || {};
-    const configured = process.env.MIXDOG_AGENT_COMPACT_TYPE
-        ?? process.env.MIXDOG_COMPACT_TYPE
-        ?? cfg.type
-        ?? cfg.compactType
-        ?? cfg.compact_type;
-    return normalizeCompactType(configured, DEFAULT_COMPACT_TYPE);
-}
 function addCompactUsageToSession(session, usage) {
     if (!session || !usage) return;
     const inputTokens = usage.inputTokens || 0;
     const outputTokens = usage.outputTokens || 0;
     const cachedTokens = usage.cachedTokens || 0;
     const cacheWriteTokens = usage.cacheWriteTokens || 0;
+    const uncachedInputTokens = uncachedInputTokensForProvider(session.provider, inputTokens, cachedTokens, cacheWriteTokens);
     session.totalInputTokens = (session.totalInputTokens || 0) + inputTokens;
     session.totalOutputTokens = (session.totalOutputTokens || 0) + outputTokens;
     session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + cachedTokens;
     session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + cacheWriteTokens;
+    session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + uncachedInputTokens;
     session.tokensCumulative = (session.tokensCumulative || 0) + inputTokens + outputTokens;
 }
 async function runRecallFastTrackForSession(session, messages, opts = {}) {
@@ -977,6 +284,18 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
     }
     return { query, querySha, recallText: [`session_id=${sessionId}`, cycle1Text, recallText].map(v => String(v || '').trim()).filter(Boolean).join('\n\n') };
 }
+// Element-identity change detection (same approach as loop.mjs messagesArrayChanged): two
+// arrays are "unchanged" only when same length AND every slot is the same object
+// reference. Used to reject a no-op prune (which returns a fresh array whose
+// elements are the untouched originals) from being accepted as a recovery.
+function messagesChanged(before, after) {
+    if (!Array.isArray(before) || !Array.isArray(after)) return before !== after;
+    if (before.length !== after.length) return true;
+    for (let i = 0; i < before.length; i += 1) {
+        if (before[i] !== after[i]) return true;
+    }
+    return false;
+}
 async function runSessionCompaction(session, opts = {}) {
     if (!session || session.closed === true) return null;
     const mode = opts.mode === 'auto' ? 'auto' : 'manual';
@@ -991,7 +310,16 @@ async function runSessionCompaction(session, opts = {}) {
         if (force) throw new Error('compact: no context window is available for this session');
         return null;
     }
-    const reserveTokens = estimateRequestReserveTokens(session.tools || []);
+    // Reserve must mirror loop.mjs (buildCompactPolicy): request reserve (tool
+    // schema) PLUS the configured reserve (session.compaction.reservedTokens or
+    // MIXDOG_AGENT_COMPACT_RESERVED_TOKENS env). The old request-only value left
+    // the manual / auto-clear compact budget without the configured headroom the
+    // loop path reserves, so a compacted transcript could overflow on next send.
+    const requestReserveTokens = estimateRequestReserveTokens(session.tools || []);
+    const configuredReserveTokens = positiveContextWindow(session.compaction?.reservedTokens)
+        || positiveContextWindow(process.env.MIXDOG_AGENT_COMPACT_RESERVED_TOKENS)
+        || 0;
+    const reserveTokens = requestReserveTokens + configuredReserveTokens;
     const beforeMessageTokens = estimateMessagesTokens(messages);
     const triggerTokens = compactTriggerForSession(session, boundary)
         || positiveContextWindow(session.compaction?.triggerTokens)
@@ -1041,7 +369,11 @@ async function runSessionCompaction(session, opts = {}) {
                 recallText: recallPayload.recallText,
                 query: recallPayload.query,
                 querySha: recallPayload.querySha,
-                allowEmptyRecall: true,
+                // Ingest just ran on the live transcript, so an empty recall dump
+                // means the memory pipeline is broken — do NOT erase history
+                // behind an empty summary shell. Empty recall now throws and is
+                // handled by the semantic fallback below (or recorded failure).
+                allowEmptyRecall: false,
                 tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
                 keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
                 preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
@@ -1055,6 +387,48 @@ async function runSessionCompaction(session, opts = {}) {
             try {
                 process.stderr.write(`[session] recall-fasttrack ${mode} compact failed (sess=${session.id || 'unknown'}): ${err?.message || err}\n`);
             } catch { /* best-effort */ }
+            // Degraded-compact fallback: recall-fasttrack failed (empty recall,
+            // ingest error, fit failure). Before recording a hard failure, try
+            // the semantic path once so auto-clear/manual compaction still makes
+            // progress WITHOUT shipping an empty-recall summary. History is only
+            // replaced when the semantic summary actually succeeds.
+            if (semanticCompactionEnabledForSession(session)
+                && provider && typeof provider.send === 'function') {
+                try {
+                    semanticCompactResult = await semanticCompactMessages(
+                        provider,
+                        messages,
+                        opts.model || session.model,
+                        budget,
+                        {
+                            reserveTokens,
+                            providerName: session.provider || provider?.name || null,
+                            sessionId: opts.sessionId || session.id || null,
+                            signal: opts.signal || null,
+                            promptCacheKey: session.promptCacheKey || null,
+                            providerCacheKey: session.promptCacheKey || null,
+                            timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
+                            tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
+                            keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
+                            preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
+                            force: true,
+                        },
+                    );
+                    if (Array.isArray(semanticCompactResult?.messages)) {
+                        compacted = semanticCompactResult.messages;
+                        compactError = null;
+                        addCompactUsageToSession(session, semanticCompactResult.usage);
+                        try {
+                            process.stderr.write(`[session] degraded compact: recall-fasttrack failed, semantic fallback succeeded (sess=${session.id || 'unknown'}, mode=${mode})\n`);
+                        } catch { /* best-effort */ }
+                    }
+                } catch (fallbackErr) {
+                    semanticCompactError = fallbackErr;
+                    try {
+                        process.stderr.write(`[session] degraded compact: semantic fallback also failed (sess=${session.id || 'unknown'}): ${fallbackErr?.message || fallbackErr}\n`);
+                    } catch { /* best-effort */ }
+                }
+            }
         }
     } else if (compactTypeIsSemantic(compactType)) {
         try {
@@ -1098,6 +472,32 @@ async function runSessionCompaction(session, opts = {}) {
     if (!compacted && !compactError) {
         compactError = new Error(`${compactType} compact produced no messages`);
     }
+    // Anchor-independent prune safety net (mirror loop.mjs compact catch): when a
+    // non-recall (semantic) compact failed, try one non-LLM prune that needs no
+    // user anchor before recording failure, so Lead manual / auto-clear paths
+    // recover the same transcripts the loop path does. Gated off the recall
+    // path — a recall failure keeps its original contract (no silent prune).
+    if (!compacted && !recallFastTrackError) {
+        try {
+            const acceptThreshold = compactEffectiveBudget(budget, { reserveTokens });
+            const salvaged = pruneToolOutputsUnanchored(messages, budget, { reserveTokens });
+            // pruneToolOutputsUnanchored ALWAYS returns a fresh reconciled array
+            // (never the input identity), so `salvaged !== messages` is always
+            // true and cannot detect a no-op. Compare by element identity so a
+            // transcript that already fit (nothing pruned) is NOT falsely accepted
+            // as a recovery — that would clear compactError and unconditionally
+            // invalidate providerState for an unchanged transcript.
+            if (Array.isArray(salvaged)
+                && messagesChanged(messages, salvaged)
+                && estimateMessagesTokens(salvaged) <= acceptThreshold) {
+                compacted = salvaged;
+                compactError = null;
+                try {
+                    process.stderr.write(`[session] compact fallback prune recovered (sess=${session.id || 'unknown'}, mode=${mode})\n`);
+                } catch { /* best-effort */ }
+            }
+        } catch { /* fall through to failure record */ }
+    }
     if (!compacted) {
         const now = Date.now();
         session.compaction = {
@@ -1506,7 +906,7 @@ async function _tryBridgeExplicitPrefetch(session, explicitPrefetch) {
 // Preset shape: { name, provider, model, effort?, fast?, tools? }
 //
 // Agent Runtime integration:
-//   opts.taskType / opts.role / opts.profileId — enables profile-aware routing.
+//   opts.taskType / opts.agent / opts.profileId — enables profile-aware routing.
 //     Rule-based SmartRouter resolves these synchronously; the resolved
 //     profile controls context filtering (skip.skills/memory/etc) and cache
 //     strategy. If no rule matches, falls back to classic preset behavior.
@@ -1519,13 +919,13 @@ export function createSession(opts) {
     // --- Agent Runtime profile resolution (best-effort, sync) ---
     let profile = opts.profile || null;
     let providerCacheOpts = opts.providerCacheOpts || null;
-    if (!profile && (opts.taskType || opts.role || opts.profileId)) {
+    if (!profile && (opts.taskType || opts.agent || opts.profileId)) {
         const agentRuntime = getAgentRuntimeSync();
         if (agentRuntime) {
             try {
                 const resolved = agentRuntime.resolveSync({
                     taskType: opts.taskType,
-                    role: opts.role,
+                    agent: opts.agent,
                     profileId: opts.profileId,
                     preset: presetObj?.name || (typeof opts.preset === 'string' ? opts.preset : null),
                     provider: opts.provider || presetObj?.provider,
@@ -1567,25 +967,26 @@ export function createSession(opts) {
     const id = `sess_${process.pid}_${nextId++}_${Date.now()}_${randomBytes(16).toString('hex')}`;
     const messages = [];
     const ownerIsAgent = isAgentOwner(opts.owner);
-    const resolvedRole = opts.role || profile?.taskType || null;
-    const hiddenRole = getHiddenRole(resolvedRole);
-    const isRetrievalRole = hiddenRole?.kind === 'retrieval';
-    // Skill schema is fixed; the compact manifest is discovered once through
-    // the mtime-cached frontmatter index so BP1 tells every role which Skill()
-    // names are available without loading full SKILL.md bodies.
-    const skills = opts.skipSkills ? [] : collectSkillsCached(opts.cwd);
+    const resolvedAgent = opts.agent || opts.role || profile?.taskType || null;
+    const hiddenAgent = getHiddenAgent(resolvedAgent);
+    const isRetrievalAgent = hiddenAgent?.kind === 'retrieval';
+    // Skill schema is fixed for public agent sessions, but hidden retrieval /
+    // maintenance roles are deliberately narrowed away from the Skill tool.
+    // Do not leak a Skill manifest into those hidden prompts when no Skill()
+    // loader is available.
+    const skills = (opts.skipSkills || hiddenAgent) ? [] : collectSkillsCached(opts.cwd);
 
     // BP1 is shared tool policy (+ compact skill manifest in compose). BP2 is
     // role/system rules. User-defined schedules/webhooks ride as normal user
     // context below so event data does not rewrite BP3 memory/meta.
-    const agentRulesRole = opts.role || profile?.taskType || null;
-    const agentRulesProfile = isRetrievalRole ? 'retrieval' : 'full';
+    const agentRulesAgent = opts.agent || opts.role || profile?.taskType || null;
+    const agentRulesProfile = isRetrievalAgent ? 'retrieval' : 'full';
     const skipAgentRules = opts.skipAgentRules === true;
     // Retrieval roles already inject a compact # Tool Use via BP2; skip the full BP1 shared tool policy to avoid duplicating it.
-    const injectedRules = (skipAgentRules || isRetrievalRole) ? '' : _buildSharedRules();
+    const injectedRules = (skipAgentRules || isRetrievalAgent) ? '' : _buildSharedRules();
     const roleRules = skipAgentRules ? '' : (ownerIsAgent ? _buildAgentRules(agentRulesProfile) : _buildLeadRules());
     const metaContext = skipAgentRules ? '' : (ownerIsAgent ? '' : _buildLeadMetaContext());
-    const roleSpecific = ownerIsAgent && !skipAgentRules ? _buildRoleSpecific(agentRulesRole) : '';
+    const roleSpecific = ownerIsAgent && !skipAgentRules ? _buildAgentSpecific(agentRulesAgent) : '';
     // Agent sessions must not inherit role/profile/preset tool narrowing: Pool
     // B and Pool C share one bit-identical tool schema to maximize provider
     // prefix reuse, and permission differences are enforced only at call time. Raw
@@ -1612,7 +1013,7 @@ export function createSession(opts) {
     // fail closed (zero tools) rather than silently falling back to the full
     // preset, which would grant the role more surface than declared.
     if (ownerIsAgent) {
-        toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, toolPermission, opts.role || null);
+        toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, toolPermission, opts.agent || null);
     }
 
     const { baseRules, stableSystemContext, sessionMarker, volatileTail } = composeSystemPrompt({
@@ -1622,7 +1023,7 @@ export function createSession(opts) {
         metaContext: metaContext || undefined,
         skipRoleCatalog: !ownerIsAgent,
         profile: profile || undefined,
-        role: resolvedRole,
+        agent: resolvedAgent,
         workflowContext: opts.workflowContext || null,
         workspaceContext: opts.workspaceContext || null,
         coreMemoryContext: opts.coreMemoryContext || null,
@@ -1678,17 +1079,17 @@ export function createSession(opts) {
     const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
     const tools = finalizeSessionToolList(toolsForRouting, {
         schemaAllowedTools: hasCallerAllow ? opts.schemaAllowedTools : null,
-        disallowedTools: opts.disallowedTools,
+        disallowedTools: hiddenAgent ? [...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []), 'Skill'] : opts.disallowedTools,
         ownerIsAgent,
-        resolvedRole,
+        resolvedAgent,
     });
 
     // Unified-shard policy — no broad role-specific schema filter. Keep
     // agent schemas shared unless a hidden-role schema profile explicitly
     // passes schemaAllowedTools for a small specialist; broad role
     // whitelists would fragment the cache shard.
-    if (resolvedRole && process.env.MIXDOG_DEBUG_SESSION_LOG) {
-        process.stderr.write(`[session] role=${resolvedRole} permission=${permission || 'full'} toolPermission=${toolPermission || 'full'} tools=${tools.length}\n`);
+    if (resolvedAgent && process.env.MIXDOG_DEBUG_SESSION_LOG) {
+        process.stderr.write(`[session] agent=${resolvedAgent} permission=${permission || 'full'} toolPermission=${toolPermission || 'full'} tools=${tools.length}\n`);
     }
     const contextMeta = resolveSessionContextMeta(provider, modelName);
     const workflowMeta = opts.workflow && typeof opts.workflow === 'object' && String(opts.workflow.id || '').trim()
@@ -1758,7 +1159,6 @@ export function createSession(opts) {
         // agent sessions past RUNNING_STALL_MS.
         lastUsedAt: Date.now(),
         tokensCumulative: 0,
-        role: opts.role || null,
         taskType: opts.taskType || null,
         maxLoopIterations: Number.isFinite(opts.maxLoopIterations) ? opts.maxLoopIterations : null,
         // Agent tag (auto worker{n} on spawn) persisted so the forked status
@@ -2203,6 +1603,18 @@ export function usageMetricsIdempotencyKey(sessionId, session, delta = {}) {
     return `${sessionId}:${turnId}:${epoch}:${delta.iterationIndex}:${source}`;
 }
 
+function uncachedInputTokensForProvider(provider, inputTokens, cachedReadTokens = 0, cacheWriteTokens = 0) {
+    const input = Number(inputTokens) || 0;
+    if (input <= 0) return 0;
+    // Anthropic-style providers report input_tokens excluding cache reads; OpenAI
+    // Responses/Gemini-style providers report input_tokens inclusive of cached
+    // prefix tokens. Keep both views so UI can show the real context footprint
+    // and the fresh/new token portion without mistaking cache hits for a cache
+    // break.
+    if (providerInputExcludesCache(provider)) return input + (Number(cacheWriteTokens) || 0);
+    return Math.max(input - (Number(cachedReadTokens) || 0) - (Number(cacheWriteTokens) || 0), 0);
+}
+
 /**
  * Apply terminal ask usage to session totals. Skips lifetime totals when incremental
  * per-iteration persistence already counted this turn (askSession path).
@@ -2211,23 +1623,38 @@ export function applyAskTerminalUsageTotals(session, result, options = {}) {
     if (!session || !result?.usage) return;
     const skipTotals = options.skipTotalsIfIncremental === true;
     if (!skipTotals) {
-        session.totalInputTokens = (session.totalInputTokens || 0) + (result.usage.inputTokens || 0);
-        session.totalOutputTokens = (session.totalOutputTokens || 0) + (result.usage.outputTokens || 0);
+        const inputTokens = result.usage.inputTokens || 0;
+        const outputTokens = result.usage.outputTokens || 0;
+        const cachedTokens = result.usage.cachedTokens || 0;
+        const cacheWriteTokens = result.usage.cacheWriteTokens || 0;
+        const uncachedInputTokens = uncachedInputTokensForProvider(session.provider, inputTokens, cachedTokens, cacheWriteTokens);
+        session.totalInputTokens = (session.totalInputTokens || 0) + inputTokens;
+        session.totalOutputTokens = (session.totalOutputTokens || 0) + outputTokens;
         session.tokensCumulative = (session.tokensCumulative || 0)
-            + (result.usage.inputTokens || 0)
-            + (result.usage.outputTokens || 0);
-        session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + (result.usage.cachedTokens || 0);
-        session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + (result.usage.cacheWriteTokens || 0);
+            + inputTokens
+            + outputTokens;
+        session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + cachedTokens;
+        session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + cacheWriteTokens;
+        session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + uncachedInputTokens;
     }
     const _lastTurn = result.lastTurnUsage || result.usage || {};
-    session.lastInputTokens = _lastTurn.inputTokens || 0;
+    const _lastInputTokens = _lastTurn.inputTokens || 0;
+    const _lastCachedReadTokens = _lastTurn.cachedTokens || 0;
+    const _lastCacheWriteTokens = _lastTurn.cacheWriteTokens || 0;
+    session.lastInputTokens = _lastInputTokens;
     session.lastOutputTokens = _lastTurn.outputTokens || 0;
-    session.lastCachedReadTokens = _lastTurn.cachedTokens || 0;
-    session.lastCacheWriteTokens = _lastTurn.cacheWriteTokens || 0;
+    session.lastCachedReadTokens = _lastCachedReadTokens;
+    session.lastCacheWriteTokens = _lastCacheWriteTokens;
+    session.lastUncachedInputTokens = uncachedInputTokensForProvider(
+        session.provider,
+        _lastInputTokens,
+        _lastCachedReadTokens,
+        _lastCacheWriteTokens,
+    );
     const _inputExcludesCache = providerInputExcludesCache(session.provider);
     session.lastContextTokens = _inputExcludesCache
-        ? (_lastTurn.inputTokens || 0) + (_lastTurn.cachedTokens || 0)
-        : (_lastTurn.inputTokens || 0);
+        ? _lastInputTokens + _lastCachedReadTokens + _lastCacheWriteTokens
+        : _lastInputTokens;
     session.lastContextTokensUpdatedAt = Date.now();
     session.lastContextTokensStaleAfterCompact = false;
 }
@@ -2257,6 +1684,9 @@ export async function persistIterationMetrics(delta) {
     seen.add(ikey);
     if (!isReplay) {
         if (runtimeEntry) runtimeEntry.usageMetricsTurnIncremental = true;
+        const deltaUncachedInput = delta.deltaUncachedInput != null
+            ? Number(delta.deltaUncachedInput) || 0
+            : uncachedInputTokensForProvider(session.provider, deltaInput, deltaCachedRead, deltaCacheWrite);
         session.totalInputTokens = (session.totalInputTokens || 0) + (deltaInput || 0);
         session.totalOutputTokens = (session.totalOutputTokens || 0) + (deltaOutput || 0);
         session.tokensCumulative = (session.tokensCumulative || 0) + (deltaInput || 0) + (deltaOutput || 0);
@@ -2266,12 +1696,15 @@ export async function persistIterationMetrics(delta) {
         // includes cached_read / cache_write in its terminal usage rollup).
         session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + (deltaCachedRead || 0);
         session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + (deltaCacheWrite || 0);
+        session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + deltaUncachedInput;
         // Window snapshot updated per iteration so agent type=list reflects the
         // most-recent provider-reported input size even for short dispatches
         // that finish before askSession's terminal save lands.
         session.lastInputTokens = deltaInput || 0;
         session.lastOutputTokens = deltaOutput || 0;
         session.lastCachedReadTokens = deltaCachedRead || 0;
+        session.lastCacheWriteTokens = deltaCacheWrite || 0;
+        session.lastUncachedInputTokens = deltaUncachedInput;
         // Normalized last-call context footprint: how many prompt tokens the
         // model actually saw on the most-recent send, comparable ACROSS
         // providers. Anthropic reports input_tokens EXCLUDING cache (cache_read
@@ -2280,7 +1713,7 @@ export async function persistIterationMetrics(delta) {
         // tokens INTO the input count, so input alone is the footprint.
         const _inputExcludesCache = providerInputExcludesCache(session.provider);
         session.lastContextTokens = _inputExcludesCache
-            ? (deltaInput || 0) + (deltaCachedRead || 0)
+            ? (deltaInput || 0) + (deltaCachedRead || 0) + (deltaCacheWrite || 0)
             : (deltaInput || 0);
         session.lastContextTokensUpdatedAt = ts || Date.now();
         session.lastContextTokensStaleAfterCompact = false;
@@ -2515,363 +1948,6 @@ const _sessionLocks = new Map();
 // queue contract, two call sites. Rich content is kept in memory for the live
 // relay path; the disk mirror stores only a text fallback so image bytes do not
 // leak into the pending-message JSON.
-const _sessionPendingMessages = new Map();
-const PENDING_MESSAGES_FILE = 'session-pending-messages.json';
-const PENDING_MESSAGES_MODE = 0o600;
-const _pendingPersistBuffers = new Map();
-let _pendingPersistImmediate = null;
-
-function pendingMessagesPath() {
-    return join(resolvePluginData(), PENDING_MESSAGES_FILE);
-}
-
-function isValidPendingSessionId(sessionId) {
-    return typeof sessionId === 'string' && /^[A-Za-z0-9_-]+$/.test(sessionId);
-}
-
-function normalizePendingStore(raw) {
-    const sessions = raw && typeof raw === 'object' && raw.sessions && typeof raw.sessions === 'object'
-        ? raw.sessions
-        : {};
-    const out = { version: 1, updatedAt: Date.now(), sessions: {} };
-    for (const [sid, value] of Object.entries(sessions)) {
-        if (!isValidPendingSessionId(sid) || !Array.isArray(value)) continue;
-        const q = value
-            .map((entry) => {
-                if (typeof entry === 'string') return entry;
-                if (entry && typeof entry === 'object' && typeof entry.message === 'string') return entry.message;
-                return '';
-            })
-            .filter(Boolean);
-        if (q.length > 0) out.sessions[sid] = q;
-    }
-    return out;
-}
-
-function normalizePendingMessageEntry(entry) {
-    if (typeof entry === 'string') {
-        const text = entry.trim();
-        return text ? { content: text, text } : null;
-    }
-    if (Array.isArray(entry)) {
-        if (entry.length === 0) return null;
-        const text = promptContentText(entry).trim();
-        return { content: entry, text };
-    }
-    if (!entry || typeof entry !== 'object') return null;
-    const content = Object.prototype.hasOwnProperty.call(entry, 'content') ? entry.content : null;
-    if (content == null) return null;
-    const text = typeof entry.text === 'string' ? entry.text.trim() : promptContentText(content).trim();
-    if (Array.isArray(content)) return content.length > 0 ? { content, text } : null;
-    if (typeof content === 'string') {
-        const value = content.trim();
-        return value ? { content: value, text: text || value } : null;
-    }
-    const fallback = promptContentText(content).trim();
-    return fallback ? { content: fallback, text: text || fallback } : null;
-}
-
-function pendingMessageText(entry) {
-    const normalized = normalizePendingMessageEntry(entry);
-    return normalized ? String(normalized.text || promptContentText(normalized.content) || '').trim() : '';
-}
-
-function pendingMessageQueueEntry(entry) {
-    const normalized = normalizePendingMessageEntry(entry);
-    if (!normalized) return null;
-    if (typeof normalized.content === 'string' && normalized.content === normalized.text) return normalized.content;
-    return { content: normalized.content, text: normalized.text || promptContentText(normalized.content).trim() };
-}
-
-function persistPendingMessages(sessionId, messages) {
-    if (!isValidPendingSessionId(sessionId)) return 0;
-    const persistedMessages = (Array.isArray(messages) ? messages : [messages])
-        .map(pendingMessageText)
-        .filter(Boolean);
-    if (persistedMessages.length === 0) return 0;
-    let depth = 0;
-    try {
-        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
-            const next = normalizePendingStore(raw);
-            const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
-            q.push(...persistedMessages);
-            next.sessions[sessionId] = q;
-            next.updatedAt = Date.now();
-            depth = q.length;
-            return next;
-        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
-    } catch (err) {
-        try { process.stderr.write(`[session] pending-message persist failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
-    }
-    return depth;
-}
-
-function flushPendingMessagePersistsSync() {
-    if (_pendingPersistImmediate) {
-        try { clearImmediate(_pendingPersistImmediate); } catch {}
-        _pendingPersistImmediate = null;
-    }
-    if (_pendingPersistBuffers.size === 0) return;
-    const batches = [..._pendingPersistBuffers.entries()];
-    _pendingPersistBuffers.clear();
-    for (const [sid, messages] of batches) {
-        persistPendingMessages(sid, messages);
-    }
-}
-
-function schedulePendingMessagePersist(sessionId, message) {
-    if (!isValidPendingSessionId(sessionId)) return 0;
-    const persistedMessage = pendingMessageText(message);
-    if (!persistedMessage) return 0;
-    const q = _pendingPersistBuffers.get(sessionId) || [];
-    q.push(persistedMessage);
-    _pendingPersistBuffers.set(sessionId, q);
-    if (!_pendingPersistImmediate) {
-        _pendingPersistImmediate = setImmediate(() => {
-            _pendingPersistImmediate = null;
-            flushPendingMessagePersistsSync();
-        });
-    }
-    return q.length;
-}
-
-function takeBufferedPendingMessages(sessionId) {
-    if (!isValidPendingSessionId(sessionId)) return [];
-    const buffered = _pendingPersistBuffers.get(sessionId);
-    if (!buffered || buffered.length === 0) return [];
-    _pendingPersistBuffers.delete(sessionId);
-    return buffered.slice();
-}
-
-function drainPersistedPendingMessages(sessionId) {
-    if (!isValidPendingSessionId(sessionId)) return [];
-    let drained = [];
-    try {
-        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
-            const next = normalizePendingStore(raw);
-            const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
-            drained = q.filter((m) => typeof m === 'string' && m.length > 0);
-            if (drained.length === 0) return undefined;
-            delete next.sessions[sessionId];
-            next.updatedAt = Date.now();
-            return next;
-        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
-    } catch (err) {
-        try { process.stderr.write(`[session] pending-message drain failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
-    }
-    return drained;
-}
-
-export function enqueuePendingMessage(sessionId, message) {
-    const entry = pendingMessageQueueEntry(message);
-    if (!sessionId || !entry) return 0;
-    let q = _sessionPendingMessages.get(sessionId);
-    if (!q) { q = []; _sessionPendingMessages.set(sessionId, q); }
-    q.push(entry);
-    const bufferedDepth = schedulePendingMessagePersist(sessionId, entry);
-    return Math.max(q.length, bufferedDepth || 0);
-}
-export function drainPendingMessages(sessionId) {
-    const q = _sessionPendingMessages.get(sessionId);
-    const memory = q && q.length > 0 ? q.slice() : [];
-    _sessionPendingMessages.delete(sessionId);
-    const persisted = [...takeBufferedPendingMessages(sessionId), ...drainPersistedPendingMessages(sessionId)];
-    const memoryVisible = modelVisiblePendingMessages(memory);
-    const persistedVisible = modelVisiblePendingMessages(persisted);
-    if (memoryVisible.length === 0) return persistedVisible;
-    if (persistedVisible.length === 0) return memoryVisible;
-    const persistedTexts = persistedVisible.map(pendingMessageText);
-    const prefixMatches = memoryVisible.every((m, i) => persistedTexts[i] === pendingMessageText(m));
-    if (prefixMatches) return [...memoryVisible, ...persistedVisible.slice(memoryVisible.length)];
-    const out = persistedVisible.slice();
-    const seen = new Set(persistedTexts);
-    for (const m of memoryVisible) {
-        const text = pendingMessageText(m);
-        if (!text || seen.has(text)) continue;
-        out.push(m);
-        seen.add(text);
-    }
-    return out;
-}
-
-function promptContentText(content) {
-    if (typeof content === 'string') return content;
-    if (Array.isArray(content)) {
-        return content.map((part) => {
-            if (typeof part === 'string') return part;
-            if (part?.type === 'text') return part.text || '';
-            if (part?.type === 'image') return '[Image]';
-            return part?.text || '';
-        }).filter(Boolean).join('\n');
-    }
-    return String(content ?? '');
-}
-
-function hasModelVisiblePromptContent(prompt) {
-    return !!promptContentText(prompt).trim();
-}
-
-function promptContentBytes(content) {
-    try {
-        if (typeof content === 'string') return Buffer.byteLength(content, 'utf8');
-        return Buffer.byteLength(JSON.stringify(content), 'utf8');
-    } catch {
-        return Buffer.byteLength(promptContentText(content), 'utf8');
-    }
-}
-
-function prefixUserTurnContent(content, contextBlock) {
-    if (!contextBlock) return content;
-    if (Array.isArray(content)) {
-        return [{ type: 'text', text: `${contextBlock}# Task\n` }, ...content];
-    }
-    return `${contextBlock}# Task\n${content}`;
-}
-
-function prefixSessionStartContent(content, sessionBlock) {
-    if (!sessionBlock) return content;
-    if (Array.isArray(content)) {
-        return [{ type: 'text', text: `${sessionBlock}\n\n` }, ...content];
-    }
-    return `${sessionBlock}\n\n${content}`;
-}
-
-function localIsoDate(date = new Date()) {
-    const year = date.getFullYear();
-    const month = String(date.getMonth() + 1).padStart(2, '0');
-    const day = String(date.getDate()).padStart(2, '0');
-    return `${year}-${month}-${day}`;
-}
-
-function localDateTimeWithZone(date = new Date()) {
-    const datePart = localIsoDate(date);
-    const hh = String(date.getHours()).padStart(2, '0');
-    const mm = String(date.getMinutes()).padStart(2, '0');
-    const ss = String(date.getSeconds()).padStart(2, '0');
-    let zone = '';
-    try { zone = Intl.DateTimeFormat().resolvedOptions().timeZone || ''; } catch {}
-    return zone ? `${datePart} ${hh}:${mm}:${ss} ${zone}` : `${datePart} ${hh}:${mm}:${ss}`;
-}
-
-function temporalPromptText(content) {
-    const text = promptContentText(content)
-        .replace(/\s+/g, ' ')
-        .trim()
-        .toLowerCase();
-    return text;
-}
-
-function promptNeedsDateReminder(content) {
-    const text = temporalPromptText(content);
-    if (!text) return false;
-    return /(?:오늘|내일|어제|모레|그저께|요즘|최근|방금|아까|현재\s*(?:날짜|시간|시각)|지금\s*(?:몇\s*시|시간|날짜|요일)|몇\s*월\s*몇\s*일|몇\s*시|무슨\s*요일|요일|날짜|이번\s*(?:주|달|월|년)|지난\s*(?:주|달|월|년)|다음\s*(?:주|달|월|년)|올해|작년|내년|today|tomorrow|yesterday|recently|current\s+(?:date|time)|what\s+(?:date|time)|which\s+day|weekday|this\s+(?:week|month|year)|last\s+(?:week|month|year)|next\s+(?:week|month|year))/i.test(text);
-}
-
-function promptNeedsTimeReminder(content) {
-    const text = temporalPromptText(content);
-    if (!text) return false;
-    return /(?:현재\s*(?:시간|시각)|지금\s*(?:몇\s*시|시간)|몇\s*시|시각|시간|current\s+time|what\s+time|time\s+is\s+it)/i.test(text);
-}
-
-function buildCurrentTimeBlock(content) {
-    const needsTime = promptNeedsTimeReminder(content);
-    if (!needsTime && !promptNeedsDateReminder(content)) return '';
-    return localDateTimeWithZone(new Date());
-}
-
-function sessionModelDisplay(model) {
-    const text = String(model || '').trim();
-    if (!text) return '';
-    return text
-        .replace(/-\d{4}-\d{2}-\d{2}$/, '')
-        .replace(/^gpt-/i, 'GPT-')
-        .replace(/(?:^|-)([a-z])/g, (m) => m.toUpperCase());
-}
-
-function buildSessionStartBlock(session, cwd) {
-    if (!session || session.owner === 'agent') return '';
-    const lines = ['# Session'];
-    const effectiveCwd = String(cwd || session.cwd || '').trim();
-    if (effectiveCwd) lines.push(`Cwd: ${effectiveCwd}`);
-    const modelBits = [
-        sessionModelDisplay(session.model),
-        session.effort ? String(session.effort).trim().toUpperCase() : '',
-        session.fast === true ? 'FAST' : '',
-    ].filter(Boolean);
-    if (modelBits.length) lines.push(`Model: ${modelBits.join(' · ')}`);
-    const workflowName = String(session.workflow?.name || session.workflow?.id || '').trim();
-    if (workflowName) lines.push(`Workflow: ${workflowName}`);
-    return lines.length > 1 ? lines.join('\n') : '';
-}
-
-function isReferenceFilesMessage(message) {
-    return message?.role === 'user'
-        && typeof message.content === 'string'
-        && /^Reference files:\s*/i.test(message.content.trimStart());
-}
-
-function isProtectedContextUserMessage(message) {
-    return message?.role === 'user'
-        && typeof message.content === 'string'
-        && message.content.trimStart().startsWith('<system-reminder>');
-}
-
-function hasUserConversationMessage(messages) {
-    return (Array.isArray(messages) ? messages : []).some((message) => (
-        message?.role === 'user'
-        && !isProtectedContextUserMessage(message)
-        && !isReferenceFilesMessage(message)
-    ));
-}
-
-function modelVisiblePendingMessages(messages) {
-    return (Array.isArray(messages) ? messages : [])
-        .map(pendingMessageQueueEntry)
-        .filter(Boolean)
-        .filter((message) => !isInternalRuntimeNotificationText(
-            message && typeof message === 'object' && Object.prototype.hasOwnProperty.call(message, 'content')
-                ? message.content
-                : message,
-        ));
-}
-
-export function _mergePendingMessageEntries(entries) {
-    const normalized = (Array.isArray(entries) ? entries : [])
-        .map(normalizePendingMessageEntry)
-        .filter(Boolean);
-    if (normalized.length === 0) return null;
-    const displayText = normalized.map((entry) => entry.text || promptContentText(entry.content))
-        .filter((text) => String(text || '').trim())
-        .join('\n');
-    if (normalized.every((entry) => typeof entry.content === 'string')) {
-        return {
-            content: normalized.map((entry) => entry.content).filter(Boolean).join('\n'),
-            text: displayText,
-            count: normalized.length,
-        };
-    }
-    const parts = [];
-    for (const entry of normalized) {
-        if (typeof entry.content === 'string') {
-            if (entry.content.trim()) parts.push({ type: 'text', text: entry.content });
-        } else if (Array.isArray(entry.content)) {
-            parts.push(...entry.content);
-        } else {
-            const text = promptContentText(entry.content);
-            if (text.trim()) parts.push({ type: 'text', text });
-        }
-        parts.push({ type: 'text', text: '\n' });
-    }
-    while (parts.length && parts[parts.length - 1]?.type === 'text' && parts[parts.length - 1]?.text === '\n') parts.pop();
-    return { content: parts, text: displayText || promptContentText(parts), count: normalized.length };
-}
-
-function isInternalRuntimeNotificationText(content) {
-    return contractIsInternalRuntimeNotificationText(promptContentText(content));
-}
-
-export const _isInternalRuntimeNotificationText = isInternalRuntimeNotificationText;
-
 function isInternalCancelledAssistantMessage(message) {
     if (!message || message.role !== 'assistant') return false;
     if (message.cancelled === true) return true;
@@ -3439,7 +2515,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 logLlmCall({
                     ts: new Date().toISOString(),
                     sourceType: session.sourceType || 'lead',
-                    sourceName: session.sourceName || session.role || null,
+                    sourceName: session.sourceName || session.agent || null,
                     preset: session.presetName || null,
                     model: session.model,
                     provider: session.provider,
@@ -3660,13 +2736,13 @@ export async function resumeSession(sessionId, preset) {
     }
     let toolsForRouting = resolveSessionTools(toolSpec, skills, { ownerIsAgentSession: ownerIsAgent });
     if (ownerIsAgent) {
-        toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, session.toolPermission, session.role || null);
+        toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, session.toolPermission, session.agent || null);
     }
     session.tools = finalizeSessionToolList(toolsForRouting, {
         schemaAllowedTools: Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
-        disallowedTools: null,
+        disallowedTools: getHiddenAgent(session.agent || null) ? ['Skill'] : null,
         ownerIsAgent,
-        resolvedRole: session.role || null,
+        resolvedAgent: session.agent || null,
     });
     const newTools = session.tools;
     const missing = oldTools.filter(t => !newTools.find(n => n.name === t.name));
@@ -3911,6 +2987,10 @@ export function closeSession(id, reason = 'manual') {
     // or Map entries across session lifetime. Fire-and-forget — close path
     // should not await disk IO; errors are swallowed inside.
     try { clearOffloadSession(id); } catch { /* ignore */ }
+    // Drop the in-memory pending-message queue and any buffered-persist entry
+    // for this session — otherwise both Maps accumulate one entry per closed
+    // session for the life of the mcp-server.
+    _dropPendingMessageState(id);
     // 4. Defer runtime map clear to next tick so any settling askSession can
     //    observe `closed=true` / bumped generation before we yank the entry.
     //    Disk tombstone remains — that's what blocks resurrection.