mixdog 0.9.152 → 0.9.154

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -14,6 +14,10 @@ import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { estimateJsonBytes } from '../../../../shared/json-metrics.mjs';
 import { logLlmCall } from '../../../../shared/llm/usage-log.mjs';
 import { appendAgentTrace } from '../../agent-trace.mjs';
+import {
+    acknowledgePendingDeferredToolDelta,
+    snapshotPendingDeferredToolDelta,
+} from '../../../../../session-runtime/deferred-tool-delta.mjs';
 import { recordStandaloneStatusTelemetry } from './status-telemetry.mjs';
 import { normalizeStaleCompactingStage } from './compaction-runner.mjs';
 import { resolveSessionContextMeta, positiveContextWindow } from './context-meta.mjs';
@@ -80,6 +84,37 @@ export async function settleAskCleanup(promise, { timeoutMs } = {}) {
     return await settleWithin(promise, budget);
 }
 
+// Live Agent projection is a per-ask send opt, never a session field.
+// Callers that pass onTextDelta/onAssistantText still need `liveProjection`
+// to un-suppress provider streaming: askSession always wraps those
+// callbacks for interruption tracking, so agent-loop cannot infer intent
+// from `typeof opts.onTextDelta === 'function'`.
+export function resolveAskLiveProjection(askOpts = {}) {
+    return askOpts?.liveProjection === true;
+}
+
+export function emitAskSessionStart(askOpts, detail) {
+    if (typeof askOpts?.onSessionStart !== 'function') return;
+    try { askOpts.onSessionStart(detail); } catch { /* best-effort */ }
+}
+
+// Replacement is opt-in and transactional: a delta-only consumer cannot
+// retract already exposed bytes, so absence, false, or rejection must
+// preserve the original partial and force the provider's terminal
+// no-replay behavior. Live projection never auto-acks.
+export async function acknowledgeAskTextReset(askOpts, detail, onAcknowledged) {
+    if (typeof askOpts?.onTextReset !== 'function') return false;
+    let acknowledged = false;
+    try {
+        acknowledged = await askOpts.onTextReset(detail) === true;
+    } catch {
+        return false;
+    }
+    if (!acknowledged) return false;
+    if (typeof onAcknowledged === 'function') onAcknowledged(detail);
+    return true;
+}
+
 export function persistedAssistantTranscriptMetadata(value, fallbackAt = Date.now()) {
     if (!value || typeof value !== 'object') return null;
     const candidateAt = Number(value.assistantAt);
@@ -194,6 +229,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             ...(typeof _rawTranscriptMeta.model === 'string' && _rawTranscriptMeta.model ? { model: _rawTranscriptMeta.model } : {}),
             ...(typeof _rawTranscriptMeta.provider === 'string' && _rawTranscriptMeta.provider ? { provider: _rawTranscriptMeta.provider } : {}),
             ...(typeof _rawTranscriptMeta.agent === 'string' && _rawTranscriptMeta.agent ? { agent: _rawTranscriptMeta.agent } : {}),
+            ...(typeof _rawTranscriptMeta.sender === 'string' && _rawTranscriptMeta.sender ? { sender: _rawTranscriptMeta.sender } : {}),
         }
         : null;
     const _takeAssistantTranscriptMetadata = () => {
@@ -229,6 +265,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     // can compare against the last turn's generation.
     let askGeneration = 0;
     let _crashRecoveryChecked = false;
+    let _sessionStartEmitted = false;
     try {
       // Turn loop (pendingMessages pattern): run the current prompt, then drain
       // any `agent type=send` messages that were queued while this turn was in
@@ -238,6 +275,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       for (;;) {
         let _pwstTurnDrained = null;
         let _turnPendingEntries = [];
+        let _turnDeferredToolDelta = null;
         // After the first turn, the next prompt comes from the drained queue.
         // (On the first iteration _pendingTail is empty and `prompt` is the
         // caller's original message.)
@@ -333,6 +371,16 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             linkParentSignalToSession(sessionId, _linkedParentSignal);
         }
         markSessionAskStart(sessionId);
+        if (!_sessionStartEmitted) {
+            _sessionStartEmitted = true;
+            emitAskSessionStart(askOpts, {
+                sessionId,
+                agent: preSession.agent || null,
+                model: preSession.model || null,
+                provider: preSession.provider || null,
+                owner: preSession.owner || null,
+            });
+        }
         // Preprocessing is inside try so provider-not-available / trim failures
         // fall into the catch and mark the session as errored rather than
         // leaving stage='connecting' forever.
@@ -540,9 +588,13 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 process.stderr.write(`[session] Warning: prompt is very large (est. ${Math.round(promptTokenEstimate)} tokens vs ${softBudget} soft budget)\n`);
             }
             const _currentTimeBlock = buildCurrentTimeBlock(prompt);
-            const _turnReminderBlock = _currentTimeBlock
-                ? `<system-reminder>\n# Current Time\n${_currentTimeBlock}\n</system-reminder>`
-                : '';
+            _turnDeferredToolDelta = snapshotPendingDeferredToolDelta(session);
+            const _turnReminderBlock = [
+                _currentTimeBlock
+                    ? `<system-reminder>\n# Current Time\n${_currentTimeBlock}\n</system-reminder>`
+                    : '',
+                _turnDeferredToolDelta?.content || '',
+            ].filter(Boolean).join('\n\n');
             const _baseUserTurnContent = prefixUserTurnContent(prompt, _contextBlock);
             const _userTurnContent = prefixSessionStartContent(_baseUserTurnContent, _turnReminderBlock);
             cancelledUserTurnContent = _userTurnContent;
@@ -623,23 +675,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 _scheduleTurnCheckpoint();
                 if (typeof askOpts?.onTextDelta === 'function') askOpts.onTextDelta(chunk);
             };
-            const _trackTextReset = async (detail) => {
-                // Replacement is opt-in and transactional: a delta-only
-                // consumer cannot retract already exposed bytes, so absence,
-                // false, or rejection must preserve the original partial and
-                // force the provider's terminal no-replay behavior.
-                if (typeof askOpts?.onTextReset !== 'function') return false;
-                let acknowledged = false;
-                try {
-                    acknowledged = await askOpts.onTextReset(detail) === true;
-                } catch {
-                    return false;
-                }
-                if (!acknowledged) return false;
-                _turnInterruption.tombstoneText(detail?.chars);
+            const _trackTextReset = async (detail) => acknowledgeAskTextReset(askOpts, detail, (resetDetail) => {
+                _turnInterruption.tombstoneText(resetDetail?.chars);
                 _scheduleTurnCheckpoint(true);
-                return true;
-            };
+            });
             const _trackReasoningDelta = (chunk) => {
                 _turnInterruption.recordReasoningDelta(chunk);
                 _scheduleTurnCheckpoint();
@@ -679,9 +718,13 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     onReasoningDelta: _trackReasoningDelta,
                     onAssistantText: _trackAssistantText,
                     takeAssistantTranscriptMetadata: _takeAssistantTranscriptMetadata,
-                    onAssistantMessageCommitted: () => {
+                    // Send-opt only. Never copy onto `session` — a transient
+                    // interactive/live flag must not survive this ask.
+                    liveProjection: resolveAskLiveProjection(askOpts),
+                    onAssistantMessageCommitted: (message) => {
                         _turnInterruption.markAssistantMessageCommitted();
                         _scheduleTurnCheckpoint(true);
+                        try { askOpts?.onAssistantMessageCommitted?.(message); } catch {}
                     },
                     onAssistantToolCallObserved: (call, detail) => {
                         _turnInterruption.recordToolCalls([call], detail);
@@ -1008,6 +1051,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     promptTokens,
                     prefixHash: prefixHashForLog,
                     costUsd,
+                    transportTiming: result.transportTiming || null,
                 });
                 recordStandaloneStatusTelemetry(session, result, Date.now() - _askStartedAt);
             }
@@ -1020,6 +1064,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             } else if (result.providerStateUpdated === true || result.providerState !== undefined) {
                 session.providerState = result.providerState;
             }
+            if (_turnDeferredToolDelta) {
+                acknowledgePendingDeferredToolDelta(session, _turnDeferredToolDelta.revision);
+            }
             const terminalResultPreview = {
                 ...result,
                 trimmed: messagesDropped > 0,
@@ -1214,13 +1261,25 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // renderer's ephemeral failure toast.
             try {
                 const _status = Number(err?.httpStatus || err?.status || err?.response?.status || 0) || 0;
+                const _errorDetails = err?.details && typeof err.details === 'object'
+                    ? err.details
+                    : null;
                 const _parts = [
                     `session=${sessionId}`,
                     `name=${err?.name || 'Error'}`,
                     _status ? `status=${_status}` : null,
                     err?.code ? `code=${err.code}` : null,
                     err?.providerErrorType ? `type=${err.providerErrorType}` : null,
-                    `kind=${classifyError(err)}`,
+                    `kind=${_errorDetails?.kind || classifyError(err)}`,
+                    _errorDetails?.reason ? `reason=${_errorDetails.reason}` : null,
+                    _errorDetails?.source ? `source=${_errorDetails.source}` : null,
+                    Number.isFinite(Number(_errorDetails?.index)) ? `index=${_errorDetails.index}` : null,
+                    Number.isFinite(Number(_errorDetails?.previousCount))
+                        ? `previousCount=${_errorDetails.previousCount}`
+                        : null,
+                    Number.isFinite(Number(_errorDetails?.nextCount))
+                        ? `nextCount=${_errorDetails.nextCount}`
+                        : null,
                     Number.isFinite(Number(err?.attempts)) ? `attempts=${err.attempts}` : null,
                     Number.isFinite(Number(err?.midstreamRetries)) ? `midstreamRetries=${err.midstreamRetries}` : null,
                     err?.midstreamClassifier ? `midstream=${err.midstreamClassifier}` : null,

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -16,6 +16,8 @@ import {
 import { estimateMessagesTokens, estimateRequestReserveTokens, estimateTranscriptContextUsage, resolveCompactBufferRatio } from '../context-utils.mjs';
 import { executeInternalTool } from '../../internal-tools.mjs';
 import {
+    callMemoryColdStart,
+    recallMemoryTimeoutMs,
     runRecallFastTrackCompact,
 } from '../loop/recall-fasttrack.mjs';
 import {
@@ -34,9 +36,11 @@ import {
     compactTargetBudget as compactTargetBudgetForPolicy,
     currentContextEstimateTokens,
     invalidateProviderContextBaseline,
+    recordContextUsageSnapshot,
     resolveGaugeContextTokens,
     resolveWorkerCompactPolicy,
 } from '../loop/compact-policy.mjs';
+import { snapshotProviderRequestTools } from '../../../../../session-runtime/tool-catalog.mjs';
 
 // 'compacting' is a transient in-flight stage written just before semantic /
 // recall-fasttrack compaction runs. If the process crashes or only partially
@@ -58,12 +62,19 @@ export function normalizeStaleCompactingStage(session) {
 
 // Manual/auto-clear compaction needs the same threshold and post-compact
 // target math as the loop, even when automatic compaction is disabled.
-export function resolveSessionCompactionPolicy(session) {
+export function resolveSessionCompactionPolicy(session, messages = session?.messages) {
     if (!session) return null;
+    const requestTools = snapshotProviderRequestTools({
+        provider: session.provider,
+        tools: session.tools || [],
+        nativeTools: [],
+        messages: Array.isArray(messages) ? messages : [],
+        session,
+    });
     return resolveWorkerCompactPolicy({
         ...session,
         compaction: { ...(session.compaction || {}), auto: true },
-    }, session.tools || []);
+    }, requestTools);
 }
 function addCompactUsageToSession(session, usage) {
     if (!session || !usage) return;
@@ -79,44 +90,9 @@ function addCompactUsageToSession(session, usage) {
     session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + uncachedInputTokens;
     session.tokensCumulative = (session.tokensCumulative || 0) + inputTokens + outputTokens;
 }
-// A stalled memory call must NEVER wedge the
-// compact//clear path. Bound every recall-fasttrack memory call with a short
-// local timeout: on timeout we abort (best-effort cancel via a chained signal)
-// and treat it exactly like an RPC failure, so compaction proceeds WITHOUT
-// recall-fasttrack instead of hanging.
-const RECALL_MEMORY_CALL_TIMEOUT_MS = Math.max(
-    250,
-    Number(process.env.MIXDOG_AGENT_COMPACT_RECALL_TIMEOUT_MS) || 4000,
-);
-function recallMemoryTimeoutMs(session) {
-    const configured = positiveContextWindow(session?.compaction?.recallMemoryTimeoutMs);
-    // Clamp ALL sources (session-config included) to the 250ms floor so a
-    // misconfigured tiny value can't turn the bound into a busy no-wait.
-    return Math.max(250, configured || RECALL_MEMORY_CALL_TIMEOUT_MS);
-}
-// Cold-start allowance (clear/manual path only): a booting memory runtime can
-// miss the tight first bound (waitForPort + first-RPC warmup ~2-10s). On a
-// timeout we retry ONCE with a longer bound before honoring the bail-to-
-// semantic contract, so a rebooting runtime succeeds instead of instantly
-// failing. Non-timeout errors and outer aborts propagate immediately.
-// 15s: memory boot is ~2-4s warm-cache / ~10s worst since the PG fast-start
-// fix; keeping this tight bounds the clear path's worst case (2 memory calls
-// retried + 120s semantic) under the TUI auto-clear watchdog (180s).
-const RECALL_COLD_START_TIMEOUT_MS = 15_000;
-function isTimeoutError(err) {
-    return typeof err?.message === 'string' && err.message.includes('timed out after');
-}
-async function callMemoryColdStart(args, callerCtx, timeoutMs, executeMemory) {
-    try {
-        return await callMemoryBounded(args, callerCtx, timeoutMs, executeMemory);
-    } catch (err) {
-        if (!isTimeoutError(err) || callerCtx?.signal?.aborted) throw err;
-        const coldMs = Math.max(timeoutMs, RECALL_COLD_START_TIMEOUT_MS);
-        if (coldMs <= timeoutMs) throw err;
-        try { process.stderr.write(`[session] recall-fasttrack ${args?.action || 'call'} cold-start retry (${timeoutMs}ms -> ${coldMs}ms)\n`); } catch {}
-        return await callMemoryBounded(args, callerCtx, coldMs, executeMemory);
-    }
-}
+// Recall-fasttrack memory bounds live with the pipeline itself
+// (loop/recall-fasttrack.mjs) so every caller — this one and the pre-send
+// compaction — shares one timeout contract instead of each wiring its own.
 // Semantic-compact timeout scales with transcript size (clear/manual path):
 // default max(30s, ~10s per 25k estimated message tokens) capped at 120s, so a
 // large (~100k-token) transcript no longer dies on a fixed 30s bound.
@@ -127,34 +103,6 @@ function semanticCompactTimeoutMs(session, messageTokens) {
     const scaled = Math.ceil((messageTokens || 0) / 25_000) * 10_000;
     return Math.min(120_000, Math.max(30_000, scaled));
 }
-async function callMemoryBounded(args, callerCtx, timeoutMs, executeMemory = executeInternalTool) {
-    const ac = new AbortController();
-    const outer = callerCtx?.signal;
-    const onOuterAbort = () => { try { ac.abort(); } catch {} };
-    if (outer) {
-        if (outer.aborted) ac.abort();
-        else { try { outer.addEventListener?.('abort', onOuterAbort, { once: true }); } catch {} }
-    }
-    let timer = null;
-    const timeout = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-            try { ac.abort(); } catch {}
-            reject(new Error(`memory ${args?.action || 'call'} timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-        try { timer.unref?.(); } catch {}
-    });
-    try {
-        return await Promise.race([
-            executeMemory('memory', args, { ...callerCtx, signal: ac.signal }),
-            timeout,
-        ]);
-    } finally {
-        if (timer) clearTimeout(timer);
-        // Drop the chained-abort listener when the call settles first, so a
-        // later outer abort can't fire into a dead controller / leak.
-        try { outer?.removeEventListener?.('abort', onOuterAbort); } catch {}
-    }
-}
 // Element-identity change detection (same approach as loop.mjs messagesArrayChanged): two
 // arrays are "unchanged" only when same length AND every slot is the same object
 // reference. Used to reject a no-op prune (which returns a fresh array whose
@@ -438,11 +386,12 @@ export async function runSessionCompaction(session, opts = {}) {
     try { beforeEncoded = JSON.stringify(messages); } catch { beforeEncoded = ''; }
     try { afterEncoded = JSON.stringify(compacted); } catch { afterEncoded = ''; }
     const afterMessageTokens = estimateMessagesTokens(compacted);
+    const postCompactPolicy = resolveSessionCompactionPolicy(session, compacted) || alignedPolicy;
     // Same scale as beforeTokens: compaction invalidates the provider baseline,
     // so the gauge's post-compact number is the calibrated transcript estimate
     // plus the request reserve. The raw sum reported roughly half of that.
-    const afterTokens = alignedPolicy
-        ? currentContextEstimateTokens(afterMessageTokens, alignedPolicy)
+    const afterTokens = postCompactPolicy
+        ? currentContextEstimateTokens(afterMessageTokens, postCompactPolicy)
         : afterMessageTokens + reserveTokens;
     const changed = beforeEncoded && afterEncoded
         ? beforeEncoded !== afterEncoded
@@ -471,7 +420,8 @@ export async function runSessionCompaction(session, opts = {}) {
         triggerTokens,
         bufferTokens,
         bufferRatio,
-        reserveTokens,
+        requestReserveTokens: postCompactPolicy?.requestReserveTokens || 0,
+        reserveTokens: postCompactPolicy?.reserveTokens ?? reserveTokens,
         type: compactType,
         compactType,
         lastCompactType: compactType,
@@ -503,7 +453,18 @@ export async function runSessionCompaction(session, opts = {}) {
         } : null,
         compactCount: (session.compaction?.compactCount || 0) + (changed ? 1 : 0),
     };
-    if (changed) invalidateProviderContextBaseline(session);
+    if (changed) {
+        invalidateProviderContextBaseline(session);
+        if (postCompactPolicy) {
+            recordContextUsageSnapshot(session, postCompactPolicy, {
+                messages: compacted,
+                usedTokens: afterTokens,
+                messageTokensEst: afterMessageTokens,
+                source: 'post_compact',
+                updatedAt: now,
+            });
+        }
+    }
     // Observability parity with the loop's pre-send pass: record the
     // out-of-loop mutation as compact_meta and park a one-shot intent so the
     // next turn's first send tags its cache break instead of logging an

package/src/runtime/agent/orchestrator/session/manager/session-crud.mjs

@@ -6,7 +6,12 @@ import { loadSession, saveSessionAsync, setLiveSession, evictLiveSession, listSt
 import { estimateMessagesTokens, estimateTranscriptContextUsage } from '../context-utils.mjs';
 import { normalizeCompactType, DEFAULT_COMPACT_TYPE, SUMMARY_PREFIX } from '../compact.mjs';
 import { runSessionCompaction, resolveSessionCompactionPolicy } from './compaction-runner.mjs';
-import { resolveGaugeContextTokens } from '../loop/compact-policy.mjs';
+import {
+    currentContextEstimateTokens,
+    invalidateContextUsageSnapshot,
+    recordContextUsageSnapshot,
+    resolveGaugeContextTokens,
+} from '../loop/compact-policy.mjs';
 import { hasUserConversationMessage, promptContentText, resetSessionBp3Environment } from './prompt-utils.mjs';
 import { getProvider } from '../../providers/registry.mjs';
 import { isSessionCompactionBlocked, getSessionAbortSignal, _runtimeEntries } from './runtime-liveness.mjs';
@@ -161,7 +166,10 @@ export async function clearSessionMessages(sessionId, options = {}) {
     const beforeTokens = (clearPolicy
         ? resolveGaugeContextTokens(beforeMessageTokens, clearPolicy, { messages, sessionRef: session })
         : 0) || estimateTranscriptContextUsage(messages, session.tools || [], { provider: session.provider });
-    const afterTokens = estimateTranscriptContextUsage(keep, session.tools || [], { provider: session.provider });
+    const postClearPolicy = resolveSessionCompactionPolicy(session, keep);
+    const afterTokens = postClearPolicy
+        ? currentContextEstimateTokens(afterMessageTokens, postClearPolicy)
+        : estimateTranscriptContextUsage(keep, session.tools || [], { provider: session.provider });
     const now = Date.now();
     // --- Fork the outgoing transcript to a separate resumable session BEFORE
     // the wipe below. Runs for every clear path (plain /clear, auto-clear,
@@ -264,6 +272,17 @@ export async function clearSessionMessages(sessionId, options = {}) {
         lastClearCompactType: clearCompactType || session.compaction?.compactType || null,
         lastClearCompactError: clearCompactError?.message || null,
     };
+    if (summaryCarriedForward && postClearPolicy) {
+        recordContextUsageSnapshot(session, postClearPolicy, {
+            messages: keep,
+            usedTokens: afterTokens,
+            messageTokensEst: afterMessageTokens,
+            source: 'post_clear',
+            updatedAt: now,
+        });
+    } else {
+        invalidateContextUsageSnapshot(session);
+    }
     session.updatedAt = now;
     await saveSessionAsync(session, { expectedGeneration: session.generation });
     return session;

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -21,7 +21,6 @@ import {
     _buildLeadMetaContext,
 } from './rules-cache.mjs';
 import {
-    applyToolPermissionNarrowing,
     finalizeSessionToolList,
     resolveSessionTools,
     permissionFromToolSpec,
@@ -213,11 +212,8 @@ export function createSession(opts) {
     const resolvedAgent = opts.agent || opts.role || profile?.taskType || null;
     const hiddenAgent = getHiddenAgent(resolvedAgent);
     const isRetrievalAgent = hiddenAgent?.kind === 'retrieval';
-    // Skill schema is fixed for public agent sessions, but hidden retrieval /
-    // maintenance roles are deliberately narrowed away from the Skill tool.
-    // Do not leak a Skill manifest into those hidden prompts when no Skill()
-    // loader is available.
-    const skills = (opts.skipSkills || hiddenAgent) ? [] : collectPromptSkillsCached(opts.cwd);
+    // Lead and Agent share the same cwd-scoped Skill inventory.
+    const skills = opts.skipSkills ? [] : collectPromptSkillsCached(opts.cwd);
 
     // BP1 is shared tool policy. BP2 holds persistent profile/tool catalogs;
     // BP3 holds workflow/role and session/project environment.
@@ -230,7 +226,6 @@ export function createSession(opts) {
     // override role-inapplicable entries.
     const sessionDeny = [
         ...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []),
-        ...(hiddenAgent ? ['Skill'] : []),
         ...(!ownerIsAgent && workflowDisallowsAgentTool(opts.workflow) ? ['agent'] : []),
     ];
     // The edit dialect this model never receives is omitted from the rules as
@@ -245,60 +240,31 @@ export function createSession(opts) {
             ? _buildAgentRules(agentRulesProfile)
             : _buildLeadRules({ includeLeadBrief: !delegationFree }));
     const metaContext = skipAgentRules ? '' : (ownerIsAgent ? '' : _buildLeadMetaContext());
-    // Prompt permission is metadata for the write bundle, but a read-only role
-    // is stamped BEFORE the toolSpec decision so its schema ships the narrowed
-    // bundle. Resolve toolPermission (with profile/preset fallbacks) first, and
-    // let the stored/logged `permission` reflect that resolved value — not just
-    // opts.permission — so diagnostics show the effective read/write class.
+    // Role permission is prompt/diagnostic metadata only. Resolve and persist
+    // it without shaping the provider-visible Agent schema.
     const toolPermission = opts.permission
         || profile?.permission
         || permissionFromToolSpec(toolPreset)
         || null;
     const permission = toolPermission;
 
-    // Agent sessions do not inherit arbitrary role/profile/preset tool
-    // narrowing — that would shatter provider prefix reuse into one shard per
-    // role. Instead they collapse onto exactly TWO stable, bit-identical
-    // bundles, one cache group each:
-    //   - read-only roles (reviewer / hidden retrieval, i.e. any
-    //     session resolving to permission 'read') -> 'readonly' bundle:
-    //     read builtins (code_graph/find/glob/list/grep/read) + retrieval
-        // (web_search/web_fetch/Skill) + shell/task for self-verification
-    //     (agent-owned readonly bundle only), no apply_patch, no MCP-write.
-    //     applyToolPermissionNarrowing('read') below trims the
-    //     bundle to AGENT_STRING_PERMISSION_READ_ALLOW so the final surface is
-    //     bit-identical across these roles regardless of MCP registry state.
-    //   - write roles (worker / heavy-worker / maintainer / …) -> 'full'
-    //     bundle: the historical full schema.
-    // Call-time permission enforcement below is UNCHANGED (defense in depth):
-    // applyToolPermissionNarrowing still runs so the bundle choice never
-    // widens effective access.
-    const isReadOnlyAgentBundle = ownerIsAgent && toolPermission === 'read';
+    // Exactly two schema surfaces exist: Lead and Agent. Every Agent role gets
+    // the full Lead-capable base bundle; the recursive `agent` control tool is
+    // removed later at the owner boundary. Role permission remains prompt/
+    // diagnostic metadata and does not fragment the provider-visible schema.
     const toolSpec = ownerIsAgent
-        ? (isReadOnlyAgentBundle ? 'readonly' : 'full')
+        ? 'full'
         : (Array.isArray(profile?.tools) ? profile.tools : toolPreset);
     let toolsForRouting = resolveSessionTools(toolSpec, skills, {
         ownerIsAgentSession: ownerIsAgent,
         mcpScopeId: opts.mcpScopeId || null,
         modelName,
     });
-    // Fail-closed permission intersection: when a session declares an explicit
-    // object-form permission, intersect the
-    // resolved tool list with the permission's allow/deny lists. If the
-    // intersection produces an empty set the permission config is broken —
-    // fail closed (zero tools) rather than silently falling back to the full
-    // preset, which would grant the role more surface than declared.
-    if (ownerIsAgent) {
-        // Pass the RESOLVED agent (opts.agent || opts.role): narrowing keys
-        // retrieval/locator roles off this name to strip
-        // shell/task; verifying read roles (reviewer) keep them.
-        toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, toolPermission, resolvedAgent);
-    }
 
     const workflowMeta = toSessionWorkflowMeta(opts.workflow);
     const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
     const tools = finalizeSessionToolList(toolsForRouting, {
-        schemaAllowedTools: hasCallerAllow ? opts.schemaAllowedTools : null,
+        schemaAllowedTools: ownerIsAgent ? null : (hasCallerAllow ? opts.schemaAllowedTools : null),
         disallowedTools: sessionDeny,
         ownerIsAgent,
         resolvedAgent,
@@ -478,7 +444,9 @@ export function createSession(opts) {
         profileId: profile?.id || null,
         permissionMode: opts.permissionMode ?? null,
         providerCacheOpts: providerCacheOpts || null,
+        parentSessionId: opts.parentSessionId || null,
         ownerSessionId: opts.ownerSessionId || null,
+        visibility: opts.visibility || null,
         clientHostPid: opts.clientHostPid || null,
     };
     refreshSessionBp3Environment(session, opts.cwd);
@@ -643,7 +611,7 @@ const _preparedResumes = new Map();
 
 function _prepareResumeTools(session, preset) {
     const ownerIsAgent = isAgentOwner(session);
-    const skills = ownerIsAgent ? [] : collectPromptSkillsCached(session.cwd);
+    const skills = collectPromptSkillsCached(session.cwd);
     let toolSpec = ownerIsAgent ? 'full' : (preset || session.preset || 'full');
     const agentRuntime = getAgentRuntimeSync();
     if (session.profileId && agentRuntime?.getProfile) {
@@ -657,19 +625,17 @@ function _prepareResumeTools(session, preset) {
         mcpScopeId: session.mcpScopeId || null,
         modelName: session.model,
     });
-    if (ownerIsAgent) {
-        toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, session.toolPermission, session.agent || null);
-    }
     return {
         session,
         preset,
         toolSpec,
         ownerIsAgent,
         tools: finalizeSessionToolList(toolsForRouting, {
-            schemaAllowedTools: Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
+            schemaAllowedTools: ownerIsAgent
+                ? null
+                : (Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null),
             disallowedTools: [
                 ...(Array.isArray(session.disallowedTools) ? session.disallowedTools : []),
-                ...(getHiddenAgent(session.agent || null) ? ['Skill'] : []),
                 ...(!isAgentOwner(session) && workflowDisallowsAgentTool(session.workflow) ? ['agent'] : []),
             ],
             ownerIsAgent,
@@ -715,6 +681,14 @@ export function prefetchSession(sessionId, preset = 'full') {
 export function prepareSessionProjection(session, preset = 'full') {
     if (!session?.id) return null;
     const prepared = _preparedResumeForSession(session, preset);
+    // This read-only projection describes the last provider-visible session,
+    // not the transient bootstrap bundle that resumeSession installs before
+    // session-runtime reapplies deferred selections. Keeping the persisted
+    // active surface preserves its provider baseline/tool signature while the
+    // cached `prepared.tools` remains available for the real resume.
+    const projectionTools = Array.isArray(session.tools)
+        ? session.tools
+        : prepared.tools;
     let contextMeta = null;
     try {
         const provider = session.provider ? getProvider(session.provider) : null;
@@ -727,7 +701,7 @@ export function prepareSessionProjection(session, preset = 'full') {
     return {
         ...session,
         toolSpec: prepared.toolSpec,
-        tools: prepared.tools,
+        tools: projectionTools,
         ...(contextMeta ? {
             contextWindow: contextMeta.contextWindow,
             rawContextWindow: contextMeta.rawContextWindow,

package/src/runtime/agent/orchestrator/session/manager/status-telemetry.mjs

@@ -58,9 +58,12 @@ export function recordStandaloneStatusTelemetry(session, result, durationMs) {
             ...summarizeGatewayUsage(routeInfo, providerOut, _compactArg, durationMs),
             requestKind: 'chat',
             sessionId: session.id || null,
+            sourceType: session.sourceType || 'lead',
+            sourceName: session.sourceName || session.agent || null,
             toolCount: result.toolCallsTotal ?? null,
             messageCount: Array.isArray(session.messages) ? session.messages.length : null,
             cacheStrategy: session.providerCacheOpts?.cacheStrategy || null,
+            transportTiming: result.transportTiming || null,
         };
         recordGatewayUsageEvent(summary);
     } catch {