mixdog 0.9.151 → 0.9.152

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint.mjs

@@ -1,59 +1,27 @@
-import {
-    existsSync,
-    mkdirSync,
-    readFileSync,
-    unlinkSync,
-    writeFileSync,
-} from 'fs';
-import { writeFile } from 'fs/promises';
-import { randomBytes } from 'crypto';
-import { join } from 'path';
-import { getPluginData } from '../../config.mjs';
-import { renameWithRetrySync } from '../../../../shared/atomic-file.mjs';
-import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
-import { promptContentText } from './prompt-utils.mjs';
+import { existsSync, unlinkSync } from 'fs';
 import { finalizeTurnInterruptionSnapshot } from './turn-interruption.mjs';
-
-const TURN_CHECKPOINT_VERSION = 1;
-const SESSION_ID = /^[A-Za-z0-9_-]+$/;
-
-function checkpointDir() {
-    const dir = join(getPluginData(), 'turn-checkpoints');
-    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-    return dir;
-}
-
-function turnCheckpointPath(sessionId) {
-    if (!SESSION_ID.test(String(sessionId || ''))) {
-        throw new Error(`[turn-checkpoint] invalid session id: ${JSON.stringify(sessionId)}`);
-    }
-    return join(checkpointDir(), `${sessionId}.json`);
-}
-
-function checkpointMessage(message) {
-    if (!message || typeof message !== 'object') return message;
-    const content = sanitizeContentForStoredHistory(message.content);
-    return content === message.content ? message : { ...message, content };
-}
-
-function matchingUserMessage(message, currentUserContent) {
-    return message?.role === 'user'
-        && (message.content === currentUserContent
-            || promptContentText(message.content) === promptContentText(currentUserContent));
-}
-
-export function turnMessagesForCheckpoint(messages, currentUserContent) {
-    const source = Array.isArray(messages) ? messages : [];
-    let start = -1;
-    for (let index = source.length - 1; index >= 0; index -= 1) {
-        if (matchingUserMessage(source[index], currentUserContent)) {
-            start = index;
-            break;
-        }
-    }
-    const turn = start >= 0 ? source.slice(start) : [];
-    return turn.map(checkpointMessage);
-}
+import {
+    appendJournalLines,
+    cancelJournalWrites,
+    createTurnJournalEncoder,
+    emptyInterruptionSnapshot,
+    findTurnStart,
+    journalHeadLines,
+    matchingUserMessage,
+    openJournalForTurn,
+    readTurnCheckpointHeader,
+    removeTurnJournal,
+    replayTurnJournal,
+    settleTurnJournalWrites,
+    turnCheckpointPath,
+    turnMessagesForCheckpoint,
+    writeCheckpointHeader,
+} from './turn-checkpoint-journal.mjs';
+
+export { turnCheckpointPath, turnMessagesForCheckpoint };
+
+/** Resolve once every queued journal append for a session has been written. */
+export const settleTurnCheckpointWrites = settleTurnJournalWrites;
 
 /** Read-only projection for a turn still owned by another process. Unlike
  * recoverTurnCheckpoint this never mutates the session, clears the checkpoint,
@@ -85,160 +53,110 @@ export function projectTurnCheckpointMessages(session, checkpoint) {
     ];
 }
 
-// ── Async checkpoint writes ──────────────────────────────────────────────────
-// The throttled streaming-delta flushes used to serialize+write synchronously
-// on the engine thread (up to ~6 stalls/second during a tool-heavy turn). The
-// async lane keeps per-session latest-wins coalescing (one in-flight write,
-// one queued payload) with an epoch so clear/stop can retire stale writes —
-// no locks, sessions stay fully parallel. The FIRST write of a turn stays
-// sync (opts.sync) because it is the crash-durability anchor for the prompt.
-const _pendingCheckpointWrites = new Map(); // sessionId → { queued, writing, epoch }
-const _asyncWriteWarned = new Set(); // sessionId — warn once per session
-
-function _warnAsyncWriteOnce(sessionId, error) {
-    if (_asyncWriteWarned.has(sessionId)) return;
-    _asyncWriteWarned.add(sessionId);
-    try {
-        process.stderr.write(`[turn-checkpoint] async write failed session=${sessionId}: ${error?.message || error}\n`);
-    } catch { /* stderr best-effort */ }
+// ── Journal-backed checkpoint writes ─────────────────────────────────────────
+// A turn is checkpointed as a write-once header plus an append-only delta
+// journal (turn-checkpoint-journal.mjs). The recorder owns exactly one turn:
+// the FIRST record() writes the header synchronously — it is the crash
+// durability anchor for the prompt and must land before the provider runs —
+// and every later record() appends ONLY what changed since the previous flush.
+// Per-flush cost is therefore O(new bytes), not O(whole growing turn), so a
+// long tool-heavy turn no longer amplifies into the shared engine thread that
+// every fanned-out agent session shares.
+export function createTurnCheckpointRecorder({ sessionId, generation, turnToken, startedAt }) {
+    const encoder = createTurnJournalEncoder({ turnToken });
+    let opened = false;
+    let stopped = false;
+    return {
+        get opened() { return opened; },
+        /** True when this call wrote or queued durable state. */
+        record({ currentUserContent, turnOutgoing, interruption }) {
+            if (stopped || !sessionId || !turnToken) return false;
+            if (!opened) {
+                const seed = encoder.seed(turnOutgoing, currentUserContent, interruption);
+                writeCheckpointHeader({
+                    sessionId,
+                    generation,
+                    turnToken,
+                    startedAt,
+                    currentUserContent,
+                    turnMessages: seed.turnMessages,
+                    interruption: typeof interruption?.snapshot === 'function'
+                        ? interruption.snapshot()
+                        : emptyInterruptionSnapshot(),
+                });
+                // Opening the journal is part of the anchor: a leftover journal
+                // from an earlier turn of this session must never replay onto
+                // the new header. It lands synchronously when the lane is idle
+                // and is otherwise FENCED behind the older in-flight write, so
+                // an old turn can never appear beneath this turn's token (the
+                // head record's token guards the interim window).
+                openJournalForTurn(sessionId, seed.openLines);
+                opened = true;
+                return true;
+            }
+            const lines = encoder.encode({ turnOutgoing, currentUserContent, interruption });
+            if (lines.length === 0) return false;
+            appendJournalLines(sessionId, lines);
+            return true;
+        },
+        stop() {
+            if (stopped) return;
+            stopped = true;
+            cancelPendingTurnCheckpoint(sessionId);
+        },
+    };
 }
 
-/** Retire queued + in-flight async writes for a session (epoch bump). */
+/** Retire queued (not yet written) journal appends for a session. The durable
+ * prefix stays on disk on purpose: between turn commit and clearTurnCheckpoint
+ * a crash must still recover the turn's work, not just its opening header. */
 export function cancelPendingTurnCheckpoint(sessionId) {
-    const entry = _pendingCheckpointWrites.get(sessionId);
-    if (!entry) return;
-    entry.queued = null;
-    entry.epoch += 1;
-    if (!entry.writing) _pendingCheckpointWrites.delete(sessionId);
+    cancelJournalWrites(sessionId);
 }
 
-function _pumpCheckpointWrites(sessionId) {
-    const entry = _pendingCheckpointWrites.get(sessionId);
-    if (!entry || entry.writing) return;
-    if (!entry.queued) {
-        _pendingCheckpointWrites.delete(sessionId);
-        return;
-    }
-    const { target, json } = entry.queued;
-    entry.queued = null;
-    entry.writing = true;
-    const epoch = entry.epoch;
-    const temp = `${target}.${randomBytes(6).toString('hex')}.tmp`;
-    writeFile(temp, json, 'utf8')
-        .then(() => {
-            // A clear/stop after this write was dequeued must win: renaming a
-            // retired payload would resurrect a checkpoint the turn already
-            // finalized. The epoch check and rename run in one synchronous
-            // block, so cancel (also synchronous) can never interleave.
-            if (entry.epoch !== epoch) {
-                try { unlinkSync(temp); } catch { /* best-effort */ }
-                return;
-            }
-            renameWithRetrySync(temp, target);
-        })
-        .catch((error) => {
-            try { unlinkSync(temp); } catch { /* best-effort */ }
-            _warnAsyncWriteOnce(sessionId, error);
-        })
-        .finally(() => {
-            entry.writing = false;
-            _pumpCheckpointWrites(sessionId);
-        });
-}
-
-// Hard-exit parity with the old sync behavior: a queued-but-unwritten payload
-// is flushed synchronously so a clean process exit never loses the newest
-// checkpoint state (crash loss remains bounded by the caller's throttle).
-process.on('exit', () => {
-    for (const [sessionId, entry] of _pendingCheckpointWrites) {
-        if (!entry.queued) continue;
-        const { target, json } = entry.queued;
-        entry.queued = null;
-        const temp = `${target}.${randomBytes(6).toString('hex')}.tmp`;
-        try {
-            writeFileSync(temp, json, 'utf8');
-            renameWithRetrySync(temp, target);
-        } catch (error) {
-            try { unlinkSync(temp); } catch { /* best-effort */ }
-            _warnAsyncWriteOnce(sessionId, error);
-        }
-    }
-});
-
-export function writeTurnCheckpoint(checkpoint, { sync = true } = {}) {
+/** Full-snapshot write (header + journal reset). The streaming path uses
+ * createTurnCheckpointRecorder; this stays for callers holding a complete
+ * checkpoint object that must become durable in one shot. */
+export function writeTurnCheckpoint(checkpoint) {
     if (!checkpoint?.sessionId || !checkpoint?.turnToken) return false;
-    const target = turnCheckpointPath(checkpoint.sessionId);
-    const payload = {
-        ...checkpoint,
-        version: TURN_CHECKPOINT_VERSION,
-        currentUserContent: sanitizeContentForStoredHistory(checkpoint.currentUserContent),
-        turnMessages: (Array.isArray(checkpoint.turnMessages) ? checkpoint.turnMessages : [])
-            .map(checkpointMessage),
-        updatedAt: Date.now(),
-    };
-    if (!sync) {
-        const json = JSON.stringify(payload);
-        const entry = _pendingCheckpointWrites.get(checkpoint.sessionId)
-            ?? { queued: null, writing: false, epoch: 0 };
-        _pendingCheckpointWrites.set(checkpoint.sessionId, entry);
-        entry.queued = { target, json };
-        _pumpCheckpointWrites(checkpoint.sessionId);
-        return true;
-    }
-    const temp = `${target}.${randomBytes(6).toString('hex')}.tmp`;
-    try {
-        writeFileSync(temp, JSON.stringify(payload), 'utf8');
-        renameWithRetrySync(temp, target);
-        return true;
-    } catch (error) {
-        try { unlinkSync(temp); } catch {}
-        throw error;
-    }
+    writeCheckpointHeader(checkpoint);
+    openJournalForTurn(checkpoint.sessionId, journalHeadLines(checkpoint.turnToken));
+    return true;
 }
 
 export function readTurnCheckpoint(sessionId) {
-    const target = turnCheckpointPath(sessionId);
-    try {
-        const value = JSON.parse(readFileSync(target, 'utf8'));
-        if (value?.version !== TURN_CHECKPOINT_VERSION
-            || value?.sessionId !== sessionId
-            || !value?.turnToken
-            || !Array.isArray(value?.turnMessages)) {
-            return null;
-        }
-        return value;
-    } catch {
-        return null;
-    }
+    const header = readTurnCheckpointHeader(sessionId);
+    if (!header) return null;
+    return replayTurnJournal(header);
 }
 
 export function clearTurnCheckpoint(sessionId, turnToken = null) {
     const target = turnCheckpointPath(sessionId);
-    // Queued async writes are stale the moment the caller decides to clear
-    // this turn's checkpoint; retire them BEFORE the token guard reads disk
-    // so a lagging write can never resurrect the file after the unlink.
+    // Queued appends are stale the moment the caller decides to clear this
+    // turn's checkpoint; retire them BEFORE the token guard reads disk so a
+    // lagging write can never resurrect state after the unlink.
     if (!turnToken) cancelPendingTurnCheckpoint(sessionId);
-    if (!existsSync(target)) return true;
+    if (!existsSync(target)) {
+        // Header already gone: drop any orphan journal (a late in-flight append
+        // can recreate the file after a previous clear).
+        if (!turnToken) removeTurnJournal(sessionId);
+        return true;
+    }
     if (turnToken) {
-        const current = readTurnCheckpoint(sessionId);
+        const current = readTurnCheckpointHeader(sessionId);
         // A token guard prevents an older turn's late terminal save from
         // deleting the checkpoint already created by its queued follow-up.
         if (current?.turnToken && current.turnToken !== turnToken) return false;
         cancelPendingTurnCheckpoint(sessionId);
     }
+    let removed = true;
     try {
         unlinkSync(target);
-        return true;
     } catch {
-        return false;
-    }
-}
-
-function findPersistedTurnStart(messages, currentUserContent) {
-    for (let index = messages.length - 1; index >= 0; index -= 1) {
-        if (matchingUserMessage(messages[index], currentUserContent)) return index;
+        removed = false;
     }
-    return -1;
+    removeTurnJournal(sessionId);
+    return removed;
 }
 
 /**
@@ -277,13 +195,14 @@ export function recoverTurnCheckpoint(session) {
         abortReason: 'process-crash',
     });
     const current = Array.isArray(session.messages) ? session.messages : [];
-    const start = findPersistedTurnStart(current, checkpoint.currentUserContent);
+    const start = findTurnStart(current, checkpoint.currentUserContent);
     session.messages = [
         ...(start >= 0 ? current.slice(0, start) : current),
         ...finalized.messages,
     ];
     delete session.activeTurnCheckpoint;
     delete session.providerState;
+    delete session._providerPrefixGuardState;
     session.updatedAt = Date.now();
     session.lastUsedAt = Date.now();
     return {

package/src/runtime/agent/orchestrator/session/manager/turn-interruption.mjs

@@ -188,6 +188,14 @@ export function createTurnInterruptionTracker() {
     let phase = 'streaming';
     const observedToolCalls = new Map();
     const observedToolResults = new Map();
+    // Epochs make the checkpoint journal's delta encoding sound WITHOUT
+    // comparing whole buffers on every flush: an epoch bump means "this buffer
+    // changed in a way that is not a plain append", so the encoder falls back
+    // to a full (still small) set record instead of an append record.
+    let textEpoch = 0;
+    let reasoningEpoch = 0;
+    let tombEpoch = 0;
+    let callsEpoch = 0;
 
     return {
         recordTextDelta(chunk) {
@@ -206,11 +214,16 @@ export function createTurnInterruptionTracker() {
                 0,
                 cutAt,
             );
+            textEpoch += 1;
+            tombEpoch += 1;
         },
         restoreTombstonedText() {
             if (!tombstonedAssistantContent) return false;
+            // Append-only for the partial buffer (no textEpoch bump); only the
+            // tombstone side is structurally reset.
             partialAssistantContent += tombstonedAssistantContent;
             tombstonedAssistantContent = '';
+            tombEpoch += 1;
             return true;
         },
         hasResponseStarted() {
@@ -235,6 +248,10 @@ export function createTurnInterruptionTracker() {
             tombstonedAssistantContent = '';
             partialReasoningContent = '';
             observedToolCalls.clear();
+            textEpoch += 1;
+            reasoningEpoch += 1;
+            tombEpoch += 1;
+            callsEpoch += 1;
         },
         recordToolCalls(calls, { eagerStarted = false } = {}) {
             for (const call of Array.isArray(calls) ? calls : []) {
@@ -283,6 +300,104 @@ export function createTurnInterruptionTracker() {
                 observedToolResults: [...observedToolResults.entries()],
             };
         },
+        /**
+         * Delta against an opaque cursor from a previous call (null = seed).
+         * The checkpoint journal uses this instead of snapshot() so a flush
+         * serializes only what changed: appended text/reasoning, newly observed
+         * tool calls/results, and phase/responseStarted transitions. Cost is
+         * O(new bytes + observed tool entries), never O(turn).
+         * Returns { changed, delta, cursor }.
+         */
+        journalDelta(cursor) {
+            const prev = cursor && typeof cursor === 'object' ? cursor : null;
+            const prevCalls = prev?.calls instanceof Map ? prev.calls : new Map();
+            const prevResults = prev?.results instanceof Map ? prev.results : new Map();
+            const delta = {};
+            let changed = false;
+            if (prev ? prev.responseStarted !== responseStarted : responseStarted) {
+                delta.rs = responseStarted;
+                changed = true;
+            }
+            if (prev ? prev.phase !== phase : phase !== 'streaming') {
+                delta.ph = phase;
+                changed = true;
+            }
+            if (!prev || prev.textEpoch !== textEpoch
+                || partialAssistantContent.length < prev.textLen) {
+                if (prev || partialAssistantContent) {
+                    delta.ts = partialAssistantContent;
+                    changed = true;
+                }
+            } else if (partialAssistantContent.length > prev.textLen) {
+                delta.ta = partialAssistantContent.slice(prev.textLen);
+                changed = true;
+            }
+            if (!prev || prev.reasoningEpoch !== reasoningEpoch
+                || partialReasoningContent.length < prev.reasoningLen) {
+                if (prev || partialReasoningContent) {
+                    delta.qs = partialReasoningContent;
+                    changed = true;
+                }
+            } else if (partialReasoningContent.length > prev.reasoningLen) {
+                delta.qa = partialReasoningContent.slice(prev.reasoningLen);
+                changed = true;
+            }
+            if (!prev || prev.tombEpoch !== tombEpoch) {
+                if (prev || tombstonedAssistantContent) {
+                    delta.tb = tombstonedAssistantContent;
+                    changed = true;
+                }
+            }
+            // A cleared call map is a structural reset: journal the clear and
+            // re-emit whatever was recorded after it.
+            const callsReset = Boolean(prev) && prev.callsEpoch !== callsEpoch;
+            if (callsReset) {
+                delta.cc = true;
+                changed = true;
+            }
+            const callSet = [];
+            for (const [id, entry] of observedToolCalls) {
+                if (!callsReset && prevCalls.get(id) === entry) continue;
+                callSet.push([id, entry]);
+            }
+            if (callSet.length > 0) {
+                delta.cs = callSet;
+                changed = true;
+            }
+            const resultSet = [];
+            for (const [id, entry] of observedToolResults) {
+                if (prevResults.get(id) === entry) continue;
+                resultSet.push([id, entry]);
+            }
+            if (resultSet.length > 0) {
+                delta.os = resultSet;
+                changed = true;
+            }
+            const resultDeleted = [];
+            for (const id of prevResults.keys()) {
+                if (!observedToolResults.has(id)) resultDeleted.push(id);
+            }
+            if (resultDeleted.length > 0) {
+                delta.od = resultDeleted;
+                changed = true;
+            }
+            return {
+                changed,
+                delta,
+                cursor: {
+                    responseStarted,
+                    phase,
+                    textEpoch,
+                    textLen: partialAssistantContent.length,
+                    reasoningEpoch,
+                    reasoningLen: partialReasoningContent.length,
+                    tombEpoch,
+                    callsEpoch,
+                    calls: new Map(observedToolCalls),
+                    results: new Map(observedToolResults),
+                },
+            };
+        },
         finalize({ turnOutgoing, currentUserContent, abortReason = null }) {
             return finalizeInterruptedTurn({
                 turnOutgoing,

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -33,6 +33,7 @@ import { isContextOverflowError } from '../providers/retry-classifier.mjs';
 import { traceAgentCompact, messagePrefixHash } from '../agent-trace.mjs';
 import { invalidateProviderRequestToolsScope } from '../../../../session-runtime/provider-request-tools.mjs';
 import { bumpUsageMetricsEpoch } from './manager.mjs';
+import { resetReadStateAfterCompaction } from './read-dedup.mjs';
 
 const RECOVERED_ERROR_MESSAGE_MAX_CHARS = 300;
 const ANSI_ESCAPE_RE = /[\u001B\u009B][[\]()#;?]*(?:(?:[a-zA-Z\d]*(?:;[-a-zA-Z\d/#&.:=?%@~_]+)*)?\u0007|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))/g;
@@ -444,6 +445,7 @@ export async function runPreSendCompactPass(state) {
                 if (compactChanged) {
                     messages.length = 0;
                     messages.push(...compacted);
+                    resetReadStateAfterCompaction(sessionId);
                     // This attempt's provider-tool scope was keyed to the old
                     // transcript shape. Invalidate it synchronously before any
                     // post-compact callback or subsequent async continuation.

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -24,6 +24,7 @@ import {
 } from './image-strip-recovery.mjs';
 import { setTimeout as sleepMs } from 'timers/promises';
 import { readStreamOutcome } from '../providers/lib/stream-outcome.mjs';
+import { cloneProviderReplay } from '../providers/lib/provider-replay.mjs';
 import { resolveWorkerCompactPolicy } from './loop/compact-policy.mjs';
 import { agentContextOverflowError } from './loop/context-overflow.mjs';
 import { estimateMessagesTokensSafe } from './loop/compact-debug.mjs';
@@ -262,6 +263,7 @@ export async function sendWithRecovery(ctx) {
                 && outcome.toolCallsStarted !== true
                 && outcome.sideEffectDispatched !== true
             ) {
+                const partialProviderReplay = cloneProviderReplay(sendErr.partialProviderReplay);
                 response = {
                     content: sendErr.partialContent,
                     model: sendErr.model || model,
@@ -269,6 +271,7 @@ export async function sendWithRecovery(ctx) {
                     usage: normalizedIncompleteUsage(sendErr.rawUsage),
                     stopReason: sendErr.finishReason,
                     truncated: true,
+                    ...(partialProviderReplay ? { providerReplay: partialProviderReplay } : {}),
                     providerMetadata: sendErr.providerMetadata,
                     providerState: opts.providerState,
                     providerIncompleteRecovery: true,
@@ -393,6 +396,7 @@ export async function sendWithRecovery(ctx) {
                         partialContentLen: typeof sendErr.partialContent === 'string' ? sendErr.partialContent.length : 0,
                     });
                 } catch { /* best-effort */ }
+                const partialProviderReplay = cloneProviderReplay(sendErr.partialProviderReplay);
                 response = {
                     content: typeof sendErr.partialContent === 'string' ? sendErr.partialContent : '',
                     model: sendErr.partialModel || model,
@@ -416,6 +420,9 @@ export async function sendWithRecovery(ctx) {
                     ...(Array.isArray(sendErr.partialAssistantBlocks) && sendErr.partialAssistantBlocks.length
                         ? { assistantBlocks: sendErr.partialAssistantBlocks }
                         : {}),
+                    ...(partialProviderReplay
+                        ? { providerReplay: partialProviderReplay }
+                        : {}),
                     providerMetadata: sendErr.providerMetadata,
                     partialToolRecovery: true,
                 };

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -95,6 +95,7 @@ export { parkSessionSnapshotForDrain, unparkSessionSnapshotForDrain } from './st
 // no timer retry and no exit-drain entry survives the unlink. Layering stays
 // intact: the store never imports manager code.
 const _sessionPurgeHooks = new Set();
+const _liveSessionSubscribers = new Set();
 
 export function registerSessionPurgeHook(hook) {
     if (typeof hook !== 'function') return () => {};
@@ -102,6 +103,24 @@ export function registerSessionPurgeHook(hook) {
     return () => _sessionPurgeHooks.delete(hook);
 }
 
+/** In-process session publication seam.
+ *
+ * The runtime worker uses this to project agent sessions through the daemon's
+ * ordinary session-state lane. Persistence remains independent: subscribers
+ * observe the same immutable session object that was admitted to the live
+ * cache, before disk debounce or I/O can delay a visible pane. */
+export function subscribeLiveSessions(listener) {
+    if (typeof listener !== 'function') return () => {};
+    _liveSessionSubscribers.add(listener);
+    return () => _liveSessionSubscribers.delete(listener);
+}
+
+function _publishLiveSession(session) {
+    for (const listener of [..._liveSessionSubscribers]) {
+        try { listener(session); } catch { /* observers never affect persistence */ }
+    }
+}
+
 function _runSessionPurgeHooks(id) {
     for (const hook of _sessionPurgeHooks) {
         try { hook(id); } catch { /* a cleanup hook never breaks delete */ }
@@ -318,7 +337,10 @@ export function saveSession(session, opts) {
     // summary row. The write itself still travels the normal path, where the
     // strict under-lock admission refuses it and produces the established
     // outcome/markers — only the local "owned" caches are never touched.
-    if (!refusal) setLiveSession(session);
+    if (!refusal) {
+        setLiveSession(session);
+        _publishLiveSession(session);
+    }
     const summaryVersion = refusal ? null : _cacheSessionSummary(session);
     // Identity of THIS attempt: only a landed save at least this new may clear
     // the id's failure/drop markers (see live-state _clearSaveStateIfCurrent),

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool-cwd-env.test.mjs

@@ -0,0 +1,14 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildShellSpawnEnv } from './bash-tool.mjs';
+
+test('shell child receives the caller session cwd without mutating the daemon env', () => {
+  const base = {
+    PATH: process.env.PATH || '',
+    MIXDOG_SESSION_CWD: 'C:\\wrong-session',
+  };
+  const env = buildShellSpawnEnv('C:\\Project\\mixdog', base);
+  assert.equal(env.MIXDOG_SESSION_CWD, 'C:\\Project\\mixdog');
+  assert.equal(base.MIXDOG_SESSION_CWD, 'C:\\wrong-session');
+});

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -401,6 +401,24 @@ const ARTIFACT_RETRY_ATTEMPTS = 10;
 const PENDING_ARTIFACT_PATHS = new Set();
 let artifactExitHookInstalled = false;
 
+export function buildShellSpawnEnv(cwd, baseEnv = process.env) {
+    const spawnEnv = {
+        ...baseEnv,
+        LANG: 'C.UTF-8',
+        LC_ALL: 'C.UTF-8',
+        MIXDOG_SESSION_CWD: String(cwd || ''),
+    };
+    if (process.platform === 'win32') {
+        if (spawnEnv.PYTHONUTF8 === undefined) spawnEnv.PYTHONUTF8 = '1';
+        if (spawnEnv.PYTHONIOENCODING === undefined) spawnEnv.PYTHONIOENCODING = 'utf-8';
+    }
+    scrubProviderSecrets(spawnEnv);
+    scrubLoaderVars(spawnEnv);
+    scrubRuntimeRootVars(spawnEnv);
+    applyShellEgressPolicy(spawnEnv);
+    return spawnEnv;
+}
+
 function removeTransportFile(file) {
     try {
         unlinkSync(file);
@@ -661,16 +679,7 @@ export async function executeBashTool(args, workDir, options = {}) {
 
     try {
         const { shell, shellArg, shellArgs, shellType } = resolvedSpec;
-        const spawnEnv = { ...process.env, LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' };
-        if (process.platform === 'win32') {
-            if (spawnEnv.PYTHONUTF8 === undefined) spawnEnv.PYTHONUTF8 = '1';
-            if (spawnEnv.PYTHONIOENCODING === undefined) spawnEnv.PYTHONIOENCODING = 'utf-8';
-        }
-        // R5/R11: same scrub as background/persistent spawn sites (env-scrub.mjs).
-        scrubProviderSecrets(spawnEnv);
-        scrubLoaderVars(spawnEnv);
-        scrubRuntimeRootVars(spawnEnv);
-        applyShellEgressPolicy(spawnEnv);
+        const spawnEnv = buildShellSpawnEnv(bashWorkDir);
         let wrappedCommand;
         let execScript = null;
         let _teePlan = null;