mixdog 0.9.151 → 0.9.153

package/src/runtime/shared/turn-snapshot.mjs

@@ -89,6 +89,7 @@ function createDiffTracker(meta = {}) {
   return {
     ownerSessionId: clean(meta.ownerSessionId) || null,
     ownerGeneration: Number(meta.ownerGeneration) || 0,
+    checkpointId: clean(meta.checkpointId),
     worktreeRequest: clean(meta.worktreeRequest),
     worktreeContended: false,
     valid: true,
@@ -445,20 +446,26 @@ function publicAgentReviews(sessionId) {
 }
 
 /** Start a new user turn and invalidate the prior turn's child review group. */
-export async function beginTurnSnapshot(_worktree, sessionId) {
+export async function beginTurnSnapshot(_worktree, sessionId, options = {}) {
   const ownerSessionId = clean(sessionId);
   if (DISABLED || !ownerSessionId) return;
   const generation = (_turnsBySession.get(ownerSessionId)?.generation || 0) + 1;
+  const checkpointId = clean(options?.checkpointId);
   for (const [trackedSessionId, tracker] of _diffTrackersBySession) {
     if (tracker.ownerSessionId === ownerSessionId) _diffTrackersBySession.delete(trackedSessionId);
   }
   _turnsBySession.delete(ownerSessionId);
   _turnsBySession.set(ownerSessionId, {
     generation,
+    checkpointId,
     agents: new Map(),
   });
   const worktreeRequest = pathKey(_worktree);
-  const tracker = resetDiffTracker(ownerSessionId, { worktreeRequest });
+  const tracker = resetDiffTracker(ownerSessionId, {
+    ownerGeneration: generation,
+    checkpointId,
+    worktreeRequest,
+  });
   trimTurnCache();
   if (!tracker) return;
   for (const [otherSessionId, other] of _diffTrackersBySession) {
@@ -575,6 +582,7 @@ async function persistTurnSnapshotRecord(ownerSessionId, tracker) {
   try {
     await saveTurnSnapshotRecord(ownerSessionId, {
       generation: _turnsBySession.get(ownerSessionId)?.generation || 0,
+      checkpointId: tracker.checkpointId,
       root: snapshot.root,
       baselineTree: snapshot.baselineTree,
       toolFiles: owned,
@@ -669,6 +677,7 @@ async function scopedReviewFromRecord(ownerSessionId) {
     patch: resumed.snapshot.patch || '',
     snapshotKind: 'scoped',
     revertMode: 'scoped',
+    checkpointId: clean(resumed.record.checkpointId),
     patchTruncated: resumed.snapshot.patchTruncated === true,
     authoritative: true,
     agents: publicAgentReviews(ownerSessionId),
@@ -677,9 +686,20 @@ async function scopedReviewFromRecord(ownerSessionId) {
 }
 
 /** Restore recorded paths — every one of them, or just the file the user picked. */
-async function revertFromRecord(worktree, ownerSessionId, file) {
+function assertCheckpointMatches(expectedCheckpointId, actualCheckpointId) {
+  const expected = clean(expectedCheckpointId);
+  if (!expected) return;
+  const actual = clean(actualCheckpointId);
+  if (!actual) throw new Error('turn review checkpoint is unavailable');
+  if (actual !== expected) {
+    throw new Error('turn review checkpoint changed; refresh the review');
+  }
+}
+
+async function revertFromRecord(worktree, ownerSessionId, file, expectedCheckpointId = '') {
   const resumed = await resumeRecordedSnapshot(ownerSessionId);
   if (!resumed) return null;
+  assertCheckpointMatches(expectedCheckpointId, resumed.record.checkpointId);
   const owned = resumed.record.toolFiles;
   const targets = file
     ? owned.filter((path) => recordedPathMatchesFile(path, resumed.record.root, file))
@@ -723,6 +743,7 @@ export async function getTurnReviewDiff(_worktree, sessionId, options = {}) {
     patch: snapshot?.patch ?? tracker?.unifiedDiff ?? '',
     snapshotKind: snapshot ? 'worktree' : 'tool',
     revertMode: snapshot ? 'worktree' : trackedRevertAvailable ? 'tracked' : '',
+    checkpointId: clean(turn?.checkpointId || tracker?.checkpointId),
     patchTruncated: snapshot?.patchTruncated === true,
     authoritative: Boolean(turn && tracker),
     agents: publicAgentReviews(ownerSessionId),
@@ -738,9 +759,10 @@ function unavailableTrackedRevertReason(tracker) {
 }
 
 /** Restore one reviewed file to this turn's worktree baseline, never to HEAD. */
-export async function revertTurnReviewFile(_worktree, sessionId, file) {
+export async function revertTurnReviewFile(_worktree, sessionId, file, expectedCheckpointId = '') {
   const ownerSessionId = clean(sessionId);
   const tracker = _diffTrackersBySession.get(ownerSessionId);
+  if (tracker) assertCheckpointMatches(expectedCheckpointId, tracker.checkpointId);
   if (tracker && !worktreeSnapshotUsable(tracker)) {
     const pairs = trackedPairs(tracker);
     if (pairs.length > 0) {
@@ -749,7 +771,7 @@ export async function revertTurnReviewFile(_worktree, sessionId, file) {
       await revertTrackedPairs(tracker, _worktree, [pair]);
       return await getTurnReviewDiff(_worktree, ownerSessionId);
     }
-    const recorded = await revertFromRecord(_worktree, ownerSessionId, file);
+    const recorded = await revertFromRecord(_worktree, ownerSessionId, file, expectedCheckpointId);
     if (recorded) return recorded;
     throw new Error(unavailableTrackedRevertReason(tracker));
   }
@@ -757,22 +779,23 @@ export async function revertTurnReviewFile(_worktree, sessionId, file) {
     await revertTurnWorktreeFile(tracker.worktreeSnapshot, file);
     return await getTurnReviewDiff(_worktree, ownerSessionId);
   }
-  const recorded = await revertFromRecord(_worktree, ownerSessionId, file);
+  const recorded = await revertFromRecord(_worktree, ownerSessionId, file, expectedCheckpointId);
   if (recorded) return recorded;
   throw new Error('turn worktree snapshot is unavailable');
 }
 
 /** Restore every file in the reviewed turn to its turn-start state. */
-export async function revertTurnReview(_worktree, sessionId) {
+export async function revertTurnReview(_worktree, sessionId, expectedCheckpointId = '') {
   const ownerSessionId = clean(sessionId);
   const tracker = _diffTrackersBySession.get(ownerSessionId);
+  if (tracker) assertCheckpointMatches(expectedCheckpointId, tracker.checkpointId);
   if (tracker && !worktreeSnapshotUsable(tracker)) {
     const pairs = trackedPairs(tracker);
     if (pairs.length > 0) {
       await revertTrackedPairs(tracker, _worktree, pairs);
       return await getTurnReviewDiff(_worktree, ownerSessionId);
     }
-    const recorded = await revertFromRecord(_worktree, ownerSessionId, null);
+    const recorded = await revertFromRecord(_worktree, ownerSessionId, null, expectedCheckpointId);
     if (recorded) return recorded;
     throw new Error(unavailableTrackedRevertReason(tracker));
   }
@@ -780,7 +803,7 @@ export async function revertTurnReview(_worktree, sessionId) {
     await revertTurnWorktreeSnapshot(tracker.worktreeSnapshot);
     return await getTurnReviewDiff(_worktree, ownerSessionId);
   }
-  const recorded = await revertFromRecord(_worktree, ownerSessionId, null);
+  const recorded = await revertFromRecord(_worktree, ownerSessionId, null, expectedCheckpointId);
   if (recorded) return recorded;
   throw new Error('turn worktree snapshot is unavailable');
 }

package/src/runtime/shared/user-cwd.mjs

@@ -6,15 +6,13 @@
  */
 
 /**
- * user-cwd.mjs — shared helper to resolve the user's working directory
- * from the persisted user-cwd.txt sentinel file, with an optional
- * session-cwd override (process.env.MIXDOG_SESSION_CWD) that takes
- * precedence when set.
+ * user-cwd.mjs — shared helper to resolve the user's working directory.
+ * Inline runtimes use AsyncLocalStorage; an inherited
+ * MIXDOG_SESSION_CWD remains only a boot/isolated-process fallback.
  *
  * Single-source-of-truth model:
- *   - captureOriginalUserCwd() reads MIXDOG_SESSION_CWD first (if set
- *     to a valid directory), otherwise user-cwd.txt fresh on every
- *     call. No in-memory freeze.
+ *   - captureOriginalUserCwd() reads the async session scope first, then
+ *     MIXDOG_SESSION_CWD/user-cwd.txt fresh on every call.
  *   - rawUserCwd() reads ONLY user-cwd.txt (no env consult) — exposed
  *     for the cwd-tool auto-init path so the env-var fallback cannot
  *     become self-referential.
@@ -32,6 +30,12 @@ import { resolvePluginData, mixdogRoot } from './plugin-paths.mjs'
 
 const _cwdOverride = new AsyncLocalStorage()
 
+function _activeCwdOverride() {
+  const store = _cwdOverride.getStore()
+  if (typeof store === 'string') return store
+  return store && typeof store.cwd === 'string' ? store.cwd : null
+}
+
 function _dataFile(name) {
   return join(resolvePluginData(), name)
 }
@@ -75,10 +79,9 @@ function _normalizePlatformCwd(p) {
 
 /**
  * Resolve the session cwd from EXPLICIT signals only:
- *   1. process.env.MIXDOG_SESSION_CWD — session-level override set via
- *      the `cwd` MCP tool. Honoured only when non-empty AND the resolved
- *      directory actually exists.
- *   2. user-cwd.txt — single source of truth maintained by Mixdog
+ *   1. AsyncLocalStorage — current inline-session scope.
+ *   2. process.env.MIXDOG_SESSION_CWD — boot/isolated-process override.
+ *   3. user-cwd.txt — persisted fallback maintained by Mixdog
  *      (rewritten at every session start).
  * Returns null when neither is available.
  *
@@ -89,6 +92,8 @@ function _normalizePlatformCwd(p) {
  * project_id resolution; use pwd() for relative-path resolution.
  */
 export function explicitSessionCwd() {
+  const scoped = _activeCwdOverride()
+  if (scoped) return scoped
   const sessionRaw = process.env.MIXDOG_SESSION_CWD
   if (typeof sessionRaw === 'string' && sessionRaw.length > 0) {
     const normalized = _normalizePlatformCwd(sessionRaw)
@@ -208,8 +213,22 @@ export function readLastSessionCwd(keyPid) {
  * Run fn inside an async context where pwd() returns cwd.
  * All descendant async calls within fn see cwd as their working directory.
  */
-function runWithCwdOverride(cwd, fn) {
-  return _cwdOverride.run(cwd, fn)
+export function runWithCwdOverride(cwd, fn) {
+  const normalized = _normalizePlatformCwd(cwd)
+  return _cwdOverride.run({ cwd: normalized || String(cwd || '') }, fn)
+}
+
+/**
+ * Retarget the current async session after an in-turn `cwd set`.
+ * Other concurrent sessions hold different AsyncLocalStorage records.
+ */
+export function updateCurrentCwdOverride(cwd) {
+  const store = _cwdOverride.getStore()
+  if (!store || typeof store !== 'object') return false
+  const normalized = _normalizePlatformCwd(cwd)
+  if (!normalized) return false
+  store.cwd = normalized
+  return true
 }
 
 /**
@@ -217,5 +236,5 @@ function runWithCwdOverride(cwd, fn) {
  *   override set by runWithCwdOverride (innermost wins) ?? original user cwd.
  */
 export function pwd() {
-  return _cwdOverride.getStore() ?? captureOriginalUserCwd()
+  return _activeCwdOverride() ?? captureOriginalUserCwd()
 }

package/src/runtime/shared/user-cwd.test.mjs

@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import {
+  explicitSessionCwd,
+  pwd,
+  runWithCwdOverride,
+  updateCurrentCwdOverride,
+} from './user-cwd.mjs';
+
+test('cwd overrides stay isolated across concurrent inline sessions', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'mixdog-user-cwd-'));
+  const a = join(root, 'a');
+  const b = join(root, 'b');
+  const next = join(root, 'next');
+  mkdirSync(a);
+  mkdirSync(b);
+  mkdirSync(next);
+  try {
+    await Promise.all([
+      runWithCwdOverride(a, async () => {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+        assert.equal(pwd(), a);
+        assert.equal(explicitSessionCwd(), a);
+        assert.equal(updateCurrentCwdOverride(next), true);
+        await new Promise((resolve) => setImmediate(resolve));
+        assert.equal(pwd(), next);
+        assert.equal(explicitSessionCwd(), next);
+      }),
+      runWithCwdOverride(b, async () => {
+        assert.equal(pwd(), b);
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        assert.equal(pwd(), b);
+        assert.equal(explicitSessionCwd(), b);
+      }),
+    ]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});

package/src/session-runtime/agent-disable.test.mjs

@@ -4,16 +4,18 @@
 // that still means "follow the Main Model" when left unset.
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import {
+  DEFAULT_DISABLED_AGENT_IDS,
   canonicalizeAgentRouteStorage,
   disabledAgentIds,
   isAgentDisabled,
   withAgentDisabled,
 } from '../runtime/shared/agent-route-config.mjs';
+import { buildDefaultConfig } from '../runtime/agent/orchestrator/config.mjs';
 import {
   createWorkflowHelpers,
   isDefaultWebSearchRouteConfig,
@@ -43,6 +45,23 @@ function fixture(agentIds = ['worker', 'reviewer']) {
   return { root, data, helpers };
 }
 
+test('fresh installs ship every starter Agent disabled with a complete definition', () => {
+  const defaults = buildDefaultConfig({ detectCredentials: false });
+  assert.deepEqual(disabledAgentIds(defaults), [...DEFAULT_DISABLED_AGENT_IDS].sort());
+
+  const agentsRoot = join(process.cwd(), 'src', 'agents');
+  for (const id of DEFAULT_DISABLED_AGENT_IDS) {
+    const manifestPath = join(agentsRoot, id, 'agent.json');
+    const rulesPath = join(agentsRoot, id, 'AGENT.md');
+    assert.equal(existsSync(manifestPath), true, `${id} manifest must ship`);
+    assert.equal(existsSync(rulesPath), true, `${id} rules must ship`);
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    assert.equal(manifest.id, id);
+    assert.ok(String(manifest.description || '').trim(), `${id} description must be non-empty`);
+    assert.ok(readFileSync(rulesPath, 'utf8').trim(), `${id} rules must be non-empty`);
+  }
+});
+
 test('disabled agents are stored apart from the route and survive canonicalization', () => {
   const config = { agents: { worker: { provider: 'anthropic-oauth', model: 'claude-opus-5' } } };
   const off = canonicalizeAgentRouteStorage(withAgentDisabled(config, 'worker', true));

package/src/session-runtime/context-status.mjs

@@ -11,6 +11,7 @@ import {
 import { SUMMARY_PREFIX } from '../runtime/agent/orchestrator/session/compact.mjs';
 import { hasUserConversationMessage } from '../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
 import {
+  resolveContextUsageSnapshot,
   resolveGaugeContextTokens,
   resolveWorkerCompactPolicy,
 } from '../runtime/agent/orchestrator/session/loop/compact-policy.mjs';
@@ -115,6 +116,7 @@ export function createContextStatus({
       compactionTriggerTokens: Number(compaction.triggerTokens || 0),
       compactionLastChangedAt: Number(compaction.lastChangedAt || 0),
       compactionLastCompactAt: Number(compaction.lastCompactAt || 0),
+      contextUsageSnapshot: session?.contextUsageSnapshot || null,
     };
   }
 
@@ -268,9 +270,13 @@ export function createContextStatus({
         ...resolveSessionCompactPolicy(session || {}, compactBoundaryTokens),
         tokenCalibration: providerTokenCalibration(session?.provider || route.provider),
       };
-    // One canonical numerator drives the gauge, proactive compaction, and
-    // telemetry: provider usage plus only the growth after its aligned prefix.
-    const usedTokens = resolveGaugeContextTokens(
+    // A successful compaction publishes one durable post-mutation reading.
+    // Polling and cold resume keep that exact value until a fresh provider
+    // baseline or a changed transcript/route/tool surface invalidates it.
+    const usageSnapshot = (!lastContextTokens || lastUsageStale)
+      ? resolveContextUsageSnapshot(session, compactPolicy, { messages })
+      : null;
+    const usedTokens = usageSnapshot?.usedTokens ?? resolveGaugeContextTokens(
       messageSummary.estimatedTokens,
       compactPolicy,
       { messages, sessionRef: session },

package/src/session-runtime/cwd-plugins.mjs

@@ -1,6 +1,7 @@
 import { discoverPluginMcp } from './plugin-mcp.mjs';
 import { featureEnvOverride, memoryToolsEnabled } from './config-helpers.mjs';
 import { readSessionCoreMemoryPayload } from '../runtime/memory/lib/core-memory-file.mjs';
+import { saveSession } from '../runtime/agent/orchestrator/session/store.mjs';
 
 // cwd-plugins.mjs — cwd resolution/apply + plugins-status + core-memory context,
 // extracted from mixdog-session-runtime.mjs. Dependency-injected factory that
@@ -15,16 +16,14 @@ export function createCwdPlugins({
   setCurrentCwd,
   getConfig,
   getSession,
+  getDesktopSession,
+  setDesktopSession,
   getRoute,
-  getLastProjectMcpKey,
-  setLastProjectMcpKey,
   isCodeGraphPrewarmLazy,
   isCodeGraphFirstTurnPrewarmDone,
   getCodeGraphPrewarmDelayMs,
   setSessionNeedsCwdRefresh,
   // callbacks / deps
-  connectConfiguredMcp,
-  invalidatePreSessionToolSurface,
   scheduleCodeGraphPrewarm,
   hooks,
   hookCommonPayload,
@@ -37,8 +36,9 @@ export function createCwdPlugins({
   pluginMcpServerName,
   mcpScriptForPlugin,
   countSkillFiles,
-  readProjectMcpServers,
   writeLastSessionCwd,
+  updateCurrentCwdOverride,
+  persistSession = (session) => saveSession(session, { immediate: true }),
   // shared utils
   clean,
   resolve,
@@ -98,17 +98,31 @@ export function createCwdPlugins({
     return next;
   }
 
-  function applyResolvedCwd(nextCwd, { markRefresh = true, waitForMcpReset = false } = {}) {
+  function applyResolvedCwd(nextCwd, {
+    markRefresh = true,
+    waitForMcpReset = false,
+    persistProjectSelection = false,
+  } = {}) {
     const resolved = resolve(nextCwd);
     const stat = statSync(resolved);
     if (!stat.isDirectory()) throw new Error(`cwd: not a directory: ${resolved}`);
     const changed = resolve(getCurrentCwd()) !== resolved;
     setCurrentCwd(resolved);
     const currentCwd = resolved;
-    process.env.MIXDOG_SESSION_CWD = currentCwd;
-    writeLastSessionCwd(currentCwd);
     const session = getSession();
     if (session) session.cwd = currentCwd;
+    updateCurrentCwdOverride?.(currentCwd);
+    writeLastSessionCwd(currentCwd, session?.clientHostPid);
+    if (persistProjectSelection && session) {
+      const desktop = getDesktopSession?.() || session.desktopSession;
+      if (desktop && typeof desktop === 'object') {
+        const nextDesktop = { classification: 'project', projectPath: currentCwd };
+        setDesktopSession?.(nextDesktop);
+        session.desktopSession = nextDesktop;
+      }
+      session.updatedAt = Date.now();
+      persistSession(session);
+    }
     // cwd changes NEVER recreate the session: a mid-conversation cwd switch must
     // preserve the full message history. We retarget the live execution cwd in
     // place; the BP3 session snapshot remains the session-start environment.
@@ -125,29 +139,14 @@ export function createCwdPlugins({
       const delay = getCodeGraphPrewarmDelayMs();
       scheduleCodeGraphPrewarm(changed ? 0 : delay, changed ? 'cwd-change' : 'cwd');
     }
-    // Project-local `.mcp.json` follows the cwd. Ordinary in-session cwd changes
-    // reconnect in the background, while desktop context replacement requests
-    // an awaitable reset so the next session/turn cannot observe the old registry.
-    let mcpReset = null;
-    if (changed) {
-      try {
-        const nextKey = resolved + '\u0000' + JSON.stringify(readProjectMcpServers(resolved));
-        if (nextKey !== getLastProjectMcpKey()) {
-          setLastProjectMcpKey(nextKey);
-          mcpReset = Promise.resolve(connectConfiguredMcp({ reset: true }))
-            .then(() => invalidatePreSessionToolSurface())
-            .catch(() => {});
-        }
-      } catch {}
-    }
+    // Extension settings are global; cwd changes never reload MCP or Skills.
+    void waitForMcpReset;
     // CwdChanged: bridge an effective cwd switch to the standard hook bus.
     // No matcher event — payload is minimal { cwd }. Fire-and-forget.
     if (changed) {
       try { void hooks.dispatch('CwdChanged', hookCommonPayload({ cwd: currentCwd })); } catch {}
     }
-    return waitForMcpReset
-      ? Promise.resolve(mcpReset).then(() => currentCwd)
-      : currentCwd;
+    return currentCwd;
   }
 
   async function refreshSessionForCwdIfNeeded(reason = 'cwd-change') {
@@ -183,6 +182,7 @@ export function createCwdPlugins({
         sourceUrl: clean(entry.source),
         sourceType: clean(entry.sourceType) || 'git',
         managed: entry.managed !== false,
+        enabled: entry.enabled !== false,
         root,
         installedAt: entry.installedAt || null,
         updatedAt: entry.updatedAt || null,

package/src/session-runtime/cwd-plugins.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { resolve, join } from 'node:path';
+import test from 'node:test';
+
+import { createCwdPlugins } from './cwd-plugins.mjs';
+
+test('explicit cwd selection persists execution cwd and desktop project metadata together', () => {
+  const root = mkdtempSync(join(tmpdir(), 'mixdog-cwd-persist-'));
+  const before = join(root, 'before');
+  const after = join(root, 'after');
+  mkdirSync(before);
+  mkdirSync(after);
+  let currentCwd = before;
+  let desktopSession = { classification: 'project', projectPath: before };
+  const session = {
+    id: 'sess-cwd-persist',
+    cwd: before,
+    desktopSession,
+    clientHostPid: 4321,
+  };
+  const persisted = [];
+  const sentinels = [];
+  const overrides = [];
+  try {
+    const { applyResolvedCwd } = createCwdPlugins({
+      getCurrentCwd: () => currentCwd,
+      setCurrentCwd: (next) => { currentCwd = next; },
+      getConfig: () => ({}),
+      getSession: () => session,
+      getDesktopSession: () => desktopSession,
+      setDesktopSession: (next) => { desktopSession = next; },
+      getRoute: () => ({}),
+      isCodeGraphPrewarmLazy: () => true,
+      isCodeGraphFirstTurnPrewarmDone: () => false,
+      getCodeGraphPrewarmDelayMs: () => 0,
+      setSessionNeedsCwdRefresh: () => {},
+      scheduleCodeGraphPrewarm: () => {},
+      hooks: { dispatch: async () => {} },
+      hookCommonPayload: (value) => value,
+      bootProfile: () => {},
+      getMemoryModule: async () => null,
+      listRegisteredPlugins: () => [],
+      pluginAdminStatus: () => ({}),
+      pluginManifest: () => ({}),
+      pluginMcpServerName: () => '',
+      mcpScriptForPlugin: () => '',
+      countSkillFiles: () => 0,
+      writeLastSessionCwd: (cwd, pid) => sentinels.push({ cwd, pid }),
+      updateCurrentCwdOverride: (cwd) => overrides.push(cwd),
+      persistSession: (value) => persisted.push(structuredClone(value)),
+      clean: (value) => String(value || '').trim(),
+      resolve,
+      statSync,
+      existsSync: () => false,
+      cfgMod: {},
+      STANDALONE_DATA_DIR: root,
+    });
+
+    applyResolvedCwd(after, { persistProjectSelection: true });
+
+    assert.equal(currentCwd, after);
+    assert.equal(session.cwd, after);
+    assert.deepEqual(desktopSession, { classification: 'project', projectPath: after });
+    assert.deepEqual(session.desktopSession, desktopSession);
+    assert.equal(persisted.length, 1);
+    assert.equal(persisted[0].cwd, after);
+    assert.deepEqual(persisted[0].desktopSession, desktopSession);
+    assert.deepEqual(sentinels, [{ cwd: after, pid: 4321 }]);
+    assert.deepEqual(overrides, [after]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});

package/src/session-runtime/cwd-tool-routing.test.mjs

@@ -14,6 +14,8 @@ test('cwd internal tool stays bound to its caller when another runtime owns the
   mkdirSync(cwdA);
   mkdirSync(cwdB);
   mkdirSync(cwdNext);
+  const previousProcessCwd = process.env.MIXDOG_SESSION_CWD;
+  process.env.MIXDOG_SESSION_CWD = 'process-global-must-not-change';
 
   const runtimeA = await createMixdogSessionRuntime({ cwd: cwdA, toolMode: 'full' });
   const runtimeB = await createMixdogSessionRuntime({ cwd: cwdB, toolMode: 'full' });
@@ -22,6 +24,8 @@ test('cwd internal tool stays bound to its caller when another runtime owns the
       runtimeA.close('cwd-routing-test', { waitForExit: false }),
       runtimeB.close('cwd-routing-test', { waitForExit: false }),
     ]);
+    if (previousProcessCwd === undefined) delete process.env.MIXDOG_SESSION_CWD;
+    else process.env.MIXDOG_SESSION_CWD = previousProcessCwd;
     rmSync(root, { recursive: true, force: true });
   });
 
@@ -53,4 +57,5 @@ test('cwd internal tool stays bound to its caller when another runtime owns the
   assert.equal(setResult.sessionId, callerSession.id);
   assert.equal(runtimeA.cwd, cwdNext);
   assert.equal(runtimeB.cwd, cwdB);
+  assert.equal(process.env.MIXDOG_SESSION_CWD, 'process-global-must-not-change');
 });

package/src/session-runtime/deferred-tool-delta.mjs

@@ -0,0 +1,104 @@
+import { clean } from './session-text.mjs';
+
+function compactDescription(value) {
+  return String(value || '')
+    .replace(/\s+/g, ' ')
+    .replace(/[<>]/g, '')
+    .trim()
+    .slice(0, 240);
+}
+
+function normalizedDelta(value) {
+  const source = value && typeof value === 'object' ? value : {};
+  const addedByName = new Map();
+  for (const entry of Array.isArray(source.added) ? source.added : []) {
+    const name = clean(entry?.name);
+    if (name) addedByName.set(name, { name, description: compactDescription(entry?.description) });
+  }
+  const removed = new Set(
+    (Array.isArray(source.removed) ? source.removed : [])
+      .map((entry) => clean(typeof entry === 'string' ? entry : entry?.name))
+      .filter(Boolean),
+  );
+  for (const name of addedByName.keys()) removed.delete(name);
+  return {
+    revision: Math.max(0, Number(source.revision) || 0),
+    addedByName,
+    removed,
+  };
+}
+
+export function mergePendingDeferredToolDelta(session, change = {}) {
+  if (!session || typeof session !== 'object') return null;
+  const current = normalizedDelta(session.pendingDeferredToolDelta);
+  const nextRevision = Math.max(
+    current.revision,
+    Math.max(0, Number(session.deferredToolDeltaRevision) || 0),
+  ) + 1;
+  for (const entry of Array.isArray(change.added) ? change.added : []) {
+    const name = clean(entry?.name);
+    if (!name) continue;
+    if (current.removed.delete(name)) continue;
+    current.addedByName.set(name, {
+      name,
+      description: compactDescription(entry?.description),
+    });
+  }
+  for (const entry of Array.isArray(change.removed) ? change.removed : []) {
+    const name = clean(typeof entry === 'string' ? entry : entry?.name);
+    if (!name) continue;
+    if (current.addedByName.delete(name)) continue;
+    current.removed.add(name);
+  }
+  const added = [...current.addedByName.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const removed = [...current.removed].sort();
+  if (!added.length && !removed.length) {
+    session.deferredToolDeltaRevision = nextRevision;
+    delete session.pendingDeferredToolDelta;
+    return null;
+  }
+  session.deferredToolDeltaRevision = nextRevision;
+  session.pendingDeferredToolDelta = {
+    version: 1,
+    type: 'deferred_tools_delta',
+    revision: nextRevision,
+    added,
+    removed,
+  };
+  session.updatedAt = Date.now();
+  return session.pendingDeferredToolDelta;
+}
+
+export function snapshotPendingDeferredToolDelta(session) {
+  const current = normalizedDelta(session?.pendingDeferredToolDelta);
+  const added = [...current.addedByName.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const removed = [...current.removed].sort();
+  if (!added.length && !removed.length) return null;
+  const lines = ['<system-reminder>', '<deferred_tools_delta>'];
+  if (added.length) {
+    lines.push('Added deferred tools:');
+    for (const entry of added) {
+      lines.push(entry.description ? `- ${entry.name}: ${entry.description}` : `- ${entry.name}`);
+    }
+  }
+  if (removed.length) {
+    lines.push('Removed deferred tools:');
+    for (const name of removed) lines.push(`- ${name}`);
+  }
+  lines.push('</deferred_tools_delta>', '</system-reminder>');
+  return {
+    revision: current.revision,
+    added,
+    removed,
+    content: lines.join('\n'),
+  };
+}
+
+export function acknowledgePendingDeferredToolDelta(session, revision) {
+  if (!session || typeof session !== 'object') return false;
+  const current = normalizedDelta(session.pendingDeferredToolDelta);
+  if (!current.revision || current.revision !== Number(revision)) return false;
+  delete session.pendingDeferredToolDelta;
+  session.updatedAt = Date.now();
+  return true;
+}