mixdog 0.9.151 → 0.9.153

package/src/agents/security/AGENT.md

@@ -0,0 +1,14 @@
+---
+name: Security
+description: Use for security audits, threat and risk reviews, vulnerability analysis, or explicitly requested security hardening.
+---
+
+Own the assigned security analysis or hardening task.
+
+Trace the relevant attack surface, trust boundaries, permissions, inputs, and
+data flow. Base every finding on concrete evidence and distinguish confirmed
+vulnerabilities from residual risk. Do not modify files during an audit unless
+the brief explicitly requests remediation.
+
+Report severity, exploitability, evidence with `file:line`, impact, and the
+smallest actionable recommendation. Avoid speculation and exaggerated claims.

package/src/agents/security/agent.json

@@ -0,0 +1,6 @@
+{
+  "id": "security",
+  "name": "Security",
+  "description": "Use for security audits, threat and risk reviews, vulnerability analysis, or explicitly requested security hardening.",
+  "entry": "AGENT.md"
+}

package/src/agents/worker/AGENT.md

@@ -1,16 +1,16 @@
 ---
-permission: read-write
+name: Worker
+description: Default implementation agent. Use for implementation work unless a specialized agent is clearly more appropriate.
 ---
 
-# Worker
 Scoped implementation agent.
 
-Own only the bounded responsibility assigned in the brief. Trust its
-`file:line` anchors; do only minimal targeted discovery, then make the
-smallest coherent patch. No drive-by cleanup or scope expansion.
+Implement the assigned task directly. Keep changes focused on the requested
+outcome, follow exact constraints and established project patterns, and avoid
+unrelated cleanup or redesign.
 
-EDIT-FIRST DISCIPLINE. Patch promptly rather than repeating read-only turns;
-stop and report blocked when the assigned scope cannot be completed.
+When blocked, stop at the first concrete boundary and report the blocker with
+the relevant `file:line`.
 
-Patch and report the changed `file:line`; verification belongs to the Lead and Reviewer.
+Hand off the completed outcome and changed `file:line`.
 

package/src/agents/worker/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "worker",
   "name": "Worker",
-  "description": "Use for simple, well-scoped tasks.",
+  "description": "Default implementation agent. Use for implementation work unless a specialized agent is clearly more appropriate.",
   "entry": "AGENT.md"
 }

package/src/agents/writer/AGENT.md

@@ -0,0 +1,14 @@
+---
+name: Writer
+description: Use for translation, editing, rewriting, tone alignment, and final-copy polishing.
+---
+
+Own the final text.
+
+Preserve meaning, facts, terminology, formatting, and intended audience while
+making the writing natural and consistent with the document's tone. Translate
+idiomatically rather than word-for-word.
+
+Do not invent facts, add commentary, or delegate the work. Return final copy
+only unless the brief explicitly assigns file edits; then hand off changed
+paths.

package/src/agents/writer/agent.json

@@ -0,0 +1,6 @@
+{
+  "id": "writer",
+  "name": "Writer",
+  "description": "Use for translation, editing, rewriting, tone alignment, and final-copy polishing.",
+  "entry": "AGENT.md"
+}

package/src/defaults/skills/setup/SKILL.md

@@ -15,7 +15,7 @@ description: Use this skill only to inspect or modify a Mixdog user's persisted
 
 - `<mixdogData>` 해석 순서: `MIXDOG_DATA_DIR` → `<MIXDOG_HOME|~/.mixdog>/data` (`src/runtime/shared/plugin-paths.mjs`)
 - 통합 config: `<mixdogData>/mixdog-config.json`
-- 프로젝트 config: `<cwd>/.mcp.json`, `<cwd>/.mixdog/skills/`, `<cwd>/.mixdog/hooks.json`
+- 프로젝트 config: `<cwd>/.mixdog/hooks.json`
 - TUI 명령 목록: `src/tui/app/slash-commands.mjs`
 - TUI 설정 허브: `/setting` (별칭 `/settings`, `/config`) → `src/tui/app/settings-picker.mjs`
 - Desktop 설정: `Ctrl+,` → General / Context / Output style / Providers / Git / Skills / MCP / Plugins / Hooks / Connection / System / Shortcuts / About
@@ -111,7 +111,8 @@ API 키·토큰·OAuth 자격은 config에 쓰지 않는다.
 1. **확인**: Desktop **Settings → General → Web search**, TUI `/setting → Web search`.
 2. **변경**: toggle → `setWebSearchEnabled()`.
 3. **저장**: `agent.modules.webSearch.enabled`.
-4. **검증**: 다음 세션의 tool surface.
+4. **검색 범위**: 전역 `<mixdogData>/skills/`와 활성 Plugin skill만 사용한다. Project `.mixdog/skills/`는 읽지 않는다.
+5. **검증**: 열린 runtime과 다음 세션의 tool surface.
 
 ### reasoning effort / Fast
 
@@ -263,18 +264,15 @@ TUI·Desktop interval 편집 UI는 없다.
 
 ### MCP 추가
 
-UI에는 서버 추가·삭제·전체 재연결 액션이 없다.
-
-1. **확인**: `/mcp` 또는 Desktop **Settings → MCP**, `mcpStatus()`, `<cwd>/.mcp.json`.
+1. **확인**: `/mcp` 또는 Desktop **Settings → MCP**, `mcpStatus()`, `agent.mcpServers`.
 2. **변경**:
-   - 전역: 디스크 `agent.mcpServers.<name>` 편집
-   - 프로젝트: `<cwd>/.mcp.json`의 `mcpServers` wrapper 또는 bare name map 편집
+   - Desktop: **Settings → MCP → Add**
+   - 디스크: `agent.mcpServers.<name>` 편집
    - API 자동화: `addMcpServer()`, `removeMcpServer()`, `reconnectMcp()`
 3. **transport**:
    - stdio: `type`, `command`, `args`, `cwd`, `env`
    - URL: `http`, `sse`, `ws`와 `url`, 선택 `headers`
-4. **제약**: API로 stdio를 추가할 때 `cwd`는 현재 프로젝트 아래여야 한다.
-5. **검증**: `connected`, `toolCount`, `source`, `transport`, `error`.
+4. **검증**: `connected`, `toolCount`, `transport`, `error`.
 
 파일을 직접 편집했다면 mixdog 재시작이 기본 적용 경로다.
 
@@ -282,17 +280,15 @@ UI에는 서버 추가·삭제·전체 재연결 액션이 없다.
 
 TUI `/mcp`와 Desktop MCP 모두 서버별 toggle을 지원하며 live connection과 세션 tool surface를 재동기화한다.
 
-- `source: project`: `<cwd>/.mcp.json` 항목의 `enabled`를 직접 저장
-- `source: config`: 서버 정의는 유지하고 현재 프로젝트용 override를 `agent.mcpProjectOverrides[normalizedCwd][name].enabled`에 저장
-- 즉, 전역 config 서버를 toggle해도 전역 `agent.mcpServers.<name>.enabled`를 바꾸지 않는다.
+- 서버 정의는 유지하고 `agent.mcpServers.<name>.enabled`를 전역으로 변경한다.
+- Project `.mcp.json`과 Project별 override는 읽지 않는다.
 - turn 실행 중 toggle은 turn 종료 경계에서 세션을 재생성한다.
 
 ### MCP 진단
 
-1. `/mcp`의 source/transport/error를 먼저 읽는다.
-2. 프로젝트와 전역 이름 충돌 시 `<cwd>/.mcp.json`이 우선한다.
-3. stdio는 command·args·cwd·자식 env, URL transport는 scheme·endpoint·headers·방화벽을 확인한다.
-4. `connected:true`와 기대 tool 노출로 검증한다.
+1. `/mcp`의 transport/error를 먼저 읽는다.
+2. stdio는 command·args·cwd·자식 env, URL transport는 scheme·endpoint·headers·방화벽을 확인한다.
+3. `connected:true`와 기대 tool 노출로 검증한다.
 
 ### Skills enable / disable
 
@@ -317,11 +313,11 @@ UI 생성 액션은 없다.
 
 1. **확인**: `/plugins` 또는 Desktop **Settings → Plugins**.
 2. **추가**: Git URL, `owner/repo`, 기존 local path → `addPlugin()`.
-3. **관리**: update/metadata refresh, plugin MCP enable/reconfigure, root/MCP name 복사, uninstall.
+3. **관리**: 전역 enable/disable, update/metadata refresh, plugin MCP enable/reconfigure, root/MCP name 복사, uninstall.
 4. **저장**: `<mixdogData>/plugins/registry.json`; managed Git checkout은 `<mixdogData>/plugins/installed/`.
 5. **검증**: `pluginsStatus()`, plugin skill 수, MCP server 노출.
 
-Plugins 화면에는 일반적인 “plugin 활성/비활성” toggle이 없다. MCP와 skill 활성 상태는 각각 MCP/Skills 화면에서 관리한다.
+Plugin toggle은 해당 Plugin의 Skills와 MCP를 전역으로 함께 활성화/비활성화한다. 개별 MCP와 Skill은 각 화면에서도 관리할 수 있다.
 
 ### Hooks
 
@@ -380,8 +376,8 @@ Discord/Telegram messaging은 제거됐다. schedules/webhooks 자동화와 voic
 
 1. **확인**: 상태줄 cwd, `/project`, Desktop rail **Projects**.
 2. **변경**: `/project [path]` 또는 picker. TUI picker는 등록·생성·rename도 지원한다.
-3. **적용**: cwd 변경 시 프로젝트 `.mcp.json`과 skills를 다시 읽고 MCP를 재연결한다.
-4. **검증**: cwd, `/mcp` source, `/skills` project 항목.
+3. **적용**: cwd 변경은 실행 경로만 바꾸며 전역 Skills·Plugins·MCP 상태는 유지한다.
+4. **검증**: cwd와 실행 경로.
 
 ### Git (Desktop 전용)
 
@@ -438,11 +434,6 @@ Desktop과 현재 runtime에서 소비되지 않는 아래 key는 사용자 옵
         "cwd": "<project-subdir>",
         "env": {}
       }
-    },
-    "mcpProjectOverrides": {
-      "<normalized-cwd>": {
-        "<name>": { "enabled": false }
-      }
     }
   }
 }
@@ -466,8 +457,8 @@ URL transport는 `type` + `url` + 선택 `headers`를 사용한다.
 
 ### 우선순위와 금지
 
-- MCP 이름 충돌: project `.mcp.json` > `agent.mcpServers`
-- Skill 이름 충돌: project > global > plugin
+- MCP는 전역 `agent.mcpServers`만 사용한다.
+- Skill 이름 충돌: global > plugin
 - `Mixdog.md` 자동 프롬프트 로드는 없다. skill/core memory를 사용한다.
 - 확인되지 않은 key는 추측하지 말고 TODO로 남긴다.
 - UI에 없는 runtime API를 사용자 UI처럼 설명하지 않는다.

package/src/headless-exec.mjs

@@ -23,17 +23,10 @@ function clean(value) {
 
 export async function prewarmHeadlessSearch(cwd, {
   loadNativeSearch = () => import('./runtime/agent/orchestrator/tools/builtin/native-search-client.mjs'),
-  loadListTool = () => import('./runtime/agent/orchestrator/tools/builtin/list-tool.mjs'),
 } = {}) {
-  const root = clean(cwd) || process.cwd();
-  const [nativeSearch, listTool] = await Promise.all([
-    loadNativeSearch(),
-    loadListTool(),
-  ]);
-  await Promise.all([
-    nativeSearch.warmNativeSearchServer(),
-    listTool.prewarmFindEnumeration(root),
-  ]);
+  void cwd;
+  const nativeSearch = await loadNativeSearch();
+  await nativeSearch.warmNativeSearchServer();
 }
 
 function nonNegativeNumber(value) {

package/src/headless-exec.test.mjs

@@ -9,7 +9,7 @@ import { prewarmHeadlessSearch, runHeadlessExec } from './headless-exec.mjs';
 import { resolveCursorOAuthAccessToken } from './runtime/agent/orchestrator/providers/cursor-auth.mjs';
 import { createPristineExecutionBoundary } from './runtime/shared/pristine-execution.mjs';
 
-test('headless search prewarm starts the native server and Project inventory together', async () => {
+test('headless search prewarm starts only the canonical native server', async () => {
   const calls = [];
   await prewarmHeadlessSearch('/app/project', {
     loadNativeSearch: async () => ({
@@ -18,13 +18,8 @@ test('headless search prewarm starts the native server and Project inventory tog
         return true;
       },
     }),
-    loadListTool: async () => ({
-      async prewarmFindEnumeration(root) {
-        calls.push(`index:${root}`);
-      },
-    }),
   });
-  assert.deepEqual(calls.sort(), ['index:/app/project', 'server']);
+  assert.deepEqual(calls, ['server']);
 });
 
 test('pristine headless execution binds Cursor OAuth credentials in process', async () => {

package/src/rules/agent/00-common.md

@@ -1,9 +1,6 @@
 # Public Agent Constraints
 
-- Use `git` only for read-only repository evidence. Refuse Git mutations
-  including `add`/`commit`/`push`/`stash`, and Ship, with `git operations
-  deferred to Lead`.
-- `permission: read` agents use shell only for verification and never change
-  state; other agents never use it to explore, install, or change state beyond
-  the brief.
-- Overflow goes to a file; hand off path + fragments.
+- Unless an agent's own `AGENT.md` explicitly assigns a review or verification
+  procedure, do not review or verify: skip builds, tests, lint, runtime checks,
+  and independent regression review. Complete the assigned role task and hand
+  off; Lead or an explicitly verification-assigned agent owns verification.

package/src/rules/lead/01-general.md

@@ -5,9 +5,6 @@
 - Before the first tool call, briefly state what you are about to do; add a
   short update when you find something load-bearing, change direction, or
   work a stretch without one. Do not use a colon before a tool call.
-- Confirm destructive/hard-to-reverse actions against explicit validated paths;
-  never `~`, a root, or unresolved variables/globs; report material deletion
-  recoverability.
 - Mid-task: replacement supersedes; addition folds in; status gets a brief
   answer while work continues. After compaction, resume the summary.
 - Periodic task reports stay in-turn: when `task wait` returns still-running,

package/src/rules/shared/10-tool-workflow.md

@@ -1,13 +1,21 @@
 # Tool Workflow
 
+- Confirm destructive/hard-to-reverse actions against explicit validated paths;
+  never `~`, a root, or unresolved variables/globs; report material deletion
+  recoverability.
 - Determine the required outcome and missing evidence; requirements are not
   evidence. Trust internal and framework guarantees.
 - Before exploration or implementation, consult prior work, current external
   information, or repository state only when needed to choose the next action.
   Start with the source most likely to decide it; consult another only if the
   result leaves the decision unresolved.
-- Minimize tool turns by batching only calls that are independently necessary
-  before the batch begins. A call whose necessity or scope can change after
+- Exhaust known work into the largest supported parameterized call before
+  issuing it. Do not split one tool's known targets or operations by item,
+  file, page, or operation type; split only when a prior result is needed to
+  determine later input or a documented tool limit requires another call.
+- Minimize model round-trips: when multiple calls are independently necessary
+  and every input is already known before the batch begins, issue them in the
+  same assistant turn. A call whose necessity or scope can change after
   another result waits for that result.
 - Respect tool/schema limits, never omit required fanout, and apply one analysis
   to many targets as one parameterized call when supported.

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -179,20 +179,128 @@ function maintenanceRouteToPreset(routeOrName, agent) {
     return out;
 }
 
+const AGENT_DISPATCH_LIVE_CALLBACKS = Object.freeze([
+    'onSessionStart',
+    'onStageChange',
+    'onReasoningDelta',
+    'onTextDelta',
+    'onTextReset',
+    'onAssistantText',
+    'onAssistantMessageCommitted',
+    'onToolCall',
+    'onToolResult',
+]);
+
+function pickDispatchCallback(factoryOpts, callArgs, name) {
+    if (typeof callArgs?.[name] === 'function') return callArgs[name];
+    if (typeof factoryOpts?.[name] === 'function') return factoryOpts[name];
+    return undefined;
+}
+
 /**
- * Build an agent-backed dispatch callback.
+ * Resolve live Agent-dispatch callbacks.
  *
- * @param {object} opts
- * @param {string} opts.agent       — REQUIRED; canonical agent name (worker, cycle1-agent, ...)
- * @param {string} [opts.taskType]  — optional internal classification stamped on the session
- * @param {string} [opts.preset]    — explicit preset override (bypasses agent → preset lookup)
- * @param {string} [opts.parentSessionId] — parent agent session for trace aggregation
- * @param {string|null} [opts.ownerSessionId] — owning Mixdog session for statusline isolation
- * @param {AbortSignal} [opts.parentSignal] — optional AbortSignal from the fan-out coordinator;
- *   when aborted the agent session's own controller is also aborted so the
- *   provider call tears down promptly (parent→child cascade).
- * @returns {(args: { prompt, preset?, sourceName? }) => Promise<string>}
+ * `liveProjection` is a send-opt. It is true when the caller explicitly
+ * sets it or supplies a live-text callback (onTextDelta / onAssistantText /
+ * onTextReset). Tool/stage/reasoning observers do not un-suppress provider
+ * streaming. The flag must never be written onto the session object.
+ *
+ * @param {object} [factoryOpts]
+ * @param {object} [callArgs]
+ * @returns {{ callbacks: object, liveProjection: boolean }}
+ */
+export function resolveAgentDispatchLiveCallbacks(factoryOpts = {}, callArgs = {}) {
+    const callbacks = {};
+    for (const name of AGENT_DISPATCH_LIVE_CALLBACKS) {
+        const fn = pickDispatchCallback(factoryOpts, callArgs, name);
+        if (fn) callbacks[name] = fn;
+    }
+    const liveProjection = factoryOpts.liveProjection === true
+        || callArgs.liveProjection === true
+        || typeof callbacks.onTextDelta === 'function'
+        || typeof callbacks.onAssistantText === 'function'
+        || typeof callbacks.onTextReset === 'function';
+    return { callbacks, liveProjection };
+}
+
+/**
+ * Adapt askSession's session-less callback signatures to the host contract
+ * by prepending the prepared session on every call:
+ *   onSessionStart(session)
+ *   onStageChange(session, stage, detail)
+ *   onReasoningDelta(session, chunk)
+ *   onTextDelta(session, chunk)
+ *   onTextReset(session, detail)  — return value is passed through unchanged
+ *   onAssistantText(session, text)
+ *   onAssistantMessageCommitted(session)
+ *   onToolCall(session, iteration, calls)
+ *   onToolResult(session, message)
+ */
+export function bindAgentDispatchHostCallbacks(hostCallbacks = {}, session) {
+    const bound = {};
+    if (typeof hostCallbacks.onSessionStart === 'function') {
+        bound.onSessionStart = () => hostCallbacks.onSessionStart(session);
+    }
+    if (typeof hostCallbacks.onStageChange === 'function') {
+        bound.onStageChange = (stage, detail) => hostCallbacks.onStageChange(session, stage, detail);
+    }
+    if (typeof hostCallbacks.onReasoningDelta === 'function') {
+        bound.onReasoningDelta = (chunk) => hostCallbacks.onReasoningDelta(session, chunk);
+    }
+    if (typeof hostCallbacks.onTextDelta === 'function') {
+        bound.onTextDelta = (chunk) => hostCallbacks.onTextDelta(session, chunk);
+    }
+    if (typeof hostCallbacks.onTextReset === 'function') {
+        bound.onTextReset = (detail) => hostCallbacks.onTextReset(session, detail);
+    }
+    if (typeof hostCallbacks.onAssistantText === 'function') {
+        bound.onAssistantText = (text) => hostCallbacks.onAssistantText(session, text);
+    }
+    if (typeof hostCallbacks.onAssistantMessageCommitted === 'function') {
+        bound.onAssistantMessageCommitted = () => hostCallbacks.onAssistantMessageCommitted(session);
+    }
+    if (typeof hostCallbacks.onToolCall === 'function') {
+        bound.onToolCall = (iteration, calls) => hostCallbacks.onToolCall(session, iteration, calls);
+    }
+    if (typeof hostCallbacks.onToolResult === 'function') {
+        bound.onToolResult = (message) => hostCallbacks.onToolResult(session, message);
+    }
+    return bound;
+}
+
+/**
+ * Build the positional `onToolCall` + askOpts bag forwarded to askSession.
+ * `interactiveSessionSurface` is intentionally dropped — that in-memory
+ * hint is owned by the standalone surface and must not be persisted or
+ * re-homed onto a dispatch session.
  */
+export function buildAgentDispatchAskSessionArgs(factoryOpts = {}, callArgs = {}, extraAskOpts = {}, session = null) {
+    const { callbacks, liveProjection } = resolveAgentDispatchLiveCallbacks(factoryOpts, callArgs);
+    const bound = session && typeof session === 'object'
+        ? bindAgentDispatchHostCallbacks(callbacks, session)
+        : callbacks;
+    const onToolCall = typeof bound.onToolCall === 'function' ? bound.onToolCall : null;
+    const askOpts = { liveProjection };
+    for (const name of AGENT_DISPATCH_LIVE_CALLBACKS) {
+        if (name === 'onToolCall') continue;
+        if (typeof bound[name] === 'function') askOpts[name] = bound[name];
+    }
+    const extraCompact = extraAskOpts.onCompactEvent;
+    if (typeof extraCompact === 'function') {
+        const callerCompact = askOpts.onCompactEvent;
+        askOpts.onCompactEvent = (event) => {
+            extraCompact(event);
+            try { callerCompact?.(event); } catch { /* best-effort */ }
+        };
+    }
+    for (const [key, value] of Object.entries(extraAskOpts)) {
+        if (key === 'onCompactEvent' || key === 'liveProjection') continue;
+        if (key === 'interactiveSessionSurface') continue;
+        if (value !== undefined) askOpts[key] = value;
+    }
+    return { onToolCall, askOpts };
+}
+
 // runtime-liveness keeps one parent link per session because askSession swaps
 // its controller at turn start.  Agent dispatch can have several independent
 // cancellation sources, so collapse them before installing that one link.
@@ -227,16 +335,59 @@ export function composeAgentDispatchAbortSignal(signals) {
     };
 }
 
+/**
+ * Build an agent-backed dispatch callback.
+ *
+ * @param {object} opts
+ * @param {string} opts.agent       — REQUIRED; canonical agent name (worker, cycle1-agent, ...)
+ * @param {string} [opts.taskType]  — optional internal classification stamped on the session
+ * @param {string} [opts.preset]    — explicit preset override (bypasses agent → preset lookup)
+ * @param {string} [opts.parentSessionId] — parent agent session for trace aggregation
+ * @param {string|null} [opts.ownerSessionId] — owning Mixdog session for statusline isolation
+ * @param {AbortSignal} [opts.parentSignal] — optional AbortSignal from the fan-out coordinator;
+ *   when aborted the agent session's own controller is also aborted so the
+ *   provider call tears down promptly (parent→child cascade).
+ * @param {boolean} [opts.liveProjection] — request provider onTextDelta / mid-turn
+ *   text for this Agent. Never persisted on the session.
+ * @param {function} [opts.onSessionStart]
+ * @param {function} [opts.onStageChange]
+ * @param {function} [opts.onReasoningDelta]
+ * @param {function} [opts.onTextDelta]
+ * @param {function} [opts.onTextReset] — must return `true` to ack a retry retraction
+ * @param {function} [opts.onAssistantText]
+ * @param {function} [opts.onAssistantMessageCommitted]
+ * @param {function} [opts.onToolCall]
+ * @param {function} [opts.onToolResult]
+ * @returns {(args: { prompt, preset?, sourceName?, liveProjection?, onSessionStart?, onStageChange?, onReasoningDelta?, onTextDelta?, onTextReset?, onAssistantText?, onAssistantMessageCommitted?, onToolCall?, onToolResult? }) => Promise<string>}
+ */
 export function makeAgentDispatch(opts = {}) {
     if (!opts.agent || typeof opts.agent !== 'string') {
         throw new Error('[agent-dispatch] opts.agent is required');
     }
     const agent = opts.agent;
 
-    return async function agentDispatch({ prompt, preset: presetArg, sourceName: sourceNameArg, parentSignal: callParentSignal, idleTimeoutMs: callIdleTimeoutMs, cwd: callCwd, sessionId: callSessionId }) {
+    return async function agentDispatch(callArgs = {}) {
+        const {
+            prompt,
+            preset: presetArg,
+            sourceName: sourceNameArg,
+            parentSignal: callParentSignal,
+            idleTimeoutMs: callIdleTimeoutMs,
+            cwd: callCwd,
+            sessionId: callSessionId,
+        } = callArgs;
         if (typeof prompt !== 'string' || !prompt) {
             throw new Error(`[agent-dispatch] prompt required for agent "${agent}"`);
         }
+        const prepare = typeof opts.prepareAgentSession === 'function'
+            ? opts.prepareAgentSession
+            : prepareAgentSession;
+        const ask = typeof opts.askSession === 'function' ? opts.askSession : askSession;
+        const updateStatus = typeof opts.updateSessionStatus === 'function'
+            ? opts.updateSessionStatus
+            : updateSessionStatus;
+        const close = typeof opts.closeSession === 'function' ? opts.closeSession : closeSession;
+        const readSession = typeof opts.getSession === 'function' ? opts.getSession : getSession;
         const admission = opts.resourceAdmission || resourceAdmission;
         const admissionAbortLink = composeAgentDispatchAbortSignal([
             opts.parentSignal,
@@ -334,7 +485,7 @@ export function makeAgentDispatch(opts = {}) {
         // pooled or resumed. Cache prefix matching happens at the provider
         // layer (account-level), not the session level.
         const finalPrompt = prompt;
-        const { session } = prepareAgentSession({
+        const { session } = prepare({
             agent,
             presetName,
             preset,
@@ -359,7 +510,7 @@ export function makeAgentDispatch(opts = {}) {
             process.stderr.write(`[agent-dispatch] agent=${agent} tool-list (${_toolNames.length}): ${_toolNames.join(',')}\n`);
         } catch { /* best-effort diagnostic */ }
 
-        await updateSessionStatus(session.id, 'running');
+        await updateStatus(session.id, 'running');
         // Parent→child abort cascade: when opts.parentSignal (factory) or
         // callParentSignal (per-call) fires, abort the sub-session's own
         // controller so the provider call tears down promptly. Best-effort:
@@ -368,7 +519,7 @@ export function makeAgentDispatch(opts = {}) {
         const _linkSignal = _managerMod?.linkParentSignalToSession;
         const _getProgressSnapshot = _managerMod?.getSessionProgressSnapshot;
         const _getLastProgressAt = _managerMod?.getSessionLastProgressAt;
-        const _getSession = _managerMod?.getSession || getSession;
+        const _getSession = _managerMod?.getSession || readSession;
         // Watchdog policy is split:
         // - firstResponseTimeoutMs cuts quickly only when the model produces no
         //   first stream/tool activity at all.
@@ -442,12 +593,13 @@ export function makeAgentDispatch(opts = {}) {
             : null;
         if (_idleTimer && typeof _idleTimer.unref === 'function') _idleTimer.unref();
         let terminalStatus = 'idle';
+        let closeReason = 'ephemeral-done';
         process.stderr.write(`[agent-dispatch] agent=${agent} preset=${presetName} model=${preset.model} provider=${preset.provider} session=${session.id}\n`);
         const _agentDispatchT0 = Date.now();
         let _handoffMsgStart = 0;
         try {
-            _handoffMsgStart = resolveHandoffMessageStartIndex(getSession(session.id));
-            const result = await askSession(session.id, finalPrompt, null, null, cwd, undefined, {
+            _handoffMsgStart = resolveHandoffMessageStartIndex(readSession(session.id));
+            const { onToolCall, askOpts } = buildAgentDispatchAskSessionArgs(opts, callArgs, {
                 onCompactEvent: (event) => {
                     try {
                         const label = agentCompactEventLabel(event);
@@ -458,7 +610,10 @@ export function makeAgentDispatch(opts = {}) {
                         );
                     } catch { /* best-effort compact visibility */ }
                 },
-            });
+            }, session);
+            // liveProjection is a send-opt on askOpts only. Do not stamp it
+            // (or interactiveSessionSurface) onto `session`.
+            const result = await ask(session.id, finalPrompt, null, onToolCall, cwd, undefined, askOpts);
             process.stderr.write(`[agent-dispatch] agent=${agent} session=${session.id} elapsed=${Date.now() - _agentDispatchT0}ms\n`);
             const raw = result?.content || '';
             // Brief cap. Agent role answers (recall/search)
@@ -468,25 +623,23 @@ export function makeAgentDispatch(opts = {}) {
             // majority of answers untouched. Opt-out via `brief:false` when
             // the caller explicitly wants the full synthesis.
             if (opts.brief === false) {
-                try { closeSession(session.id, 'ephemeral-done'); } catch { /* ignore */ }
                 return raw;
             }
             const out = applyBriefCap(raw);
-            try { closeSession(session.id, 'ephemeral-done'); } catch { /* ignore */ }
             return out;
         } catch (err) {
-            const partial = watchdogPartialHandoffFromError(err, getSession(session.id), _handoffMsgStart)
+            terminalStatus = 'error';
+            closeReason = 'ephemeral-error';
+            const partial = watchdogPartialHandoffFromError(err, readSession(session.id), _handoffMsgStart)
                 ?? (salvagePartialRequested(err, _abortLink?.signal)
-                    ? partialHandoffTextFromSession(getSession(session.id), _handoffMsgStart)
+                    ? partialHandoffTextFromSession(readSession(session.id), _handoffMsgStart)
                     : null);
             if (partial) {
                 terminalStatus = 'idle';
-                try { closeSession(session.id, 'ephemeral-done'); } catch { /* ignore */ }
+                closeReason = 'ephemeral-done';
                 if (opts.brief === false) return partial;
                 return applyBriefCap(partial);
             }
-            terminalStatus = 'error';
-            try { closeSession(session.id, 'ephemeral-error'); } catch { /* ignore */ }
             throw err;
         } finally {
             _abortLink.dispose();
@@ -496,7 +649,11 @@ export function makeAgentDispatch(opts = {}) {
             // Always flip out of 'running' before returning so the sweep never
             // leaves a stateless Pool C session stuck in 'running' when the
             // try/catch falls through in unexpected ways.
-            try { await updateSessionStatus(session.id, terminalStatus); } catch { /* ignore */ }
+            try { await updateStatus(session.id, terminalStatus); } catch { /* ignore */ }
+            // closeSession plants a tombstone, after which status writes are
+            // rejected. Publish the terminal projection before closing so
+            // live Agent panes cannot retain their preceding busy:true state.
+            try { close(session.id, closeReason); } catch { /* ignore */ }
         }
         });
         } finally {