mixdog 0.9.152 → 0.9.154

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -1,13 +1,11 @@
-// Session tool schema resolution + permission narrowing, extracted verbatim
-// from manager.mjs. Behavior-preserving: same toolset ids, same ordering,
-// same dedup, same fail-closed permission intersection.
+// Session tool schema resolution. Lead and Agent share one full-capability
+// catalog; Agent removes only the recursive `agent` control tool.
 import { getMcpTools } from '../../mcp/client.mjs';
 import { getInternalTools } from '../../internal-tools.mjs';
 import { BUILTIN_TOOLS } from '../../tools/builtin/builtin-tools.mjs';
 import { PATCH_TOOL_DEFS } from '../../tools/patch-tool-defs.mjs';
 import { CODE_GRAPH_TOOL_DEFS } from '../../tools/code-graph-tool-defs.mjs';
 import { buildSkillToolDefs } from '../../context/collect.mjs';
-import { getHiddenAgent } from '../../internal-agents.mjs';
 import { filterModelEditTools } from '../../../../shared/edit-tool-dialect.mjs';
 
 // Merge externally-connected MCP tools with the plugin's in-process tools
@@ -81,101 +79,6 @@ const READONLY_TOOL_NAMES = new Set([
     'read',
 ]);
 
-const AGENT_STRING_PERMISSION_READ_ALLOW = Object.freeze([
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-    // shell/task: verifying read-role agents (reviewer) must run their own
-    // verification (tests/repro). task is required because shell's
-    // auto-background transition settles with a bare jobId — agent sessions
-    // get no completion notification, so `task wait/read` is the only way to
-    // collect a long-running result. apply_patch stays excluded: read roles
-    // keep the no-edit contract.
-    'shell',
-    'task',
-    'web_search',
-    'web_fetch',
-    'Skill',
-]);
-
-// Retrieval roles never self-verify, so they keep the historical no-shell
-// read surface. Covers hidden retrieval agents and invokedBy wrapper roles,
-// the same set
-// pre-dispatch-deny treats as recursive wrappers. Only verifying read roles
-// (reviewer) get shell/task.
-const AGENT_STRING_PERMISSION_READ_RETRIEVAL_ALLOW = Object.freeze(
-    AGENT_STRING_PERMISSION_READ_ALLOW.filter((n) => n !== 'shell' && n !== 'task'),
-);
-
-function isRetrievalToolRole(agent) {
-    if (!agent) return false;
-  return getHiddenAgent(agent)?.kind === 'retrieval';
-}
-
-function stringToolPermissionAllowList(toolPermission, { retrieval = false } = {}) {
-    if (toolPermission === 'read') {
-        return retrieval ? AGENT_STRING_PERMISSION_READ_RETRIEVAL_ALLOW : AGENT_STRING_PERMISSION_READ_ALLOW;
-    }
-    if (toolPermission === 'read-write') return AGENT_STRING_PERMISSION_READ_WRITE_ALLOW;
-    if (toolPermission === 'none') return [];
-    return null;
-}
-
-// Read-write agent bundle: full edit surface INCLUDING shell/task so
-// write-role agents can run their own verification (build/test) without
-// bouncing it back to Lead. Deploy/ship remains a workflow-level rule,
-// not a tool-surface restriction.
-const AGENT_STRING_PERMISSION_READ_WRITE_ALLOW = Object.freeze([
-    'code_graph',
-    'find',
-    'glob',
-    'list',
-    'grep',
-    'read',
-    'edit',
-    'apply_patch',
-    'git',
-    'git_stage',
-    'shell',
-    'task',
-    'web_search',
-    'web_fetch',
-    'Skill',
-]);
-
-export function applyToolPermissionNarrowing(tools, toolPermission, warnRole = null) {
-    if (toolPermission === 'none') return [];
-    const allowList = stringToolPermissionAllowList(toolPermission, { retrieval: isRetrievalToolRole(warnRole) });
-    if (allowList) {
-        const allowSet = new Set(allowList.map((n) => String(n).toLowerCase()));
-        return tools.filter((t) => allowSet.has(String(t?.name || '').toLowerCase()));
-    }
-    if (toolPermission && typeof toolPermission === 'object') {
-        const allowSet = Array.isArray(toolPermission.allow) && toolPermission.allow.length > 0
-            ? new Set(toolPermission.allow.map(n => String(n).toLowerCase()))
-            : null;
-        const denySet = Array.isArray(toolPermission.deny) && toolPermission.deny.length > 0
-            ? new Set(toolPermission.deny.map(n => String(n).toLowerCase()))
-            : null;
-        if (allowSet || denySet) {
-            const filtered = tools.filter(t => {
-                const name = String(t?.name || '').toLowerCase();
-                if (denySet && denySet.has(name)) return false;
-                if (allowSet && !allowSet.has(name)) return false;
-                return true;
-            });
-            if (filtered.length === 0) {
-                process.stderr.write(`[session] WARN: role permission intersection produced 0 tools — failing closed (role=${warnRole || 'unknown'})\n`);
-            }
-            return filtered;
-        }
-    }
-    return tools;
-}
-
 export function finalizeSessionToolList(tools, {
     schemaAllowedTools = null,
     disallowedTools = null,
@@ -194,7 +97,7 @@ export function finalizeSessionToolList(tools, {
         out = out.filter(t => !denySet.has(String(t?.name || '').toLowerCase()));
     }
     if (ownerIsAgent) {
-        out = out.filter(t => !t?.annotations?.agentHidden);
+        out = out.filter(t => String(t?.name || '').toLowerCase() !== 'agent');
         out = orderSessionTools(out);
     }
     return out;
@@ -312,16 +215,7 @@ function _computeBaseTools(toolSpec, mcp, skillTools, { ownerIsAgentSession = fa
             return orderSessionTools(_dedupByName([...mcp, ...skillTools]));
         case 'readonly': {
             const readTools = ALL_BUILTIN_SESSION_TOOLS.filter(t => READONLY_TOOL_NAMES.has(t.name));
-// Read-ROLE agent sessions (reviewer) must self-verify, so
-            // their base bundle carries shell/task defs. The 'read' permission
-            // allowlist (AGENT_STRING_PERMISSION_READ_ALLOW) is a pure FILTER —
-            // it can only keep tools already assembled here, so without this the
-            // allowlist's shell/task entries were dead letters. Non-agent
-            // 'readonly' profiles stay strictly read-only.
-            const verifyTools = ownerIsAgentSession
-                ? ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'shell' || t.name === 'task')
-                : [];
-            return orderSessionTools(_dedupByName([...readTools, ...verifyTools, ...mcp, ...skillTools]));
+            return orderSessionTools(_dedupByName([...readTools, ...mcp, ...skillTools]));
         }
         case 'full':
         default:

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint-journal.mjs

@@ -15,9 +15,10 @@
 //                     before the provider ever runs, and store-summary-reader
 //                     keeps probing this exact path to detect a live turn.
 //   <session>.jsonl   append-only JSONL deltas — NEW/CHANGED turn messages (by
-//                     turn-relative index), APPENDED partial text/reasoning and
-//                     small interruption-state transitions. A flush costs
-//                     O(new bytes), never O(turn).
+//                     turn-relative index), a one-time full replacement when
+//                     compaction removes the opening prompt, APPENDED partial
+//                     text/reasoning and small interruption-state transitions.
+//                     A normal flush costs O(new bytes), never O(turn).
 // Appends ride a bounded coalescing lane (one in-flight write, one pending
 // buffer, synchronous drain above the byte ceiling) so the engine thread never
 // blocks on disk and the queue can never grow without limit.
@@ -434,7 +435,8 @@ export function replayTurnJournal(header) {
     } catch {
         return header;
     }
-    const messages = header.turnMessages.slice();
+    let messages = header.turnMessages.slice();
+    let fullTranscript = header.fullTranscript === true;
     const state = interruptionStateFromSnapshot(header.interruption);
     let updatedAt = Number(header.updatedAt) || 0;
     let head = false;
@@ -469,6 +471,9 @@ export function replayTurnJournal(header) {
             if (Number.isInteger(index) && index >= 0 && index <= messages.length) {
                 messages[index] = record.m;
             }
+        } else if (record.t === 'full' && Array.isArray(record.ms)) {
+            messages = record.ms.slice();
+            fullTranscript = true;
         } else if (record.t === 'len') {
             const next = Number(record.n);
             if (Number.isInteger(next) && next >= 0 && next <= messages.length) {
@@ -484,6 +489,7 @@ export function replayTurnJournal(header) {
     return {
         ...header,
         turnMessages: messages,
+        ...(fullTranscript ? { fullTranscript: true } : {}),
         interruption: interruptionSnapshotFromState(state),
         updatedAt,
     };
@@ -496,6 +502,7 @@ export function replayTurnJournal(header) {
  */
 export function createTurnJournalEncoder({ turnToken } = {}) {
     let journaled = [];
+    let fullTranscript = false;
     let cursor = null;
     // Per-turn record sequence. It is assigned where records are produced, so
     // the number line is exactly the enqueue order the write lane preserves.
@@ -513,7 +520,8 @@ export function createTurnJournalEncoder({ turnToken } = {}) {
         seed(turnOutgoing, currentUserContent, interruption) {
             const source = Array.isArray(turnOutgoing) ? turnOutgoing : [];
             const start = findTurnStart(source, currentUserContent);
-            journaled = start >= 0 ? source.slice(start) : [];
+            fullTranscript = start < 0;
+            journaled = fullTranscript ? source.slice() : source.slice(start);
             const seeded = typeof interruption?.journalDelta === 'function'
                 ? interruption.journalDelta(null)
                 : null;
@@ -523,23 +531,39 @@ export function createTurnJournalEncoder({ turnToken } = {}) {
             if (seeded?.changed) openLines.push(line({ t: 'x', d: seeded.delta, at: Date.now() }));
             return {
                 turnMessages: journaled.map(checkpointMessage),
+                fullTranscript,
                 openLines,
             };
         },
         encode({ turnOutgoing, currentUserContent, interruption }) {
             const source = Array.isArray(turnOutgoing) ? turnOutgoing : [];
             const start = findTurnStart(source, currentUserContent);
-            const length = start >= 0 ? source.length - start : 0;
             const records = [];
-            for (let index = 0; index < length; index += 1) {
-                const raw = source[start + index];
-                if (journaled[index] === raw) continue;
-                journaled[index] = raw;
-                records.push({ t: 'm', i: index, m: checkpointMessage(raw) });
-            }
-            if (journaled.length > length) {
-                journaled.length = length;
-                records.push({ t: 'len', n: length });
+            if (!fullTranscript && start < 0) {
+                // Pre-send compaction may replace the whole history, including
+                // the user message that defined our turn-relative origin. The
+                // replacement is normally small; persist it once so reconnect
+                // and crash recovery never splice an empty turn onto the stale
+                // pre-compaction prefix.
+                fullTranscript = true;
+                journaled = source.slice();
+                records.push({
+                    t: 'full',
+                    ms: journaled.map(checkpointMessage),
+                });
+            } else {
+                const offset = fullTranscript ? 0 : start;
+                const length = offset >= 0 ? source.length - offset : 0;
+                for (let index = 0; index < length; index += 1) {
+                    const raw = source[offset + index];
+                    if (journaled[index] === raw) continue;
+                    journaled[index] = raw;
+                    records.push({ t: 'm', i: index, m: checkpointMessage(raw) });
+                }
+                if (journaled.length > length) {
+                    journaled.length = length;
+                    records.push({ t: 'len', n: length });
+                }
             }
             if (typeof interruption?.journalDelta === 'function') {
                 const next = interruption.journalDelta(cursor);

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint.mjs

@@ -40,6 +40,9 @@ export function projectTurnCheckpointMessages(session, checkpoint) {
     if (checkpointGeneration !== sessionGeneration
         || (markerToken && !markerMatches)
         || (!markerToken && !checkpointIsNewer)) return source;
+    if (checkpoint.fullTranscript === true) {
+        return checkpoint.turnMessages.slice();
+    }
     let start = -1;
     for (let index = source.length - 1; index >= 0; index -= 1) {
         if (matchingUserMessage(source[index], checkpoint.currentUserContent)) {
@@ -80,6 +83,7 @@ export function createTurnCheckpointRecorder({ sessionId, generation, turnToken,
                     startedAt,
                     currentUserContent,
                     turnMessages: seed.turnMessages,
+                    ...(seed.fullTranscript ? { fullTranscript: true } : {}),
                     interruption: typeof interruption?.snapshot === 'function'
                         ? interruption.snapshot()
                         : emptyInterruptionSnapshot(),
@@ -196,10 +200,16 @@ export function recoverTurnCheckpoint(session) {
     });
     const current = Array.isArray(session.messages) ? session.messages : [];
     const start = findTurnStart(current, checkpoint.currentUserContent);
-    session.messages = [
-        ...(start >= 0 ? current.slice(0, start) : current),
-        ...finalized.messages,
-    ];
+    session.messages = checkpoint.fullTranscript === true
+        ? finalized.messages
+        : [
+            ...(start >= 0 ? current.slice(0, start) : current),
+            ...finalized.messages,
+        ];
+    // Keep the last provider reading across restart. Pressure resolution
+    // validates its message-prefix signature against this recovered transcript:
+    // a matching durable prefix stays authoritative, while any rewritten
+    // prefix falls back to a local estimate until the next provider response.
     delete session.activeTurnCheckpoint;
     delete session.providerState;
     delete session._providerPrefixGuardState;

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -12,6 +12,7 @@ import {
     shouldCompactForSession,
     countPrunedToolOutputs,
     rememberCompactTelemetry,
+    recordContextUsageSnapshot,
     emitCompactEvent,
     compactEventType,
     resolveSemanticSummaryModel,
@@ -25,6 +26,7 @@ import {
 } from './compact.mjs';
 import { runRecallFastTrackCompact } from './loop/recall-fasttrack.mjs';
 import { estimateMessagesTokensSafe } from './loop/compact-debug.mjs';
+import { hasPendingNativeTokenCounts, withSyncTokenCounts } from './context-utils.mjs';
 import { messagesArrayChanged } from './loop/tool-helpers.mjs';
 import { normalizeUsage, addUsage } from './loop/usage.mjs';
 import { agentContextOverflowError } from './loop/context-overflow.mjs';
@@ -69,23 +71,46 @@ export async function runPreSendCompactPass(state) {
             // a best-effort JSON.stringify length — close enough to the
             // payload we hand the provider for prefix-cache analysis.
             const beforeCount = messages.length;
-            const messageTokensEst = estimateMessagesTokensSafe(messages);
+            let messageTokensEst = estimateMessagesTokensSafe(messages);
             const reactivePending = reactiveOverflowRetryPending === true;
-            const pressureTokens = compactionTelemetryPressureTokens(messageTokensEst, compactPolicy, {
+            let pressureTokens = compactionTelemetryPressureTokens(messageTokensEst, compactPolicy, {
                 reactivePending,
                 messages,
                 sessionRef,
             });
-            // This is the exact canonical value used by the decision below.
-            // Reactive overflow recovery floors it at the trigger so the gauge,
-            // telemetry, and forced compact still describe the same event.
-            const gaugeBeforeTokens = pressureTokens;
-            const shouldCompact = shouldCompactForSession(messageTokensEst, compactPolicy, {
+            let shouldCompact = shouldCompactForSession(messageTokensEst, compactPolicy, {
                 forceReactive: reactivePending,
                 messages,
                 sessionRef,
                 pressureTokens,
             });
+            // Large fresh strings (>=32KB) may still be counting on the native
+            // token server; until the exact count lands, estimateTokens serves
+            // the CONSERVATIVE legacy heuristic. Never fire a compaction off
+            // that transient overshoot: when the decision says compact while
+            // counts are pending, redo the estimate synchronously (exact BPE)
+            // and re-decide. The fast path pays nothing; a genuine trigger
+            // pays one exact encode whose result seeds the shared cache.
+            if (shouldCompact && !reactivePending && hasPendingNativeTokenCounts()) {
+                withSyncTokenCounts(() => {
+                    messageTokensEst = estimateMessagesTokensSafe(messages);
+                    pressureTokens = compactionTelemetryPressureTokens(messageTokensEst, compactPolicy, {
+                        reactivePending,
+                        messages,
+                        sessionRef,
+                    });
+                });
+                shouldCompact = shouldCompactForSession(messageTokensEst, compactPolicy, {
+                    forceReactive: reactivePending,
+                    messages,
+                    sessionRef,
+                    pressureTokens,
+                });
+            }
+            // This is the exact canonical value used by the decision above.
+            // Reactive overflow recovery floors it at the trigger so the gauge,
+            // telemetry, and forced compact still describe the same event.
+            const gaugeBeforeTokens = pressureTokens;
             // Gauge sync (user: 컴팩트될 때 컨텍스트 표기량이 달랐다). The host
             // refreshes its context readout on provider usage deltas and turn
             // end, so a tool batch that pushed the transcript over the trigger
@@ -482,7 +507,7 @@ export async function runPreSendCompactPass(state) {
                     afterTokens,
                     messageTokensEst,
                     pressureTokens,
-                    compactChanged,
+                    compactChanged: compactChanged || summaryChanged,
                     semanticCompact: semanticCompactResult?.semantic === true,
                     semanticError: semanticCompactError?.message || null,
                     recallFastTrack: recallFastTrackResult?.recallFastTrack === true,
@@ -491,6 +516,14 @@ export async function runPreSendCompactPass(state) {
                     pruneCount,
                     durationMs: compactDurationMs,
                 });
+                if (compactChanged || summaryChanged || pruneCount > 0) {
+                    recordContextUsageSnapshot(sessionRef, compactPolicy, {
+                        messages,
+                        usedTokens: afterTokens,
+                        messageTokensEst: afterMessageTokensEst,
+                        source: 'post_compact',
+                    });
+                }
                 let afterBytes = null;
                 try { afterBytes = Buffer.byteLength(JSON.stringify(messages), 'utf8'); } catch { afterBytes = null; }
                 traceAgentCompact({

package/src/runtime/agent/orchestrator/session/provider-prefix-guard.mjs

@@ -15,13 +15,63 @@ function digest(value) {
     return createHash('sha256').update(encoded).digest('hex');
 }
 
-function snapshot(messages, requestPrefix) {
+function cacheRelevantRequestPrefix(requestPrefix, provider) {
+    const prefix = requestPrefix && typeof requestPrefix === 'object'
+        ? requestPrefix
+        : {};
+    const anthropic = /^(?:anthropic|anthropic-oauth)$/i.test(String(provider || ''));
+    const cacheRelevantTools = (tools) => (
+        Array.isArray(tools)
+            ? tools.filter((tool) => !anthropic
+                || (tool?.deferLoading !== true && tool?.defer_loading !== true))
+            : []
+    );
+    return {
+        ...prefix,
+        tools: cacheRelevantTools(prefix.tools),
+        nativeTools: cacheRelevantTools(prefix.nativeTools),
+    };
+}
+
+function snapshot(messages, requestPrefix, options = {}) {
+    const provider = String(options.provider || '');
+    const model = String(options.model || '');
+    const relevantPrefix = cacheRelevantRequestPrefix(requestPrefix, provider);
     return {
         messageHashes: messages.map(digest),
-        requestPrefixHash: digest(requestPrefix),
+        requestPrefixHash: digest({ provider, model, requestPrefix: relevantPrefix }),
+        provider,
+        model,
+        toolSchemaHash: digest(relevantPrefix.tools),
+        nativeToolSchemaHash: digest(relevantPrefix.nativeTools),
     };
 }
 
+function firstChangedMessageIndex(previousHashes, nextHashes) {
+    const limit = Math.min(previousHashes.length, nextHashes.length);
+    for (let index = 0; index < limit; index += 1) {
+        if (previousHashes[index] !== nextHashes[index]) return index;
+    }
+    return nextHashes.length < previousHashes.length ? nextHashes.length : null;
+}
+
+function notifyCacheBreak(options, details) {
+    try { options.onCacheBreak?.(details); } catch { /* observability only */ }
+}
+
+function requestPrefixChangeReason(previous, next) {
+    if (previous.provider !== undefined && previous.provider !== next.provider) return 'provider_changed';
+    if (previous.model !== undefined && previous.model !== next.model) return 'model_changed';
+    if (previous.toolSchemaHash !== undefined && previous.toolSchemaHash !== next.toolSchemaHash) {
+        return 'tool_schema_changed';
+    }
+    if (previous.nativeToolSchemaHash !== undefined
+        && previous.nativeToolSchemaHash !== next.nativeToolSchemaHash) {
+        return 'native_tool_schema_changed';
+    }
+    return 'request_properties_changed';
+}
+
 export class ProviderPrefixMutationError extends Error {
     constructor(message, details = {}) {
         super(message);
@@ -36,24 +86,91 @@ export function isCompactionPrefixReset(intent) {
 }
 
 export function prepareProviderPrefixGuard(previous, messages, requestPrefix, options = {}) {
-    const next = snapshot(Array.isArray(messages) ? messages : [], requestPrefix);
-    if (!previous || isCompactionPrefixReset(options.cacheBreakIntent)) return next;
+    const next = snapshot(Array.isArray(messages) ? messages : [], requestPrefix, options);
+    if (!previous) return next;
+
+    const previousHashes = Array.isArray(previous.messageHashes) ? previous.messageHashes : [];
+    const nextHashes = next.messageHashes;
+    const changedIndex = firstChangedMessageIndex(previousHashes, nextHashes);
+    const requestPrefixChanged = previous.requestPrefixHash !== next.requestPrefixHash;
+    if (isCompactionPrefixReset(options.cacheBreakIntent)) {
+        if (changedIndex !== null || requestPrefixChanged) {
+            notifyCacheBreak(options, {
+                classification: 'intentional',
+                reason: String(options.cacheBreakIntent),
+                source: 'compaction',
+                provider: options.provider || null,
+                model: options.model || null,
+                index: changedIndex,
+                previousCount: previousHashes.length,
+                nextCount: nextHashes.length,
+                previousHash: changedIndex === null ? null : previousHashes[changedIndex],
+                nextHash: changedIndex === null ? null : nextHashes[changedIndex],
+                previousRequestPrefixHash: previous.requestPrefixHash,
+                nextRequestPrefixHash: next.requestPrefixHash,
+                requestPrefixChanged,
+            });
+        }
+        return next;
+    }
 
-    if (next.messageHashes.length < previous.messageHashes.length) {
-        throw new ProviderPrefixMutationError('provider message history shrank outside compaction', {
+    if (nextHashes.length < previousHashes.length) {
+        const details = {
+            classification: 'unexpected',
+            reason: 'history_shrink',
             provider: options.provider || null,
+            model: options.model || null,
             kind: 'history_shrink',
-        });
+            source: options.mutationSource || null,
+            index: nextHashes.length,
+            previousCount: previousHashes.length,
+            nextCount: nextHashes.length,
+            previousHash: previousHashes[nextHashes.length] || null,
+            nextHash: null,
+            previousRequestPrefixHash: previous.requestPrefixHash,
+            nextRequestPrefixHash: next.requestPrefixHash,
+            requestPrefixChanged,
+        };
+        notifyCacheBreak(options, details);
+        throw new ProviderPrefixMutationError('provider message history shrank outside compaction', details);
     }
-    for (let index = 0; index < previous.messageHashes.length; index += 1) {
-        if (previous.messageHashes[index] === next.messageHashes[index]) continue;
-        throw new ProviderPrefixMutationError('provider message prefix changed outside compaction', {
+    for (let index = 0; index < previousHashes.length; index += 1) {
+        if (previousHashes[index] === nextHashes[index]) continue;
+        const details = {
+            classification: 'unexpected',
+            reason: 'message_prefix',
             provider: options.provider || null,
+            model: options.model || null,
             kind: 'message_prefix',
+            source: options.mutationSource || null,
             index,
-        });
+            previousCount: previousHashes.length,
+            nextCount: nextHashes.length,
+            previousHash: previousHashes[index],
+            nextHash: nextHashes[index],
+            previousRequestPrefixHash: previous.requestPrefixHash,
+            nextRequestPrefixHash: next.requestPrefixHash,
+            requestPrefixChanged,
+        };
+        notifyCacheBreak(options, details);
+        throw new ProviderPrefixMutationError('provider message prefix changed outside compaction', details);
     }
-    if (previous.requestPrefixHash !== next.requestPrefixHash) {
+    if (requestPrefixChanged) {
+        notifyCacheBreak(options, {
+            classification: 'intentional',
+            reason: requestPrefixChangeReason(previous, next),
+            source: 'request_configuration',
+            provider: options.provider || null,
+            model: options.model || null,
+            index: null,
+            previousCount: previousHashes.length,
+            nextCount: nextHashes.length,
+            previousHash: null,
+            nextHash: null,
+            previousRequestPrefixHash: previous.requestPrefixHash,
+            nextRequestPrefixHash: next.requestPrefixHash,
+            requestPrefixChanged: true,
+        });
         // Tool schemas are request metadata, not durable conversation state.
         // App updates may change them between turns, so rebaseline the provider
         // cache prefix after the transcript itself has passed integrity checks.

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -20,7 +20,7 @@ import {
     persistenceMessagesForConfirmedImageRejection,
     promptHasInlineImages,
     shouldStripImagesForRetry,
-    stripInlineImages,
+    stripInlineImagesFromLatestTurn,
 } from './image-strip-recovery.mjs';
 import { setTimeout as sleepMs } from 'timers/promises';
 import { readStreamOutcome } from '../providers/lib/stream-outcome.mjs';
@@ -508,7 +508,7 @@ export async function sendWithRecovery(ctx) {
                 && relayWitness.toolCallsDispatched === 0
                 && (outcome.replaySafe === true || await retractExposedTextForReplay())
             ) {
-                const stripped = stripInlineImages(recoveryMessages);
+                const stripped = stripInlineImagesFromLatestTurn(recoveryMessages);
                 if (stripped.stripped > 0) {
                     try {
                         process.stderr.write(

package/src/runtime/agent/orchestrator/session/store/listing.mjs

@@ -34,6 +34,7 @@ import {
 import { _saveAsyncQueued, _saveWorkerPending } from './save-worker.mjs';
 import { STORED_SESSION_UNREADABLE, _ensureLifecycleFields, _storedSessionFromFile } from './serialize.mjs';
 import { _savePending, deleteSession, markSessionClosed } from '../store.mjs';
+import { isOrdinarySession } from '../store-summary-visibility.mjs';
 
 // Disk mtime of the summary index when the in-memory cache was last refreshed
 // from it — the cross-process staleness detector.
@@ -98,9 +99,15 @@ export function listStoredSessions(options = {}) {
         if (/^[A-Za-z0-9_-]+$/.test(storageId)) invalidStorageIds.add(storageId);
     }
     const stored = [...sessionsById.values()];
-    return options.includeLive === true
+    const listed = options.includeLive === true
         ? _withUnpersistedSessions(stored, invalidStorageIds)
         : stored.sort((a, b) => b.updatedAt - a.updatedAt);
+    // This full-record API is the ordinary catalog boundary. Agent discovery
+    // uses the durable summary/worker indexes instead; callers that explicitly
+    // own an Agent surface can request the unfiltered internal rows.
+    return options.includeAgentOnly === true
+        ? listed
+        : listed.filter(isOrdinarySession);
 }
 
 function _withUnpersistedSessions(stored, invalidStorageIds = new Set()) {

package/src/runtime/agent/orchestrator/session/store/save-worker.mjs

@@ -139,11 +139,20 @@ let _faultSyncedKey = null;
 // optimistic summary row is published: foreign/ambiguous records must never be
 // cached as owned, not even transiently.
 let _writeAuthorityCheck = null;
+let _liveSessionPublisher = null;
 
 export function _setSessionWriteAuthorityCheck(check) {
     _writeAuthorityCheck = typeof check === 'function' ? check : null;
 }
 
+export function _setLiveSessionPublisher(publish) {
+    _liveSessionPublisher = typeof publish === 'function' ? publish : null;
+}
+
+function _publishAdmittedLiveSession(session) {
+    try { _liveSessionPublisher?.(session); } catch { /* observers never affect persistence */ }
+}
+
 function _refuseUnownedWrite(id) {
     if (!_writeAuthorityCheck || !id) return null;
     let refusal = null;
@@ -528,6 +537,7 @@ export function saveSessionAsync(session, opts, options = {}) {
         // Pin the live snapshot BEFORE anything can fail: every failure below
         // leaves this process's memory as the only copy of the newest turn.
         setLiveSession(session);
+        if (options.publishLive !== false) _publishAdmittedLiveSession(session);
         summaryVersion = _cacheSessionSummary(session);
         // The guard carries this snapshot's epoch across the thread boundary,
         // so the worker's own commit is fenced against a newer landed write.
@@ -601,6 +611,7 @@ export function saveSessionAsyncDeferred(session, opts) {
         try {
             _ensureLifecycleFields(session);
             setLiveSession(session);
+            _publishAdmittedLiveSession(session);
             _cacheSessionSummary(session);
         } catch (err) {
             _failWorkerWrite(session?.id, null, [], err, epoch, null, err?.attemptSnapshot ?? null);
@@ -625,7 +636,10 @@ export function saveSessionAsyncDeferred(session, opts) {
             // The promoted save takes its own stamp.
             _releaseSessionIncarnation(pending.incarnation);
             try {
-                saveSessionAsync(pending.session, pending.opts, { epoch: pending.epoch }).then(resolve, reject);
+                saveSessionAsync(pending.session, pending.opts, {
+                    epoch: pending.epoch,
+                    publishLive: false,
+                }).then(resolve, reject);
             } catch (err) {
                 _failWorkerWrite(session?.id, null, [], err, epoch, null, err?.attemptSnapshot ?? null);
                 reject(err);