mixdog 0.9.19 → 0.9.21

package/src/mixdog-session-runtime.mjs

@@ -1,3328 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { performance } from 'node:perf_hooks';
-import httpMod from 'node:http';
-import { ensureStandaloneEnvironment } from './standalone/seeds.mjs';
-import { createStandaloneAgent } from './standalone/agent-tool.mjs';
-import { isAgentOwner } from './runtime/agent/orchestrator/agent-owner.mjs';
-import { EXPLORE_TOOL, runExplore } from './standalone/explore-tool.mjs';
-import { createStandaloneChannelWorker } from './standalone/channel-worker.mjs';
-import { createStandaloneMemoryRuntime } from './standalone/memory-runtime-proxy.mjs';
-import { createStandaloneHookBus } from './standalone/hook-bus.mjs';
-import { writeLastSessionCwd } from './runtime/shared/user-cwd.mjs';
-import { cancelBackgroundTasks } from './runtime/shared/background-tasks.mjs';
-import { createTranscriptWriter } from './runtime/shared/transcript-writer.mjs';
-import { mixdogHome } from './runtime/shared/plugin-paths.mjs';
-import { checkLatestVersion, runGlobalUpdate, localPackageVersion } from './runtime/shared/update-checker.mjs';
-import {
-  modelVisibleToolCompletionMessage,
-  shouldPersistModelVisibleToolCompletion,
-} from './runtime/shared/tool-execution-contract.mjs';
-import {
-  channelNotificationModelContent,
-  shouldMirrorChannelNotificationToPending,
-} from './runtime/shared/channel-notification-routing.mjs';
-import {
-  normalizeAgentPermissionOrNone,
-  readMarkdownDocument,
-} from './runtime/shared/markdown-frontmatter.mjs';
-import { setConfiguredShell } from './runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs';
-import { hasUserConversationMessage } from './runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
-import {
-  beginOAuthProviderLogin,
-  forgetProviderAuth,
-  isKnownProvider,
-  loginOAuthProvider,
-  providerSetup,
-  renderProviderStatus,
-  saveOpenAIUsageSessionKey,
-  saveOpenCodeGoUsageAuth,
-  loginOpenCodeGoUsage,
-  saveProviderApiKey,
-  setLocalProvider,
-} from './standalone/provider-admin.mjs';
-import { createUsageDashboard } from './standalone/usage-dashboard.mjs';
-import { fetchOAuthUsageSnapshot } from './runtime/agent/orchestrator/providers/oauth-usage.mjs';
-import {
-  getModelMetadataSync,
-  warmCatalogsInBackground,
-} from './runtime/agent/orchestrator/providers/model-catalog.mjs';
-import {
-  isResponsesFreeformTool,
-  toResponsesCustomTool,
-} from './runtime/agent/orchestrator/providers/custom-tool-wire.mjs';
-import {
-  channelSetup,
-  deleteSchedule,
-  deleteWebhook,
-  forgetDiscordToken,
-  forgetTelegramToken,
-  forgetWebhookAuthtoken,
-  setChannel,
-  saveDiscordToken,
-  saveTelegramToken,
-  saveSchedule,
-  saveWebhook,
-  saveWebhookAuthtoken,
-  setBackend,
-  setScheduleEnabled,
-  setWebhookEnabled,
-  setWebhookConfig,
-} from './standalone/channel-admin.mjs';
-import {
-  addPlugin as registryAddPlugin,
-  listRegisteredPlugins,
-  pluginAdminStatus,
-  removePlugin as registryRemovePlugin,
-  updatePlugin as registryUpdatePlugin,
-} from './standalone/plugin-admin.mjs';
-import {
-  estimateMessagesTokens,
-  estimateRequestReserveTokens,
-  estimateTranscriptContextUsage,
-  estimateToolSchemaTokens,
-  resolveCompactBufferTokens,
-  resolveCompactTriggerTokens,
-  summarizeContextMessages,
-} from './runtime/agent/orchestrator/session/context-utils.mjs';
-
-import {
-  sessionMessageText,
-  messageContextText,
-  isSessionPreviewNoise,
-  cleanSessionPreview,
-  clean,
-  hasOwn,
-  toolResponseText,
-  isEmptyRecallText,
-  currentSessionRecallRows,
-  sessionHasConversationMessages,
-} from './session-runtime/session-text.mjs';
-import {
-  TOOL_MODES,
-  ALL_EFFORT_LEVELS,
-  EFFORT_LABELS,
-  EFFORT_OPTIONS_BY_PROVIDER,
-  EFFORT_BY_FAMILY,
-  EFFORT_FALLBACKS,
-  normalizeToolMode,
-  normalizeEffortInput,
-  effortOptionsFor,
-  coerceEffortFor,
-  normalizeSavedEffort,
-  effortItemsFor,
-  toolSpecForMode,
-  deferredSurfaceModeForLead,
-} from './session-runtime/effort.mjs';
-import {
-  LAZY_SECRET_PROVIDERS,
-  routeFastKey,
-  fastCapableFor,
-  makeSearchCapableFor,
-  fastPreferenceFor,
-  saveModelSettings,
-} from './session-runtime/model-capabilities.mjs';
-import {
-  DEFAULT_PROVIDER,
-  DEFAULT_MODEL,
-  makeResolveDefaultProvider,
-  findPreset,
-  makeResolveRoute,
-  isLikelyRawModelId,
-  validateRequestedModelSelector,
-  ensureProviderEnabled,
-  normalizeSystemShellConfig,
-  normalizeSystemShellCommand,
-  normalizeAutoClearConfig,
-  resolveAutoClearIdleMs,
-  autoClearIdleMsForProvider,
-  autoClearProviderDefaults,
-  normalizeCompactionConfig,
-  moduleEnabled,
-  setModuleEnabledInConfig,
-  recapEnabled,
-  setRecapEnabledInConfig,
-  formatDurationMs,
-  parseDurationMs,
-  modelMetaLooksResolved,
-  modelSettingsFor,
-  normalizeCompactTypeSetting,
-} from './session-runtime/config-helpers.mjs';
-import {
-  routeForStatusline,
-  writeStatuslineRoute,
-} from './session-runtime/statusline-route.mjs';
-import {
-  normalizeOutputStyleId,
-  listOutputStyleCatalog,
-  findOutputStyle,
-  outputStyleStatus as outputStyleStatusRaw,
-} from './session-runtime/output-styles.mjs';
-import { readJsonSafe, readTextSafe } from './session-runtime/fs-utils.mjs';
-import {
-  readProjectMcpServers,
-  countSkillFiles,
-  mcpScriptForPlugin,
-  normalizePluginMcpServerConfig,
-  pluginManifest,
-  pluginMcpServerName,
-  pluginRawMcpServers,
-  pluginMcpEnableScript,
-  resolveContainedPluginPath,
-} from './session-runtime/plugin-mcp.mjs';
-import {
-  WORKFLOW_ROUTE_SLOTS,
-  FIXED_AGENT_SLOTS,
-  SEARCH_DEFAULT_PROVIDER,
-  SEARCH_DEFAULT_MODEL,
-  workflowPresetId,
-  agentPresetSlot,
-  normalizeAgentId,
-  normalizeWorkflowId,
-  DEFAULT_WORKFLOW_ID,
-  createWorkflowHelpers,
-  normalizeSearchProviderId,
-  isDefaultSearchRouteConfig,
-  isSearchCapableProvider,
-  normalizeSearchRouteConfig,
-  normalizeWorkflowRoute,
-  upsertWorkflowPreset,
-  createWorkflowRouteHelpers,
-} from './session-runtime/workflow.mjs';
-import {
-  MEASURED_TOOL_USAGE,
-  DEFERRED_DEFAULT_FULL_TOOLS,
-  DEFERRED_DEFAULT_READONLY_TOOLS,
-  DEFERRED_DEFAULT_LEAD_TOOLS,
-  toolKind,
-  toolSchemaBucket,
-  estimateToolSchemaBreakdown,
-  measuredToolUsage,
-  parseToolSelection,
-  parseToolSearchQuerySelection,
-  sortedCatalogByMeasuredUsage,
-  filterDisallowedTools,
-  sortedNamesByMeasuredUsage,
-  defaultDeferredToolNames,
-  compactToolSearchDescription,
-  toolRow,
-  toolSearchMatches,
-  applyDeferredToolSurface,
-  selectDeferredTools,
-  renderToolSearch,
-} from './session-runtime/tool-catalog.mjs';
-// Re-exported for external consumers (scripts/tool-smoke.mjs) that imported
-// these from this module before the tool-catalog extraction.
-export { defaultDeferredToolNames, compactToolSearchDescription } from './session-runtime/tool-catalog.mjs';
-import {
-  TOOL_SEARCH_TOOL,
-  CWD_TOOL,
-  SKILL_TOOL,
-  SESSION_MANAGE_TOOL,
-  LEAD_DISALLOWED_TOOLS,
-  applyStandaloneToolDefaults,
-} from './session-runtime/tool-defs.mjs';
-import { ONBOARDING_VERSION, QUICK_SEARCH_MODELS } from './session-runtime/quick-search-models.mjs';
-import {
-  sortProviderModels as sortProviderModelsRaw,
-  providerModelCacheRow as providerModelCacheRowRaw,
-} from './session-runtime/model-recency.mjs';
-import { createNativeSearch } from './session-runtime/native-search.mjs';
-import { createConfigLifecycle } from './session-runtime/config-lifecycle.mjs';
-import { attachSessionHooks } from './session-runtime/session-hooks.mjs';
-import { createQuickModelRows } from './session-runtime/quick-model-rows.mjs';
-import { createWarmupSchedulers } from './session-runtime/warmup-schedulers.mjs';
-import { createPrewarmSchedulers } from './session-runtime/prewarm.mjs';
-import { createMcpGlue } from './session-runtime/mcp-glue.mjs';
-import { createCwdPlugins } from './session-runtime/cwd-plugins.mjs';
-import { createSettingsApi } from './session-runtime/settings-api.mjs';
-import { createProviderModels } from './session-runtime/provider-models.mjs';
-import { createProviderUsage } from './session-runtime/provider-usage.mjs';
-// Re-exported for external consumers (scripts/tool-smoke.mjs) that imported
-// these from this module before the tool-defs extraction.
-export { TOOL_SEARCH_TOOL, SKILL_TOOL };
-// Back-compat test alias; delegates to the extracted helper.
-export function __applyStandaloneToolDefaultsForTest(tool) {
-  return applyStandaloneToolDefaults(tool);
-}
-
-const RUNTIME = './runtime/agent/orchestrator';
-const SEARCH_RUNTIME = './runtime/search/index.mjs';
-const SEARCH_TOOL_DEFS = './runtime/search/tool-defs.mjs';
-const MEMORY_TOOL_DEFS = './runtime/memory/tool-defs.mjs';
-const MEMORY_RUNTIME = './runtime/memory/index.mjs';
-const CHANNEL_TOOL_DEFS = './runtime/channels/tool-defs.mjs';
-const CHANNEL_WORKER_ENTRY = './runtime/channels/index.mjs';
-const CODE_GRAPH_TOOL_DEFS = './runtime/agent/orchestrator/tools/code-graph-tool-defs.mjs';
-const CODE_GRAPH_RUNTIME = './runtime/agent/orchestrator/tools/code-graph.mjs';
-const STATUSLINE_SESSION_ROUTES = './vendor/statusline/src/gateway/session-routes.mjs';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const STANDALONE_SOURCE_ROOT = __dirname;
-// Resource root stays at src/ because defaults/, rules/, runtime/, vendor/ live
-// there. User-owned standalone state lives under MIXDOG_HOME (~/.mixdog).
-const STANDALONE_ROOT = STANDALONE_SOURCE_ROOT;
-const MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
-const STANDALONE_DATA_DIR = process.env.MIXDOG_DATA_DIR || join(MIXDOG_HOME, 'data');
-
-const resolveDefaultProvider = makeResolveDefaultProvider(isKnownProvider);
-const resolveRoute = makeResolveRoute(resolveDefaultProvider);
-const searchCapableFor = makeSearchCapableFor(normalizeSearchProviderId, isSearchCapableProvider);
-
-function envFlag(name) {
-  return /^(1|true|yes|on)$/i.test(String(process.env[name] || ''));
-}
-
-function envPresent(name) {
-  return process.env[name] !== undefined && process.env[name] !== '';
-}
-
-function envDelayMs(name, fallback, { min = 0, max = 60_000 } = {}) {
-  const raw = process.env[name];
-  if (raw === undefined || raw === '') return fallback;
-  const n = Number(raw);
-  if (!Number.isFinite(n)) return fallback;
-  return Math.min(max, Math.max(min, Math.floor(n)));
-}
-
-const BOOT_PROFILE_ENABLED = envFlag('MIXDOG_BOOT_PROFILE');
-const BOOT_PROFILE_START = globalThis.__mixdogBootProfileStart || (globalThis.__mixdogBootProfileStart = performance.now());
-
-function bootProfile(event, fields = {}) {
-  if (!BOOT_PROFILE_ENABLED) return;
-  const elapsedMs = performance.now() - BOOT_PROFILE_START;
-  const parts = [`[mixdog-boot] +${elapsedMs.toFixed(1)}ms`, event];
-  for (const [key, value] of Object.entries(fields || {})) {
-    if (value === undefined || value === null || value === '') continue;
-    parts.push(`${key}=${String(value).replace(/\s+/g, '_')}`);
-  }
-  try { process.stderr.write(`${parts.join(' ')}\n`); } catch {}
-}
-
-async function profiledImport(label, spec, { optional = false } = {}) {
-  const startedAt = performance.now();
-  try {
-    const mod = await import(spec);
-    bootProfile(`import:${label}`, { ms: (performance.now() - startedAt).toFixed(1) });
-    return mod;
-  } catch (error) {
-    bootProfile(`import:${label}:failed`, {
-      ms: (performance.now() - startedAt).toFixed(1),
-      error: error?.message || String(error),
-    });
-    if (optional) return null;
-    throw error;
-  }
-}
-const outputStyleStatus = (dataDir = STANDALONE_DATA_DIR, opts = {}) => outputStyleStatusRaw(STANDALONE_ROOT, dataDir || STANDALONE_DATA_DIR, opts);
-// Workflow/agent pack loaders bound to this runtime's root/data layout.
-const {
-  listWorkflowPacks,
-  activeWorkflowId,
-  loadWorkflowPack,
-  workflowSummary,
-  activeWorkflowSummary,
-  loadAgentDefinition,
-  workflowContextBlock,
-  activeWorkflowContext,
-} = createWorkflowHelpers({
-  rootDir: STANDALONE_ROOT,
-  dataDir: STANDALONE_DATA_DIR,
-  readMarkdownDocument,
-  normalizeAgentPermissionOrNone,
-});
-const {
-  summarizeWorkflowRoutes,
-  routeFromPreset,
-  agentRouteFromConfig,
-} = createWorkflowRouteHelpers({ resolveDefaultProvider, findPreset });
-
-export function __renderToolSearchForTest(args = {}, session = {}, mode = 'full') {
-  return renderToolSearch(args, session, mode);
-}
-
-export function __saveModelSettingsForTest(cfgMod, route, options = {}) {
-  return saveModelSettings(cfgMod, route, options);
-}
-
-export async function createMixdogSessionRuntime({
-  provider,
-  model,
-  cwd = process.cwd(),
-  toolMode = 'full',
-  remote = false,
-} = {}) {
-  bootProfile('session-runtime:start', { provider, model, toolMode, cwd });
-  let remoteEnabled = remote === true;
-  // Remote-mode transcript writer (Discord outbound). Lazily created per
-  // session.id + cwd inside ask(); only active while remoteEnabled.
-  let _transcriptWriter = null;
-  let _twKey = '';
-  // Last assistant text handed to the transcript writer (via onAssistantText),
-  // so the post-turn final-content append can skip an exact duplicate.
-  let _lastAppendedAssistant = '';
-  process.env.MIXDOG_QUIET_SESSION_LOG ??= '1';
-  const standaloneStartedAt = performance.now();
-  ensureStandaloneEnvironment({
-    rootDir: STANDALONE_ROOT,
-    dataDir: STANDALONE_DATA_DIR,
-  });
-  bootProfile('standalone-env:ready', { ms: (performance.now() - standaloneStartedAt).toFixed(1) });
-
-  const importsStartedAt = performance.now();
-  const [
-    cfgMod,
-    sharedCfgMod,
-    reg,
-    mcpClient,
-    mgr,
-    contextMod,
-    internalTools,
-    statusRoutes,
-    searchToolDefs,
-    memoryToolDefs,
-    channelToolDefs,
-    codeGraphToolDefs,
-  ] = await Promise.all([
-    profiledImport('config', `${RUNTIME}/config.mjs`),
-    profiledImport('shared-config', `${RUNTIME}/../../shared/config.mjs`),
-    profiledImport('providers-registry', `${RUNTIME}/providers/registry.mjs`),
-    profiledImport('mcp-client', `${RUNTIME}/mcp/client.mjs`),
-    profiledImport('session-manager', `${RUNTIME}/session/manager.mjs`),
-    profiledImport('context-collect', `${RUNTIME}/context/collect.mjs`),
-    profiledImport('internal-tools', `${RUNTIME}/internal-tools.mjs`),
-    profiledImport('status-routes', STATUSLINE_SESSION_ROUTES, { optional: true }),
-    profiledImport('search-tool-defs', SEARCH_TOOL_DEFS, { optional: true }),
-    profiledImport('memory-tool-defs', MEMORY_TOOL_DEFS, { optional: true }),
-    profiledImport('channel-tool-defs', CHANNEL_TOOL_DEFS, { optional: true }),
-    profiledImport('code-graph-tool-defs', CODE_GRAPH_TOOL_DEFS, { optional: true }),
-  ]);
-  bootProfile('imports:ready', { ms: (performance.now() - importsStartedAt).toFixed(1) });
-  const pluginDataDir = cfgMod.getPluginData();
-  // Re-wire the idle/tombstone sweep. startIdleCleanup() lost its caller in a
-  // refactor, so closed-session tombstones were never deleted after their 24h
-  // grace — the store grew unbounded (observed: 1.8k files / 114MB), which
-  // made summary-index rebuilds and per-save index rewrites stall boot for
-  // seconds. Timer is unref'd and first fires after CLEANUP_INITIAL_DELAY_MS
-  // (5min), so this adds zero boot-path cost.
-  try { mgr.startIdleCleanup?.(); } catch { /* cleanup is best-effort */ }
-  const memoryRuntime = createStandaloneMemoryRuntime({
-    entry: join(STANDALONE_ROOT, MEMORY_RUNTIME.replace(/^\.\//, '')),
-    dataDir: pluginDataDir,
-    cwd,
-  });
-  let memoryModPromise = null;
-  let searchModPromise = null;
-  let codeGraphModPromise = null;
-
-  // Memory module is always-on. `memoryEnabled()` is kept as a thin alias that
-  // now always returns true (callers/compaction helpers still reference it);
-  // the user-facing toggle is `recap` (background cycles only), read via
-  // recapEnabled(config).
-  const memoryEnabled = () => true;
-  const recapEnabledFn = () => recapEnabled(config, true);
-  const channelsEnabled = () => moduleEnabled(config, 'channels', true);
-
-  async function getMemoryModule() {
-    const startedAt = performance.now();
-    memoryModPromise ??= Promise.resolve(memoryRuntime);
-    const mod = await memoryModPromise;
-    if (typeof mod?.init === 'function') {
-      await mod.init();
-    }
-    bootProfile('memory-runtime:ready', { ms: (performance.now() - startedAt).toFixed(1) });
-    return mod;
-  }
-
-  async function getSearchModule() {
-    const startedAt = performance.now();
-    searchModPromise ??= import(SEARCH_RUNTIME);
-    const mod = await searchModPromise;
-    bootProfile('search-runtime:ready', { ms: (performance.now() - startedAt).toFixed(1) });
-    return mod;
-  }
-
-  async function getCodeGraphModule() {
-    const startedAt = performance.now();
-    codeGraphModPromise ??= import(CODE_GRAPH_RUNTIME);
-    const mod = await codeGraphModPromise;
-    bootProfile('code-graph-runtime:ready', { ms: (performance.now() - startedAt).toFixed(1) });
-    return mod;
-  }
-
-  function persistLeadRoute(routeLike) {
-    const leadRoute = normalizeWorkflowRoute(routeLike);
-    if (!leadRoute) return null;
-
-    const nextConfig = { ...(config || {}) };
-    nextConfig.presets = upsertWorkflowPreset(nextConfig.presets, 'lead', leadRoute);
-    nextConfig.workflowRoutes = {
-      ...(nextConfig.workflowRoutes || {}),
-      lead: leadRoute,
-    };
-    nextConfig.default = workflowPresetId('lead');
-
-    saveConfigAndAdopt(nextConfig);
-    return leadRoute;
-  }
-
-  async function closePatchRuntimeIfLoaded(options = {}) {
-    const closer = globalThis.__mixdogCloseNativePatchServers;
-    if (typeof closer !== 'function' || globalThis.__mixdogNativePatchRuntimeTouched !== true) return;
-    bootProfile('patch-runtime:close:start');
-    const startedAt = performance.now();
-    try {
-      await closer(options);
-    } catch {
-      // Best-effort shutdown only; terminal restore must continue.
-    } finally {
-      bootProfile('patch-runtime:close:done', { ms: (performance.now() - startedAt).toFixed(1) });
-    }
-  }
-
-  const configStartedAt = performance.now();
-  let config = cfgMod.loadConfig({ secrets: false });
-  setConfiguredShell(normalizeSystemShellConfig(config.shell).command);
-  let configHasSecrets = false;
-  let route = resolveRoute(config, { provider, model });
-  let searchRoute = normalizeSearchRouteConfig(config.searchRoute);
-  bootProfile('config:ready', { ms: (performance.now() - configStartedAt).toFixed(1) });
-  let mode = normalizeToolMode(toolMode);
-  let session = null;
-  let sessionCreatePromise = null;
-  let currentCwd = cwd;
-  let sessionNeedsCwdRefresh = false;
-  // session_manage tool: reset request scheduled by the model mid-turn,
-  // consumed by the TUI engine at turn end ('clear' | 'compact_clear').
-  let pendingSessionReset = null;
-  let closeRequested = false;
-  const warmupTimers = {
-    providerSetupWarmupTimer: null,
-    providerWarmupTimer: null,
-    providerModelWarmupTimer: null,
-    modelCatalogWarmupTimer: null,
-    statuslineUsageWarmupTimer: null,
-    statuslineUsageRefreshTimer: null,
-  };
-  // Prewarm/channel-start timer handles + async state, owned here so the
-  // teardown clearTimeout sweep still sees them; the prewarm scheduler factory
-  // mutates these objects in place (see createPrewarmSchedulers).
-  const prewarmTimers = {
-    codeGraphPrewarmTimer: null,
-    channelStartTimer: null,
-  };
-  const prewarmState = {
-    codeGraphPrewarmInFlight: false,
-    codeGraphPrewarmQueuedCwd: '',
-    channelStartPromise: null,
-  };
-  let activeTurnCount = 0;
-  let firstTurnCompleted = false;
-  function hookTranscriptPath(sessionId) {
-    const id = clean(sessionId);
-    if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) return null;
-    const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
-    return join(dataDir, 'sessions', `${id}.json`);
-  }
-  function hookEffortPayload() {
-    const level = clean(route.effectiveEffort || route.effort);
-    return level ? { level: level.toLowerCase() } : undefined;
-  }
-  function hookCommonPayload(extra = {}) {
-    const sid = clean(extra.session_id || extra.sessionId || session?.id);
-    return {
-      ...(sid ? { session_id: sid, transcript_path: hookTranscriptPath(sid) } : {}),
-      cwd: currentCwd,
-      permission_mode: session?.permissionMode || 'default',
-      ...(hookEffortPayload() ? { effort: hookEffortPayload() } : {}),
-      ...extra,
-    };
-  }
-  const sessionPrewarmDelayMs = envDelayMs('MIXDOG_SESSION_PREWARM_DELAY_MS', 50, { min: 0, max: 10_000 });
-  const providerSetupWarmupDelayMs = envDelayMs('MIXDOG_PROVIDER_SETUP_WARMUP_DELAY_MS', 300, { min: 0, max: 60_000 });
-  const modelCatalogWarmupDelayMs = envDelayMs('MIXDOG_MODEL_CATALOG_WARMUP_DELAY_MS', 200, { min: 0, max: 60_000 });
-  const providerWarmupDelayMs = envDelayMs('MIXDOG_PROVIDER_WARMUP_DELAY_MS', 1_500, { min: 0, max: 60_000 });
-  // Background model-catalog prefetch delay. Kept short so the first `/model`
-  // open finds a warm cache instead of paying a cold full network load. The
-  // work is async + unref'd, so short-lived detached runtimes still exit
-  // cleanly without waiting on it. Operators can raise it via env if a
-  // detached runtime must avoid the /models round-trip entirely.
-  const providerModelWarmupDelayMs = envDelayMs('MIXDOG_PROVIDER_MODEL_WARMUP_DELAY_MS', 2_000, { min: 0, max: 120_000 });
-  const codeGraphPrewarmDelayMs = envDelayMs('MIXDOG_CODE_GRAPH_PREWARM_DELAY_MS', 250, { min: 0, max: 60_000 });
-  const statuslineUsageWarmupDelayMs = envDelayMs('MIXDOG_STATUSLINE_USAGE_WARMUP_DELAY_MS', 800, { min: 0, max: 60_000 });
-  // Idle keep-alive: re-fetch usage before the statusline's 10-min staleness cut
-  // (LIVE_USAGE_SNAPSHOT_MAX_AGE_MS) so the usage segment does not disappear
-  // while the session sits idle with no turns to trigger a refresh.
-  const statuslineUsageRefreshDelayMs = envDelayMs('MIXDOG_STATUSLINE_USAGE_REFRESH_MS', 240_000, { min: 30_000, max: 540_000 });
-  const channelStartDelayMs = envDelayMs('MIXDOG_CHANNEL_START_DELAY_MS', 10_000, { min: 0, max: 120_000 });
-  const backgroundBusyRetryMs = envDelayMs('MIXDOG_BACKGROUND_BUSY_RETRY_MS', 1_000, { min: 50, max: 10_000 });
-  const sessionPrewarmEnabled = !envFlag('MIXDOG_DISABLE_SESSION_PREWARM')
-    && (envFlag('MIXDOG_ENABLE_SESSION_PREWARM') || envPresent('MIXDOG_SESSION_PREWARM_DELAY_MS'));
-  const providerWarmupEnabled = !envFlag('MIXDOG_DISABLE_PROVIDER_WARMUP')
-    && (
-      envFlag('MIXDOG_ENABLE_PROVIDER_WARMUP')
-      || envFlag('MIXDOG_PROVIDER_WARMUP_BEFORE_FIRST_TURN')
-      || envPresent('MIXDOG_PROVIDER_WARMUP_DELAY_MS')
-      || envPresent('MIXDOG_PROVIDER_MODEL_WARMUP_DELAY_MS')
-    );
-  // Boot-time model-catalog prefetch is intentionally decoupled from the
-  // heavier providerWarmupEnabled gate (which stays opt-in for provider
-  // *init* side effects). Fetching the model list in the background after a
-  // short delay is cheap, fire-and-forget, and unref'd, so it is ON by
-  // default — otherwise the FIRST `/model` open always paid a cold full
-  // network load. Operators can still disable it explicitly.
-  const modelPrefetchEnabled = !envFlag('MIXDOG_DISABLE_PROVIDER_WARMUP')
-    && !envFlag('MIXDOG_DISABLE_MODEL_PREFETCH');
-  const codeGraphPrewarmEnabled = !envFlag('MIXDOG_DISABLE_CODE_GRAPH_PREWARM');
-  const modelCatalogWarmupEnabled = !envFlag('MIXDOG_DISABLE_MODEL_CATALOG_WARMUP');
-  // Lazy code-graph prewarm (default ON): do NOT prewarm at startup / on cwd
-  // change — that fired ~250ms after the first frame and, in a large tree,
-  // burned a worker (and felt like a freeze) before the user did anything.
-  // Instead prewarm ONCE on the first real turn, when a code lookup is actually
-  // imminent. Operators who want the old eager behavior can set
-  // MIXDOG_CODE_GRAPH_PREWARM_EAGER=1.
-  const codeGraphPrewarmLazy = codeGraphPrewarmEnabled && !envFlag('MIXDOG_CODE_GRAPH_PREWARM_EAGER');
-  let codeGraphFirstTurnPrewarmDone = false;
-  const modelMetaByRoute = new Map();
-  const notificationListeners = new Set();
-  // Remote seat listeners (TUI): fired when remote mode flips outside a direct
-  // user action — currently only the superseded (seat stolen) path.
-  const remoteStateListeners = new Set();
-  function emitRemoteStateChange(enabled, reason = '') {
-    for (const listener of [...remoteStateListeners]) {
-      try { listener({ enabled: enabled === true, reason: String(reason || '') }); } catch {}
-    }
-  }
-  const providerModelCaches = {
-    providerModelsCache: { models: null, at: 0 },
-    providerModelsPromise: null,
-    providerModelsLoadSeq: 0,
-    searchProviderModelsCache: { models: null, at: 0 },
-  };
-  const providerUsageCaches = {
-    usageDashboardCache: { dashboard: null, at: 0 },
-    usageDashboardPromise: null,
-    providerSetupCache: { setup: null, at: 0 },
-    providerSetupQuickCache: { setup: null, at: 0 },
-    providerSetupPromise: null,
-  };
-  let providerInitPromise = null;
-  let lastProjectMcpKey = null;
-  // MCP connect state, owned here so teardown/reconnect paths still observe it;
-  // the mcp-glue factory mutates this object in place (see createMcpGlue).
-  const mcpState = {
-    mcpFailures: [],
-    mcpConnectGeneration: 0,
-    mcpConnectInFlight: null,
-  };
-  // MCP glue factory — config/currentCwd live-bound; connect state shared via
-  // the caller-owned mcpState object above.
-  const {
-    mcpTransportLabel,
-    resolveEffectiveMcpServers,
-    mcpStatus,
-    connectConfiguredMcp,
-    normalizeMcpServerInput,
-  } = createMcpGlue({
-    mcpClient,
-    getConfig: () => config,
-    getCurrentCwd: () => currentCwd,
-    state: mcpState,
-  });
-  let preSessionToolSurface = null;
-  let contextStatusCacheKey = null;
-  let contextStatusCacheValue = null;
-  const hooksStartedAt = performance.now();
-  const hooks = createStandaloneHookBus({ dataDir: cfgMod.getPluginData() });
-  hooks.emit('runtime:start', { cwd: currentCwd, provider: route.provider, model: route.model, toolMode: mode });
-  bootProfile('hooks:ready', { ms: (performance.now() - hooksStartedAt).toFixed(1) });
-
-  // ---------------------------------------------------------------------
-  // Self-update (npm registry version check + optional auto-install).
-  // updateCheckState mirrors the last-known checkLatestVersion() result;
-  // updateProcessState tracks the in-flight install lifecycle so the TUI can
-  // poll getUpdateStatus() instead of needing a push/event channel. Both are
-  // purely in-memory (per runtime instance) — the on-disk cache lives inside
-  // update-checker.mjs and is what actually enforces the 24h TTL.
-  let updateCheckState = {
-    currentVersion: null,
-    latestVersion: null,
-    updateAvailable: false,
-    lastCheckedAt: 0,
-  };
-  // phase: 'idle' | 'checking' | 'installing' | 'installed' | 'failed'
-  let updateProcessState = { phase: 'idle', version: null, error: null };
-
-  function autoUpdateEnabled() {
-    return config?.update?.auto !== false;
-  }
-
-  async function checkForUpdateInternal({ force = false } = {}) {
-    if (updateProcessState.phase !== 'installing') updateProcessState.phase = 'checking';
-    try {
-      const result = await checkLatestVersion({ force, dataDir: cfgMod.getPluginData?.() || STANDALONE_DATA_DIR });
-      updateCheckState = {
-        currentVersion: result.currentVersion,
-        latestVersion: result.latestVersion,
-        updateAvailable: result.updateAvailable,
-        lastCheckedAt: result.lastCheckedAt,
-      };
-    } catch {
-      // checkLatestVersion() is already silent-safe; this catch is belt-and-
-      // braces so a boot-time call can never crash the runtime.
-    } finally {
-      if (updateProcessState.phase === 'checking') updateProcessState.phase = 'idle';
-    }
-    return updateCheckState;
-  }
-
-  async function runUpdateNowInternal() {
-    if (updateProcessState.phase === 'installing') {
-      return { ...updateProcessState, alreadyInstalling: true, error: 'update already in progress' };
-    }
-    updateProcessState = { phase: 'installing', version: null, error: null };
-    try {
-      const result = await runGlobalUpdate();
-      if (result?.ok) {
-        updateProcessState = { phase: 'installed', version: result.version || null, error: null };
-      } else {
-        updateProcessState = { phase: 'failed', version: null, error: result?.error || 'update failed' };
-      }
-    } catch (err) {
-      updateProcessState = { phase: 'failed', version: null, error: err?.message || String(err) };
-    }
-    return updateProcessState;
-  }
-
-  // Non-blocking boot hook: fires after the runtime object below is fully
-  // constructed (setTimeout(0) defers past the synchronous return), so a
-  // slow/hanging registry request or npm install can never delay session
-  // boot. Auto-update defaults to ON unless config.update.auto is explicitly
-  // false; a failed check or install is
-  // swallowed — getUpdateStatus()/getUpdateSettings() are the only surfaces,
-  // there is no push notice channel from runtime -> TUI today.
-  // force:true — always hit the registry at boot (the 24h disk cache went
-  // stale-visible: it kept reporting an older "latest" than the installed
-  // version). checkLatestVersion() still falls back to the cache offline.
-  const updateBootTimer = setTimeout(() => {
-    void (async () => {
-      await checkForUpdateInternal({ force: true });
-      if (autoUpdateEnabled() && updateCheckState.updateAvailable) {
-        await runUpdateNowInternal();
-      }
-    })().catch(() => {});
-  }, 0);
-  updateBootTimer.unref?.();
-
-  function emitRuntimeNotification(content, meta = {}) {
-    const text = String(content || '').trim();
-    if (!text) return false;
-    const event = { content: text, meta: meta && typeof meta === 'object' ? meta : {} };
-    let handled = false;
-    for (const listener of [...notificationListeners]) {
-      try {
-        if (listener(event) === true) handled = true;
-      } catch {}
-    }
-    return handled;
-  }
-
-  function notifyFnForSession(callerSessionId) {
-    return (text, meta = {}) => {
-      const handledByRuntimeListener = emitRuntimeNotification(text, meta);
-      let enqueued = false;
-      // TUI sessions consume raw execution notifications for UI/task cards via
-      // onNotification, but those raw envelopes are internal-only in pending
-      // drain. Always mirror terminal completions with a model-visible wrapper
-      // while keeping the raw text for UI display.
-      if (callerSessionId && typeof mgr.enqueuePendingMessage === 'function'
-        && shouldPersistModelVisibleToolCompletion(text, meta)) {
-        try {
-          const visible = modelVisibleToolCompletionMessage(text, meta);
-          if (visible) enqueued = mgr.enqueuePendingMessage(callerSessionId, visible) > 0;
-        } catch {}
-      }
-      // Headless/API listeners may exist but not consume the event; preserve
-      // the old fallback for non-terminal notifications only when unhandled.
-      if (!enqueued && !handledByRuntimeListener && callerSessionId
-        && typeof mgr.enqueuePendingMessage === 'function') {
-        try {
-          const visible = modelVisibleToolCompletionMessage(text, meta);
-          if (visible) enqueued = mgr.enqueuePendingMessage(callerSessionId, visible) > 0;
-        } catch {}
-      }
-      return enqueued || handledByRuntimeListener;
-    };
-  }
-
-  function skillsStatus() {
-    const skills = typeof contextMod.collectSkillsCached === 'function'
-      ? contextMod.collectSkillsCached(currentCwd)
-      : [];
-    const norm = (value) => String(value || '').replace(/\\/g, '/').toLowerCase();
-    const cwdNorm = norm(currentCwd);
-    const sourceForSkill = (filePath) => {
-      const path = norm(filePath);
-      if (cwdNorm && path.startsWith(`${cwdNorm}/.mixdog/skills/`)) return 'project';
-      return 'skill';
-    };
-    return {
-      cwd: currentCwd,
-      count: skills.length,
-      skills: skills.map((skill) => ({
-        name: skill.name,
-        description: skill.description || '',
-        filePath: skill.filePath || null,
-        source: sourceForSkill(skill.filePath),
-      })),
-    };
-  }
-
-  // cwd resolution/apply + plugins-status + core-memory context. Extracted to
-  // session-runtime/cwd-plugins.mjs; the facade keeps ownership of the mutable
-  // currentCwd/session/config/lastProjectMcpKey locals via getter/setter
-  // injection and passes the later-defined callbacks (prewarm/tool-surface/
-  // memory) as closures.
-  const {
-    resolveCwdPath,
-    applyResolvedCwd,
-    refreshSessionForCwdIfNeeded,
-    pluginsStatus,
-    loadCoreMemoryContext,
-  } = createCwdPlugins({
-    getCurrentCwd: () => currentCwd,
-    setCurrentCwd: (next) => { currentCwd = next; },
-    getConfig: () => config,
-    getSession: () => session,
-    getRoute: () => route,
-    getLastProjectMcpKey: () => lastProjectMcpKey,
-    setLastProjectMcpKey: (next) => { lastProjectMcpKey = next; },
-    isCodeGraphPrewarmLazy: () => codeGraphPrewarmLazy,
-    isCodeGraphFirstTurnPrewarmDone: () => codeGraphFirstTurnPrewarmDone,
-    getCodeGraphPrewarmDelayMs: () => codeGraphPrewarmDelayMs,
-    setSessionNeedsCwdRefresh: (next) => { sessionNeedsCwdRefresh = next; },
-    connectConfiguredMcp,
-    invalidatePreSessionToolSurface: (...a) => invalidatePreSessionToolSurface(...a),
-    scheduleCodeGraphPrewarm: (...a) => scheduleCodeGraphPrewarm(...a),
-    hooks,
-    hookCommonPayload: (...a) => hookCommonPayload(...a),
-    bootProfile,
-    getMemoryModule: (...a) => getMemoryModule(...a),
-    listRegisteredPlugins,
-    pluginAdminStatus,
-    pluginManifest,
-    pluginMcpServerName,
-    mcpScriptForPlugin,
-    countSkillFiles,
-    readProjectMcpServers,
-    writeLastSessionCwd,
-    clean,
-    resolve,
-    statSync,
-    existsSync,
-    cfgMod,
-    STANDALONE_DATA_DIR,
-  });
-
-  function skillContent(name) {
-    const res = typeof contextMod.loadSkillResource === 'function'
-      ? contextMod.loadSkillResource(name, currentCwd)
-      : null;
-    if (!res) throw new Error(`skill not found: ${name}`);
-    return { name, content: res.content, dir: res.dir };
-  }
-
-  function skillToolContent(name) {
-    if (typeof contextMod.isSkillDisabled === 'function' && contextMod.isSkillDisabled(name)) {
-      const label = String(name || '').trim() || 'skill';
-      return `Error: skill "${label}" is disabled`;
-    }
-    const skill = skillContent(name);
-    // Return the general tool envelope so the main/Lead session behaves the
-    // same as agent-loop sessions: the model-visible tool_result is the short
-    // stub (`Loaded skill: <name>`) and the full SKILL.md body is delivered
-    // ONCE as a separate injected role:'user' message (newMessages). The
-    // envelope passes through internal-tools._normalize untouched (it preserves
-    // __toolEnvelope objects), and the agent loop's central normalizeToolEnvelope
-    // splits it into stub + injected user body.
-    return contextMod.buildSkillToolEnvelope(skill.name, skill.content, skill.dir);
-  }
-
-  function addProjectSkill(input = {}) {
-    const name = clean(input.name).replace(/[^a-zA-Z0-9_.-]+/g, '-').replace(/^-+|-+$/g, '');
-    if (!name) throw new Error('skill name is required');
-    const dir = join(currentCwd, '.mixdog', 'skills', name);
-    const filePath = join(dir, 'SKILL.md');
-    if (existsSync(filePath)) throw new Error(`skill already exists: ${name}`);
-    const description = clean(input.description) || 'Project skill.';
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(filePath, [
-      '---',
-      `name: ${name}`,
-      `description: ${description}`,
-      '---',
-      '',
-      '# Instructions',
-      '',
-      'Describe when and how to use this skill.',
-      '',
-    ].join('\n'), 'utf8');
-    return { name, filePath };
-  }
-
-  const agentToolStartedAt = performance.now();
-  const agentTool = createStandaloneAgent({
-    cfgMod,
-    reg,
-    mgr,
-    dataDir: cfgMod.getPluginData(),
-    cwd,
-    // SubagentStart/SubagentStop: bridge internal worker spawn/finish to the
-    // standard hook bus. agent_type is passed top-level via hookCommonPayload
-    // (added to hook-bus buildEventPayload passthrough). Best-effort.
-    onSubagentEvent: (phase, info = {}) => {
-      try {
-        const event = phase === 'stop' ? 'SubagentStop' : 'SubagentStart';
-        void hooks.dispatch(event, hookCommonPayload({
-          session_id: info?.session_id || null,
-          agent_type: info?.agent_type || null,
-        }));
-      } catch { /* best-effort: subagent hook must never affect worker lifecycle */ }
-    },
-  });
-  bootProfile('agent:ready', { ms: (performance.now() - agentToolStartedAt).toFixed(1) });
-  const agentStatusState = () => {
-    try {
-      const status = agentTool.getStatus?.({ clientHostPid: session?.clientHostPid || process.pid }) || {};
-      return {
-        agentWorkers: Array.isArray(status.workers) ? status.workers : [],
-        agentJobs: Array.isArray(status.jobs) ? status.jobs : [],
-        agentScope: status.scope || null,
-      };
-    } catch {
-      return { agentWorkers: [], agentJobs: [], agentScope: null };
-    }
-  };
-  const channelsStartedAt = performance.now();
-  const channels = createStandaloneChannelWorker({
-    entry: join(STANDALONE_ROOT, CHANNEL_WORKER_ENTRY.replace(/^\.\//, '')),
-    rootDir: STANDALONE_ROOT,
-    dataDir: cfgMod.getPluginData(),
-    cwd,
-    onNotify: (msg) => {
-      // Single-holder remote: the worker reports it lost the bridge seat to a
-      // newer remote session. Drop remote mode entirely on this session (no
-      // handover, no retry) and tell UI listeners so the indicator updates.
-      if (msg?.method === 'notifications/mixdog/remote') {
-        if (msg?.params?.state === 'superseded' && remoteEnabled) {
-          stopRemote('superseded-by-newer-remote-session');
-          emitRemoteStateChange(false, 'superseded');
-        }
-        // Symmetric acquire: the worker took the bridge seat (boot make-before-
-        // break or activate). Flip remote ON via the same side-state a user
-        // /remote toggles — remoteEnabled + transcript writer — but WITHOUT
-        // re-invoking channel start (the worker is already running; startRemote
-        // would re-fork/activate). Idempotent: no-op when already enabled.
-        if (msg?.params?.state === 'acquired' && !remoteEnabled) {
-          remoteEnabled = true;
-          ensureRemoteTranscriptWriter();
-          emitRemoteStateChange(true, 'acquired');
-        }
-        return;
-      }
-      if (msg?.method !== 'notifications/claude/channel') return;
-      const params = msg?.params && typeof msg.params === 'object' ? msg.params : {};
-      const meta = params.meta && typeof params.meta === 'object' ? params.meta : {};
-      const content = channelNotificationModelContent(params);
-      if (!content) return;
-      const handled = emitRuntimeNotification(content, meta);
-      if (!handled && session?.id && shouldMirrorChannelNotificationToPending(meta)) {
-        try { mgr.enqueuePendingMessage(session.id, content); } catch {}
-      }
-    },
-  });
-  bootProfile('channels:worker-ready', { ms: (performance.now() - channelsStartedAt).toFixed(1) });
-  const toolsStartedAt = performance.now();
-  const standaloneTools = [
-    TOOL_SEARCH_TOOL,
-    SKILL_TOOL,
-    CWD_TOOL,
-    SESSION_MANAGE_TOOL,
-    EXPLORE_TOOL,
-    ...(searchToolDefs?.TOOL_DEFS || []).filter((tool) => tool?.name === 'search' || tool?.name === 'web_fetch'),
-    ...(memoryToolDefs?.TOOL_DEFS || []).filter((tool) => tool?.name === 'recall' || tool?.name === 'memory'),
-    ...(channelToolDefs?.TOOL_DEFS || []).filter((tool) => channels.isChannelTool(tool?.name)),
-    ...(codeGraphToolDefs?.CODE_GRAPH_TOOL_DEFS || []).filter((tool) => tool?.name === 'code_graph'),
-    ...agentTool.tools,
-  ].map(applyStandaloneToolDefaults);
-  bootProfile('tools:ready', { ms: (performance.now() - toolsStartedAt).toFixed(1), count: standaloneTools.length });
-
-  function invalidatePreSessionToolSurface() {
-    preSessionToolSurface = null;
-  }
-
-  function invalidateContextStatusCache() {
-    contextStatusCacheKey = null;
-    contextStatusCacheValue = null;
-  }
-
-  function buildPreSessionToolSurface() {
-    const previewTools = typeof mgr.previewSessionTools === 'function'
-      ? mgr.previewSessionTools(toolSpecForMode(mode), [])
-      : [];
-    const tools = filterDisallowedTools(previewTools, LEAD_DISALLOWED_TOOLS);
-    const surface = { tools: Array.isArray(tools) ? tools.slice() : [] };
-    applyDeferredToolSurface(surface, deferredSurfaceModeForLead(mode), standaloneTools, { provider: route.provider });
-    return surface;
-  }
-
-  function activeToolSurface() {
-    if (session) return session;
-    preSessionToolSurface ??= buildPreSessionToolSurface();
-    return preSessionToolSurface;
-  }
-
-  function applyPreSessionToolSelection() {
-    if (!session || !preSessionToolSurface) return;
-    const selected = Array.isArray(preSessionToolSurface.deferredSelectedTools)
-      ? preSessionToolSurface.deferredSelectedTools
-      : [];
-    const discovered = Array.isArray(preSessionToolSurface.deferredDiscoveredTools)
-      ? preSessionToolSurface.deferredDiscoveredTools
-      : [];
-    const replay = [...new Set([...selected, ...discovered])];
-    if (replay.length) selectDeferredTools(session, replay, deferredSurfaceModeForLead(mode));
-  }
-  internalTools.setInternalToolsProvider({
-    tools: standaloneTools,
-    executor: async (name, args, callerCtx = {}) => {
-      const callerCwd = callerCtx?.callerCwd || currentCwd;
-      if (name === 'search' || name === 'web_fetch') {
-        const callerSessionId = callerCtx?.callerSessionId || session?.id || null;
-        const searchMod = await getSearchModule();
-        if (!searchMod?.handleToolCall) throw new Error('search runtime is not available');
-        return await searchMod.handleToolCall(name, args || {}, {
-          callerCwd,
-          callerSessionId,
-          routingSessionId: callerSessionId,
-          clientHostPid: callerCtx?.clientHostPid || session?.clientHostPid || process.pid,
-          notifyFn: notifyFnForSession(callerSessionId),
-          nativeSearch: name === 'search'
-            ? async (searchArgs) => runNativeWebSearch(searchArgs, { signal: callerCtx?.signal || session?.controller?.signal })
-            : undefined,
-        });
-      }
-      if (name === 'recall' || name === 'memory' || name === 'search_memories') {
-        const memoryMod = await getMemoryModule();
-        if (!memoryMod?.handleToolCall) throw new Error('memory runtime is not available');
-        return await memoryMod.handleToolCall(name, args || {});
-      }
-      if (name === 'code_graph') {
-        const codeGraphMod = await getCodeGraphModule();
-        if (!codeGraphMod?.executeCodeGraphTool) throw new Error('code_graph runtime is not available');
-        return await codeGraphMod.executeCodeGraphTool(name, args || {}, args?.cwd || callerCwd);
-      }
-      if (name === 'tool_search') {
-        return renderToolSearch(args, activeToolSurface(), mode);
-      }
-      if (name === 'explore') {
-        const callerSessionId = callerCtx?.callerSessionId || session?.id || null;
-        return await runExplore(args || {}, {
-          callerCwd: args?.cwd ? resolveCwdPath(args.cwd) : callerCwd,
-          callerSessionId,
-          routingSessionId: callerSessionId,
-          clientHostPid: callerCtx?.clientHostPid || session?.clientHostPid || process.pid,
-          notifyFn: notifyFnForSession(callerSessionId),
-        });
-      }
-      if (name === 'cwd') {
-        const action = clean(args?.action || (args?.path ? 'set' : 'get')).toLowerCase();
-        if (action === 'set') {
-          applyResolvedCwd(resolveCwdPath(args?.path));
-        } else if (action !== 'get') {
-          throw new Error(`cwd: unknown action "${action}"`);
-        }
-        return JSON.stringify({ cwd: currentCwd, sessionId: session?.id || null }, null, 2);
-      }
-      if (name === 'session_manage') {
-        // Lead/owner sessions only: an agent worker resetting its own
-        // transcript mid-task would corrupt the delegation contract, and it
-        // must never reach the owner conversation either.
-        const callerSessionId = callerCtx?.callerSessionId || null;
-        if (callerSessionId && session?.id && callerSessionId !== session.id) {
-          throw new Error('session_manage: only the lead session may reset the conversation');
-        }
-        if (!session?.id) throw new Error('session_manage: no active session');
-        const action = clean(args?.action).toLowerCase();
-        if (action !== 'clear' && action !== 'compact_clear') {
-          throw new Error(`session_manage: unknown action "${action}" (use clear | compact_clear)`);
-        }
-        // Never clear mid-turn — the loop is still reading the transcript.
-        // Schedule and let the TUI engine consume it at turn end (same
-        // boundary the idle auto-clear uses).
-        // Pin to the current session id so a resume/new-session between
-        // scheduling and consumption can never clear the wrong conversation.
-        pendingSessionReset = { action, sessionId: session.id };
-        return action === 'clear'
-          ? 'Session reset scheduled: full clear will run when this turn ends. All prior context will be gone.'
-          : 'Session reset scheduled: the conversation will be summarized (compact) and cleared when this turn ends; key context carries forward in the summary.';
-      }
-      if (name === 'Skill') {
-        return skillToolContent(args?.name);
-      }
-      if (name === 'agent') {
-        const callerSessionId = callerCtx?.callerSessionId || session?.id || null;
-        return await agentTool.execute(args, {
-          callerCwd,
-          invocationSource: 'model-tool',
-          callerSessionId,
-          clientHostPid: callerCtx?.clientHostPid || session?.clientHostPid || process.pid,
-          signal: callerCtx?.signal,
-          notifyFn: notifyFnForSession(callerSessionId),
-        });
-      }
-      if (channels.isChannelTool(name)) {
-        if (!channelsEnabled()) throw new Error('channels are disabled in settings');
-        return await channels.execute(name, args || {});
-      }
-      throw new Error(`unknown standalone internal tool: ${name}`);
-    },
-  });
-  internalTools.markBootReady?.();
-  try { lastProjectMcpKey = resolve(currentCwd) + '\u0000' + JSON.stringify(readProjectMcpServers(currentCwd)); } catch { lastProjectMcpKey = null; }
-  void connectConfiguredMcp()
-    .then((status) => bootProfile('mcp:ready', {
-      connected: Number(status?.connectedCount || 0),
-      failed: Number(status?.failedCount || 0),
-    }))
-    .catch((error) => bootProfile('mcp:failed', { error: error?.message || String(error) }));
-
-  function reloadChannelsSoon() {
-    channels.execute('reload_config', {}).catch(() => {});
-  }
-
-  function invalidateProviderCaches() {
-    providerModelCaches.providerModelsCache = { models: null, at: 0 };
-    providerModelCaches.providerModelsPromise = null;
-    providerModelCaches.providerModelsLoadSeq += 1;
-    providerModelCaches.searchProviderModelsCache = { models: null, at: 0 };
-    providerUsageCaches.usageDashboardCache = { dashboard: null, at: 0 };
-    providerUsageCaches.usageDashboardPromise = null;
-    providerUsageCaches.providerSetupCache = { setup: null, at: 0 };
-    providerUsageCaches.providerSetupQuickCache = { setup: null, at: 0 };
-    providerUsageCaches.providerSetupPromise = null;
-    providerInitPromise = null;
-    modelMetaByRoute.clear();
-  }
-
-  // Config reload/save/adopt family + output-style status cache. Extracted to
-  // session-runtime/config-lifecycle.mjs; the facade retains ownership of the
-  // config/searchRoute/configHasSecrets mutable locals via getter/setter
-  // injection (the proven mutable-state pattern).
-  const {
-    getOutputStyleStatusCached,
-    invalidateOutputStyleStatusCache,
-    seedOutputStyleStatusCache,
-    adoptConfig,
-    saveConfigAndAdopt,
-    flushConfigSave,
-    flushBackendSave,
-    scheduleBackendSave,
-    flushOutputStyleSave,
-    scheduleOutputStyleSave,
-    reloadFullConfig,
-    ensureFullConfig,
-    displayConfig,
-    ensureConfigForRouteProvider,
-  } = createConfigLifecycle({
-    getConfig: () => config,
-    setConfig: (next) => { config = next; },
-    getSearchRoute: () => searchRoute,
-    setSearchRoute: (next) => { searchRoute = next; },
-    getConfigHasSecrets: () => configHasSecrets,
-    setConfigHasSecrets: (next) => { configHasSecrets = next; },
-    getRoute: () => route,
-    cfgMod,
-    sharedCfgMod,
-    setBackend,
-    setConfiguredShell,
-    normalizeSystemShellConfig,
-    normalizeSearchRouteConfig,
-    outputStyleStatus,
-    LAZY_SECRET_PROVIDERS,
-    clean,
-    resolve,
-    STANDALONE_DATA_DIR,
-  });
-
-  async function ensureProvidersReady(providerConfig = config.providers || {}) {
-    if (providerInitPromise) return await providerInitPromise;
-    providerInitPromise = reg.initProviders(providerConfig)
-      .finally(() => {
-        providerInitPromise = null;
-      });
-    return await providerInitPromise;
-  }
-
-  const {
-    currentMainSearchModelMeta,
-    runNativeWebSearch,
-  } = createNativeSearch({
-    getRoute: () => route,
-    getSearchRoute: () => searchRoute,
-    setSearchRoute: (next) => { searchRoute = next; },
-    getConfig: () => config,
-    getSession: () => session,
-    getReg: () => reg,
-    ensureFullConfig,
-    ensureProvidersReady,
-    ensureProviderEnabled,
-    normalizeSearchProviderId,
-    normalizeSearchRouteConfig,
-    isDefaultSearchRouteConfig,
-    isSearchCapableProvider,
-    searchCapableFor,
-  });
-
-  // Late-bound: createWarmupSchedulers is constructed after this factory, but
-  // cachedProviderSetup(quick) may nudge scheduleProviderSetupWarmup on a cold
-  // quick-cache fill. Thread it by reference so the scheduler is reachable once
-  // it exists (a pre-scheduler quick fill simply skips the warmup nudge).
-  let scheduleProviderSetupWarmupRef = () => {};
-  const {
-    refreshStatuslineUsageSnapshot,
-    cachedProviderSetup,
-    getUsageDashboard,
-  } = createProviderUsage({
-    caches: providerUsageCaches,
-    getConfig: () => config,
-    getReg: () => reg,
-    displayConfig,
-    providerSetup,
-    createUsageDashboard,
-    fetchOAuthUsageSnapshot,
-    isCloseRequested: () => closeRequested,
-    getProviderSetupWarmupTimer: () => warmupTimers.providerSetupWarmupTimer,
-    scheduleProviderSetupWarmup: (delayMs) => scheduleProviderSetupWarmupRef(delayMs),
-  });
-
-  // Holder filled after createQuickModelRows resolves; provider-models and
-  // quick-model-rows are mutually dependent (rows need cache-row helpers, the
-  // model factory needs quick fallbacks) so we thread the quick surface in by
-  // reference after both are constructed.
-  const providerModelQuickHelpers = {};
-  // Late-bound: createWarmupSchedulers is constructed after this factory, but
-  // lookupModelMeta may fire scheduleProviderModelWarmup on a cache miss. Thread
-  // it by reference so the scheduler is called once it exists (miss handling is
-  // best-effort; a pre-scheduler miss simply skips the warmup nudge).
-  let scheduleProviderModelWarmupRef = () => {};
-  const {
-    modelMetaKey,
-    lookupModelMeta,
-    sortProviderModels,
-    providerModelCacheRow,
-    providerModelsFromCacheRows,
-    collectSearchProviderModels,
-    collectProviderModels,
-    warmProviderModelCache,
-  } = createProviderModels({
-    caches: providerModelCaches,
-    modelMetaByRoute,
-    getRoute: () => route,
-    getConfig: () => config,
-    getReg: () => reg,
-    searchCapableFor,
-    sortProviderModelsRaw,
-    providerModelCacheRowRaw,
-    normalizeSearchProviderId,
-    isSearchCapableProvider,
-    ensureFullConfig,
-    ensureProvidersReady,
-    bootProfile,
-    scheduleProviderModelWarmup: () => scheduleProviderModelWarmupRef(),
-    quickHelpers: providerModelQuickHelpers,
-  });
-
-  const {
-    quickProviderModelRows,
-    addDefaultSearchModel,
-    quickSearchProviderModelRows,
-    searchModelsFromRows,
-    searchRowsWithDefault,
-  } = createQuickModelRows({
-    getRoute: () => route,
-    getSearchRoute: () => searchRoute,
-    displayConfig,
-    providerModelCacheRow,
-    providerModelsFromCacheRows,
-    sortProviderModels,
-    modelMetaByRoute,
-    modelMetaKey,
-    normalizeSearchProviderId,
-    normalizeSearchRouteConfig,
-    isSearchCapableProvider,
-    searchCapableFor,
-    currentMainSearchModelMeta,
-  });
-  Object.assign(providerModelQuickHelpers, {
-    quickProviderModelRows,
-    addDefaultSearchModel,
-    quickSearchProviderModelRows,
-    searchModelsFromRows,
-    searchRowsWithDefault,
-  });
-
-  async function resolveMissingRouteModelForFirstTurn() {
-    if (routeHasModel()) return route;
-    const models = await collectProviderModels();
-    const picked = models[0] || null;
-    if (!picked) {
-      throw new Error('No provider models available. Open /providers to sign in, then /model to choose a model.');
-    }
-    route = {
-      ...route,
-      provider: picked.provider,
-      model: picked.id,
-      preset: null,
-    };
-    return route;
-  }
-
-  async function refreshRouteEffort(modelMetaOverride = null) {
-    await ensureProvidersReady(ensureProviderEnabled(config, route.provider));
-    const modelMeta = modelMetaOverride || await lookupModelMeta(route.provider, route.model);
-    const requested = hasOwn(route, 'effort') ? route.effort : (route.preset?.effort || null);
-    const effectiveEffort = coerceEffortFor(route.provider, modelMeta, requested);
-    const fastCapable = fastCapableFor(route.provider, modelMeta);
-    // Carry the catalog display name onto the route so the statusline shows a
-    // human label (e.g. "Claude Fable 5") for preset-less direct models instead
-    // of the raw id. `name` is only trusted when it differs from the raw model
-    // id (some providers echo the id as `name`), so it can't clobber a better
-    // already-resolved label. Falls back to existing route.modelDisplay, then unset.
-    const metaName = clean(modelMeta?.name);
-    const modelDisplay = clean(modelMeta?.display) || clean(modelMeta?.displayName)
-      || (metaName && metaName !== clean(route.model) ? metaName : '')
-      || clean(route.modelDisplay);
-    route = {
-      ...route,
-      fast: fastCapable ? route.fast === true : false,
-      fastCapable,
-      effectiveEffort,
-      effortOptions: effortItemsFor(route.provider, modelMeta, effectiveEffort),
-      ...(modelDisplay ? { modelDisplay } : {}),
-    };
-    return route;
-  }
-
-  function routeHasModel() {
-    return !!clean(route?.model);
-  }
-
-  function requireModelRoute() {
-    if (routeHasModel()) return;
-    throw new Error('No model configured. Open /providers to sign in, then /model to choose a model.');
-  }
-
-  async function recreateCurrentSessionIfReady() {
-    if (!routeHasModel()) {
-      session = null;
-      return null;
-    }
-    return await createCurrentSession();
-  }
-
-  async function createCurrentSession(reason = 'demand') {
-    if (sessionCreatePromise) return await sessionCreatePromise;
-    if (session?.id && !sessionNeedsCwdRefresh) {
-      const liveSession = mgr.getSession(session.id);
-      if (liveSession && liveSession.closed !== true && liveSession.status !== 'closed') {
-        session = liveSession;
-        return session;
-      }
-      session = null;
-    }
-
-    const startedAt = performance.now();
-    bootProfile('session:create:start', { mode, reason });
-    const promise = (async () => {
-      ensureConfigForRouteProvider();
-      await resolveMissingRouteModelForFirstTurn();
-      requireModelRoute();
-      bootProfile('session:create:route-ready', { ms: (performance.now() - startedAt).toFixed(1) });
-      // refreshRouteEffort (effort/model-meta) and loadCoreMemoryContext (memory
-      // files) are independent — refreshRouteEffort only touches route effort/
-      // display fields, never provider/model that the memory load reads — so run
-      // them concurrently instead of serially on the boot path.
-      const [, coreMemoryContext] = await Promise.all([
-        refreshRouteEffort(),
-        loadCoreMemoryContext(),
-      ]);
-      bootProfile('session:create:effort-ready', { ms: (performance.now() - startedAt).toFixed(1) });
-      const providerImpl = reg.getProvider(route.provider);
-      if (!providerImpl) {
-        throw new Error(`Provider "${route.provider}" is not configured.`);
-      }
-      bootProfile('session:create:provider-ready', { ms: (performance.now() - startedAt).toFixed(1) });
-      if (closeRequested) throw new Error('runtime is closing');
-      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
-      // Load the active WORKFLOW.md pack once for both summary + context block.
-      const { summary: workflow, context: workflowContext } = activeWorkflowContext(config, dataDir);
-      const sessionOpts = {
-        provider: route.provider,
-        model: route.model,
-        preset: route.preset || undefined,
-        tools: toolSpecForMode(mode),
-        owner: 'cli',
-        agent: 'lead',
-        lane: 'cli',
-        sourceType: 'lead',
-        sourceName: 'main',
-        clientHostPid: process.pid,
-        disallowedTools: LEAD_DISALLOWED_TOOLS,
-        cwd: currentCwd,
-        coreMemoryContext,
-        workflow,
-        workflowContext,
-        fast: route.fast === true,
-        compaction: config.compaction && typeof config.compaction === 'object'
-          ? normalizeCompactionConfig(config.compaction, { memoryEnabled: memoryEnabled() })
-          : undefined,
-      };
-      if (hasOwn(route, 'effort') || route.effectiveEffort) {
-        sessionOpts.effort = route.effectiveEffort || null;
-      }
-      session = mgr.createSession(sessionOpts);
-      sessionNeedsCwdRefresh = false;
-      attachSessionHooks(session, { hooks, hookCommonPayload, getCwd: () => currentCwd });
-      applyDeferredToolSurface(session, deferredSurfaceModeForLead(mode), standaloneTools, { provider: route.provider });
-      applyPreSessionToolSelection();
-      writeStatuslineRoute(statusRoutes, session, route);
-      hooks.emit('session:create', { sessionId: session.id, provider: route.provider, model: route.model, toolMode: mode, cwd: currentCwd });
-      // SessionStart: bridge to the standard project hook bus. Best-effort;
-      // a hook error must never break session creation. additionalContext is
-      // injected before the first user turn as a system-reminder context pair.
-      try {
-        const startSource = /resume/i.test(String(reason || ''))
-          ? 'resume'
-          : (/clear/i.test(String(reason || '')) ? 'clear' : 'startup');
-        const startDispatch = await hooks.dispatch('SessionStart', hookCommonPayload({ session_id: session.id, source: startSource, model: route.model }));
-        const startContext = Array.isArray(startDispatch?.additionalContext)
-          ? startDispatch.additionalContext.join('\n\n')
-          : String(startDispatch?.additionalContext || '');
-        if (startContext.trim()) {
-          session.messages.push({ role: 'user', content: `<system-reminder>\n# SessionStart Hook Context\n${startContext.trim()}\n</system-reminder>` });
-          session.messages.push({ role: 'assistant', content: '.' });
-          session.updatedAt = Date.now();
-        }
-      } catch { /* best-effort: never break session create */ }
-      bootProfile('session:create:ready', {
-        ms: (performance.now() - startedAt).toFixed(1),
-        reason,
-        tools: Array.isArray(session.tools) ? session.tools.length : 0,
-        catalog: Array.isArray(session.deferredToolCatalog) ? session.deferredToolCatalog.length : 0,
-      });
-      return session;
-    })();
-
-    sessionCreatePromise = promise;
-    try {
-      return await promise;
-    } finally {
-      if (sessionCreatePromise === promise) sessionCreatePromise = null;
-    }
-  }
-
-  const {
-    scheduleProviderWarmup,
-    scheduleProviderSetupWarmup,
-    scheduleProviderModelWarmup,
-    scheduleModelCatalogWarmup,
-    scheduleStatuslineUsageWarmup,
-    scheduleStatuslineUsageRefresh,
-  } = createWarmupSchedulers({
-    timers: warmupTimers,
-    bootProfile,
-    getRoute: () => route,
-    getConfig: () => config,
-    isCloseRequested: () => closeRequested,
-    getActiveTurnCount: () => activeTurnCount,
-    getSessionCreatePromise: () => sessionCreatePromise,
-    getProviderModelsCache: () => providerModelCaches.providerModelsCache,
-    getProviderModelsPromise: () => providerModelCaches.providerModelsPromise,
-    reloadFullConfig,
-    ensureConfigForRouteProvider,
-    ensureProvidersReady,
-    ensureProviderEnabled,
-    refreshStatuslineUsageSnapshot,
-    warmProviderModelCache,
-    cachedProviderSetup,
-    warmCatalogsInBackground,
-    isFirstTurnCompleted: () => firstTurnCompleted,
-    envFlag,
-    delays: {
-      providerWarmupDelayMs,
-      providerSetupWarmupDelayMs,
-      providerModelWarmupDelayMs,
-      modelCatalogWarmupDelayMs,
-      statuslineUsageWarmupDelayMs,
-      statuslineUsageRefreshDelayMs,
-      backgroundBusyRetryMs,
-    },
-    flags: {
-      providerWarmupEnabled,
-      modelPrefetchEnabled,
-      modelCatalogWarmupEnabled,
-    },
-  });
-  scheduleProviderModelWarmupRef = scheduleProviderModelWarmup;
-  scheduleProviderSetupWarmupRef = scheduleProviderSetupWarmup;
-
-  const {
-    scheduleCodeGraphPrewarm,
-    scheduleLeadSessionPrewarm,
-    invokeChannelStart,
-    scheduleChannelStart,
-  } = createPrewarmSchedulers({
-    timers: prewarmTimers,
-    bootProfile,
-    getCurrentCwd: () => currentCwd,
-    isCloseRequested: () => closeRequested,
-    getActiveTurnCount: () => activeTurnCount,
-    getSessionCreatePromise: () => sessionCreatePromise,
-    getSession: () => session,
-    isRemoteEnabled: () => remoteEnabled,
-    channelsEnabled,
-    getCodeGraphModule,
-    createCurrentSession,
-    channels,
-    envFlag,
-    delays: {
-      codeGraphPrewarmDelayMs,
-      channelStartDelayMs,
-      sessionPrewarmDelayMs,
-      backgroundBusyRetryMs,
-    },
-    flags: {
-      codeGraphPrewarmEnabled,
-      sessionPrewarmEnabled,
-    },
-    state: prewarmState,
-  });
-
-  // Eagerly create/refresh the remote transcript writer for the CURRENT
-  // session + cwd, publish the session record, and ensure the transcript
-  // file exists on disk. Called from startRemote() (so the channel worker's
-  // activate-time discovery finds THIS session immediately instead of
-  // waiting for the first turn) and from ask() at turn start. Returns true
-  // when a writer is bound.
-  function ensureRemoteTranscriptWriter() {
-    if (!remoteEnabled || !session?.id) return false;
-    const twKey = `${session.id}\u0000${currentCwd}`;
-    if (_twKey !== twKey) {
-      try {
-        _transcriptWriter = createTranscriptWriter({
-          mixdogHome: mixdogHome(),
-          sessionId: session.id,
-          cwd: currentCwd,
-          pid: process.pid,
-        });
-        _transcriptWriter.writeSessionRecord();
-        _twKey = twKey;
-      } catch (error) {
-        process.stderr.write(`mixdog: transcript-writer: init failed: ${error?.message || error}\n`);
-        _transcriptWriter = null;
-        _twKey = '';
-        return false;
-      }
-    } else {
-      // Same binding — refresh updatedAt so worker-side discovery keeps
-      // ranking this session as the live parent-chain candidate.
-      try { _transcriptWriter?.writeSessionRecord(); } catch {}
-    }
-    try { _transcriptWriter?.ensureTranscriptFile(); }
-    catch (error) { process.stderr.write(`mixdog: transcript-writer: ensureTranscriptFile failed: ${error?.message || error}\n`); }
-    return _transcriptWriter != null;
-  }
-
-  // Remote (Discord channel) mode is opt-in per session. Only a session that
-  // explicitly enables remote — via `mixdog --remote` or the runtime toggle —
-  // boots the channel worker and contends for channel ownership.
-  // startRemote() is FORCE-TAKEOVER: it always (re)claims the bridge seat and
-  // rebinds output forwarding to this session, even when the worker is
-  // already running (e.g. `/remote` re-issued after another session took the
-  // seat, or to re-pin forwarding onto the current transcript).
-  function startRemote() {
-    remoteEnabled = true;
-    // Boot the memory daemon eagerly. The channels worker forwards
-    // transcript ingests/entries to the memory HTTP service, whose port is
-    // published to active-instance.json by getMemoryModule().init(). Without
-    // this, memory only starts on the first turn's getMemoryModule() call —
-    // so early channel traffic finds no memory_port and gets buffered (or,
-    // pre-drainer, silently dropped). Runs BEFORE channel claim so the port is
-    // racing to be live by the time the worker sends its first ingest.
-    //
-    // Not fire-and-forget: init() only resolves the module handle, so a bare
-    // getMemoryModule() could return before /health reports ok — leaving early
-    // ingests to hit a not-yet-listening port. Await the proxy start() and then
-    // poll /health with a bounded retry so the daemon is provably reachable
-    // (or logged failed) rather than assumed-up. Still non-blocking to the
-    // caller: the whole probe is detached, but it internally awaits readiness.
-    void (async () => {
-      try {
-        // Yield one event-loop tick before the heavy chain below (module
-        // resolve, daemon fork/health-poll) starts, so Ink's next render
-        // (scheduled via setImmediate/timers) and any queued keypress
-        // events get a turn first instead of being starved by this
-        // detached chain's synchronous setup work.
-        await new Promise((r) => setImmediate(r));
-        const mod = await getMemoryModule();
-        const started = typeof mod?.start === 'function' ? await mod.start() : null;
-        const port = started?.port;
-        if (!port) { bootProfile('channels:memory-eager-init-failed', { error: 'no port from start()' }); return; }
-        for (let i = 0; i < 30; i++) {
-          try {
-            const ok = await new Promise((res) => {
-              const req = httpMod.request({ hostname: '127.0.0.1', port, path: '/health', timeout: 1500 }, (r) => {
-                let d = ''; r.on('data', (c) => { d += c; }); r.on('end', () => {
-                  try { res(JSON.parse(d)?.status === 'ok'); } catch { res(false); }
-                });
-              });
-              req.on('error', () => res(false));
-              req.on('timeout', () => { req.destroy(); res(false); });
-              req.end();
-            });
-            if (ok) { bootProfile('channels:memory-eager-init-ready', { port }); return; }
-          } catch {}
-          await new Promise((r) => setTimeout(r, 500));
-        }
-        bootProfile('channels:memory-eager-init-failed', { error: `health not ok after retries (port ${port})` });
-      } catch (error) {
-        bootProfile('channels:memory-eager-init-failed', { error: error?.message || String(error) });
-      }
-    })();
-    // Publish this session's record + transcript file BEFORE the worker's
-    // activate-time discovery polls, so output forwarding binds to this
-    // terminal session immediately instead of waiting for the first turn.
-    // No-op when the session has not been created yet (lazy mode); that
-    // case is covered by the turn-start rebind in ask().
-    ensureRemoteTranscriptWriter();
-    // A backend switch may still be sitting in its debounce window; flush it
-    // so the channel worker boots against the backend the user just chose,
-    // not the previous on-disk value.
-    try { flushBackendSave(); } catch {}
-    if (envFlag('MIXDOG_DISABLE_CHANNEL_START')) {
-      bootProfile('channels:start-skipped');
-      return true;
-    }
-    if (!channelsEnabled()) {
-      bootProfile('channels:start-disabled');
-      return true;
-    }
-    if (closeRequested) return true;
-    if (prewarmTimers.channelStartTimer) {
-      clearTimeout(prewarmTimers.channelStartTimer);
-      prewarmTimers.channelStartTimer = null;
-    }
-    bootProfile('channels:start-scheduled', { delayMs: 0, immediate: true });
-    void (async () => {
-      // Yield before the createCurrentSession/transcript/fork chain below —
-      // same rationale as the memory-eager-init yield above: this detached
-      // chain runs synchronous config/fs work (createCurrentSession, backend
-      // flush, transcript writer) back-to-back, and without a tick break it
-      // can run ahead of Ink's queued render/input handling.
-      await new Promise((r) => setImmediate(r));
-      // Immediate-occupancy guarantee: make sure a session + transcript
-      // exist BEFORE the worker boots — a freshly-forked worker claims and
-      // runs transcript discovery inside its own start(), so publishing the
-      // session record/file first lets that very first discovery pass bind
-      // output forwarding to THIS terminal instead of a persisted/stale
-      // neighbour. Lazy mode means the session may not exist yet at /remote
-      // time; create it here (idempotent — reuses a live session, joins an
-      // in-flight create). On create failure we still claim: that matches
-      // the pre-eager behavior (bind resolves on the first turn's rebind).
-      try { await createCurrentSession('remote-start'); }
-      catch (error) { bootProfile('channels:remote-session-create-failed', { error: error?.message || String(error) }); }
-      ensureRemoteTranscriptWriter();
-      // Re-check after the awaits above: stopRemote()/superseded or runtime
-      // close may have landed mid-chain — do not boot/claim for a session
-      // that already turned remote off.
-      if (!remoteEnabled || closeRequested) return;
-      await invokeChannelStart();
-      if (!remoteEnabled || closeRequested) return;
-      // Unconditional claim + forwarder rebind. A freshly-forked worker
-      // already claims in its own start(), so this is idempotent there; the
-      // already-running case is where it matters (last-wins seat overwrite +
-      // transcript rebind onto this session).
-      await channels.execute('activate_channel_bridge', { active: true });
-    })().catch((error) => bootProfile('channels:claim-failed', { error: error?.message || String(error) }));
-    return true;
-  }
-
-  function stopRemote(reason) {
-    remoteEnabled = false;
-    // Cancel any pending deferred start so it can't fire after remote is off.
-    if (prewarmTimers.channelStartTimer) { clearTimeout(prewarmTimers.channelStartTimer); prewarmTimers.channelStartTimer = null; }
-    channels.stop(reason || 'remote-disabled', { waitForExit: false }).catch(() => {});
-    return true;
-  }
-
-  function isRemoteEnabled() {
-    return remoteEnabled;
-  }
-
-  function withTeardownDeadline(promise, ms, fallback = false) {
-    let timer = null;
-    return Promise.race([
-      Promise.resolve(promise),
-      new Promise((resolve) => {
-        timer = setTimeout(() => resolve(fallback), ms);
-      }),
-    ]).finally(() => {
-      if (timer) clearTimeout(timer);
-    });
-  }
-
-  bootProfile('session-runtime:ready', {
-    lazySession: true,
-    prewarmSession: sessionPrewarmEnabled,
-    providerWarmup: providerWarmupEnabled,
-    codeGraphPrewarm: codeGraphPrewarmEnabled,
-  });
-  scheduleLeadSessionPrewarm();
-  // Lazy mode (default): skip the startup prewarm entirely; the first turn
-  // triggers it instead (see ask()). Eager mode keeps the old startup schedule.
-  if (!codeGraphPrewarmLazy) {
-    scheduleCodeGraphPrewarm(codeGraphPrewarmDelayMs, 'startup');
-  } else {
-    bootProfile('code-graph:prewarm-lazy', { reason: 'startup-deferred-to-first-turn' });
-  }
-  scheduleProviderSetupWarmup();
-  scheduleModelCatalogWarmup();
-  scheduleProviderWarmup();
-  // Warm the provider model catalog in the background, but keep it on its own
-  // delay so short-lived detached runtimes can exit before /models I/O starts.
-  // Operators that want earlier catalog warming can lower
-  // MIXDOG_PROVIDER_MODEL_WARMUP_DELAY_MS explicitly.
-  scheduleProviderModelWarmup();
-  scheduleStatuslineUsageWarmup();
-  // Channels are opt-in: only boot the worker when this session started in (or
-  // was toggled into) remote mode. Non-remote sessions never contend for the
-  // channel; see startRemote()/stopRemote() and the `/remote` toggle.
-  // `remote.autoStart` in mixdog-config.json makes every session claim remote
-  // at boot (same force-takeover semantics as `mixdog --remote` / `/remote`).
-  // The flag lives in the TOP-LEVEL `remote` section of mixdog-config.json
-  // (sibling of agent/ui/channels), not inside the agent section that
-  // cfgMod.loadConfig returns — read it via the shared whole-file reader.
-  // `config?.remote?.autoStart` is kept for back-compat with agent-section
-  // placement.
-  if (!remoteEnabled) {
-    try {
-      if (config?.remote?.autoStart === true
-        || sharedCfgMod?.readSection?.('remote')?.autoStart === true) {
-        remoteEnabled = true;
-      }
-    } catch { /* unreadable config never blocks boot */ }
-  }
-  // Boot-time remote start (autoStart or --remote) is DEFERRED past the TUI's
-  // first frame. startRemote() front-loads heavy work — memory daemon fork
-  // (PG + forced ONNX embed warmup in the child), eager session create, and
-  // the channel-worker fork — and running it inline here interleaves that
-  // CPU/disk load with engine boot, visibly delaying the first ink frame by
-  // seconds. The deferred timer reuses prewarmTimers.channelStartTimer so an
-  // early /remote (startRemote clears it), stopRemote(), and close() all
-  // cancel it through the existing clearTimeout paths. Runtime /remote calls
-  // still start immediately (user-initiated, UI already painted).
-  if (remoteEnabled) {
-    const remoteAutoStartDelayMs = envDelayMs('MIXDOG_REMOTE_AUTOSTART_DELAY_MS', 1_500, { min: 0, max: 60_000 });
-    bootProfile('channels:autostart-deferred', { delayMs: remoteAutoStartDelayMs });
-    prewarmTimers.channelStartTimer = setTimeout(() => {
-      prewarmTimers.channelStartTimer = null;
-      if (closeRequested || !remoteEnabled) return;
-      startRemote();
-    }, remoteAutoStartDelayMs);
-    prewarmTimers.channelStartTimer.unref?.();
-  }
-
-  function contextStatusCacheKeyFor({ messages, tools }) {
-    const compaction = session?.compaction || {};
-    const lastMessage = messages[messages.length - 1] || null;
-    return {
-      session,
-      sessionId: session?.id || null,
-      provider: route.provider,
-      model: route.model,
-      cwd: currentCwd,
-      mode,
-      messages,
-      messageCount: messages.length,
-      lastMessage,
-      lastMessageRole: lastMessage?.role || null,
-      lastMessageContent: lastMessage?.content || null,
-      tools,
-      toolCount: tools.length,
-      contextWindow: session?.contextWindow || null,
-      rawContextWindow: session?.rawContextWindow || null,
-      effectiveContextWindowPercent: session?.effectiveContextWindowPercent || null,
-      autoCompactTokenLimit: Number(session?.autoCompactTokenLimit || 0),
-      lastContextTokens: Number(session?.lastContextTokens || 0),
-      lastContextTokensUpdatedAt: Number(session?.lastContextTokensUpdatedAt || 0),
-      lastContextTokensStaleAfterCompact: session?.lastContextTokensStaleAfterCompact === true,
-      lastInputTokens: Number(session?.lastInputTokens || 0),
-      lastUncachedInputTokens: Number(session?.lastUncachedInputTokens || 0),
-      lastOutputTokens: Number(session?.lastOutputTokens || 0),
-      lastCachedReadTokens: Number(session?.lastCachedReadTokens || 0),
-      lastCacheWriteTokens: Number(session?.lastCacheWriteTokens || 0),
-      totalInputTokens: Number(session?.totalInputTokens || 0),
-      totalUncachedInputTokens: Number(session?.totalUncachedInputTokens || 0),
-      totalOutputTokens: Number(session?.totalOutputTokens || 0),
-      totalCachedReadTokens: Number(session?.totalCachedReadTokens || 0),
-      totalCacheWriteTokens: Number(session?.totalCacheWriteTokens || 0),
-      compactBoundaryTokens: Number(session?.compactBoundaryTokens || 0),
-      compactionBoundaryTokens: Number(compaction.boundaryTokens || 0),
-      compactionTriggerTokens: Number(compaction.triggerTokens || 0),
-      compactionLastChangedAt: Number(compaction.lastChangedAt || 0),
-      compactionLastCompactAt: Number(compaction.lastCompactAt || 0),
-    };
-  }
-
-  function sameContextStatusCacheKey(a, b) {
-    if (!a || !b) return false;
-    for (const key of Object.keys(a)) {
-      if (!Object.is(a[key], b[key])) return false;
-    }
-    return true;
-  }
-
-  // Pure settings-delegate methods (onboarding status/skip, autoClear, profile,
-  // compaction, recap/memory, channels, systemShell, update settings, channel
-  // token save/forget, setBackend). Extracted to session-runtime/settings-api.mjs
-  // and SPREAD into the API object below so the external surface is unchanged.
-  const settingsApi = createSettingsApi({
-    getConfig: () => config,
-    getRoute: () => route,
-    getSession: () => session,
-    getRemoteEnabled: () => remoteEnabled,
-    adoptConfig,
-    saveConfigAndAdopt,
-    scheduleBackendSave,
-    cfgMod,
-    hasOwn,
-    normalizeAutoClearConfig,
-    autoClearIdleMsForProvider,
-    autoClearProviderDefaults,
-    normalizeCompactionConfig,
-    normalizeCompactTypeSetting,
-    normalizeSystemShellConfig,
-    normalizeSystemShellCommand,
-    setConfiguredShell,
-    setRecapEnabledInConfig,
-    setModuleEnabledInConfig,
-    summarizeWorkflowRoutes,
-    parseDurationMs,
-    formatDurationMs,
-    localPackageVersion,
-    memoryEnabled,
-    recapEnabledFn,
-    channelsEnabled,
-    autoUpdateEnabled,
-    getUpdateCheckState: () => updateCheckState,
-    getUpdateProcessState: () => updateProcessState,
-    invalidateContextStatusCache: (...a) => invalidateContextStatusCache(...a),
-    invalidatePreSessionToolSurface: (...a) => invalidatePreSessionToolSurface(...a),
-    scheduleChannelStart: (...a) => scheduleChannelStart(...a),
-    channels,
-    clearChannelStartTimer: () => {
-      if (prewarmTimers.channelStartTimer) {
-        clearTimeout(prewarmTimers.channelStartTimer);
-        prewarmTimers.channelStartTimer = null;
-      }
-    },
-    checkForUpdateInternal: (...a) => checkForUpdateInternal(...a),
-    runUpdateNowInternal: (...a) => runUpdateNowInternal(...a),
-    reloadChannelsSoon: (...a) => reloadChannelsSoon(...a),
-    ONBOARDING_VERSION,
-    saveDiscordToken,
-    forgetDiscordToken,
-    saveTelegramToken,
-    forgetTelegramToken,
-    saveWebhookAuthtoken,
-    forgetWebhookAuthtoken,
-    setBackend,
-  });
-
-  return {
-    ...settingsApi,
-    get id() {
-      return session?.id || null;
-    },
-    get provider() {
-      return route.provider;
-    },
-    get model() {
-      return route.model;
-    },
-    get effort() {
-      return route.effectiveEffort || route.effort || route.preset?.effort || null;
-    },
-    get fast() {
-      return route.fast === true;
-    },
-    get fastCapable() {
-      return route.fastCapable === true;
-    },
-    get effortOptions() {
-      return route.effortOptions || [];
-    },
-    get contextWindow() {
-      return session?.contextWindow || null;
-    },
-    get rawContextWindow() {
-      return session?.rawContextWindow || session?.contextWindow || null;
-    },
-    get effectiveContextWindowPercent() {
-      return session?.effectiveContextWindowPercent || null;
-    },
-    get toolMode() {
-      return mode;
-    },
-    get autoClear() {
-      return this.getAutoClear();
-    },
-    get systemShell() {
-      return normalizeSystemShellConfig(config.shell);
-    },
-    get searchRoute() {
-      searchRoute = normalizeSearchRouteConfig(config.searchRoute) || normalizeSearchRouteConfig(searchRoute);
-      return searchRoute;
-    },
-    get workflow() {
-      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
-      const active = activeWorkflowSummary(config, dataDir);
-      if (session?.workflow && typeof session.workflow === 'object') {
-        const current = workflowSummary(session.workflow);
-        return current?.id && active?.id && current.id !== active.id
-          ? { ...active, currentSession: current, appliedToCurrentSession: false }
-          : active;
-      }
-      return active;
-    },
-    get outputStyle() {
-      return getOutputStyleStatusCached().current;
-    },
-    get cwd() {
-      return currentCwd;
-    },
-    get session() {
-      return session;
-    },
-    contextStatus() {
-      // Prefer the in-flight working transcript while a turn is running so the
-      // context gauge reflects LIVE growth (user turn + tool calls/results) as
-      // it accumulates, instead of freezing at the pre-turn committed snapshot.
-      // askSession() sets session.liveTurnMessages for the turn duration and
-      // clears it on commit/cancel/error, after which we fall back to the
-      // authoritative committed transcript.
-      const liveTurnMessages = Array.isArray(session?.liveTurnMessages) ? session.liveTurnMessages : null;
-      const messages = liveTurnMessages || (Array.isArray(session?.messages) ? session.messages : []);
-      const tools = Array.isArray(session?.tools) ? session.tools : [];
-      const cacheKey = contextStatusCacheKeyFor({ messages, tools });
-      if (contextStatusCacheValue && sameContextStatusCacheKey(cacheKey, contextStatusCacheKey)) {
-        return contextStatusCacheValue;
-      }
-
-      const messageSummary = summarizeContextMessages(messages);
-      const toolSchemaTokens = estimateToolSchemaTokens(tools);
-      const toolSchemaBreakdown = estimateToolSchemaBreakdown(tools);
-      const requestReserveTokens = estimateRequestReserveTokens(tools);
-      const requestOverheadTokens = Math.max(0, requestReserveTokens - toolSchemaTokens);
-      const rawWindow = Number(session?.rawContextWindow || session?.contextWindow || 0);
-      const effectiveWindow = Number(session?.contextWindow || rawWindow || 0);
-      const lastContextTokens = Number(session?.lastContextTokens || 0);
-      const estimatedContextTokens = estimateTranscriptContextUsage(messages, tools, {
-        messageCount: messageSummary.count,
-      });
-      const compactAt = Number(session?.compaction?.lastChangedAt || session?.compaction?.lastCompactAt || 0);
-      const usageAt = Number(session?.lastContextTokensUpdatedAt || 0);
-      const lastUsageStale = !!lastContextTokens && (
-        session?.lastContextTokensStaleAfterCompact === true
-        || (compactAt > 0 && usageAt > 0 && usageAt <= compactAt)
-        || (compactAt > 0 && usageAt <= 0)
-      );
-      const compactBoundaryTokens = Number(session?.compactBoundaryTokens || session?.compaction?.boundaryTokens || 0);
-      const displayWindow = compactBoundaryTokens || effectiveWindow;
-      // The transcript estimate is the single source of truth for the displayed
-      // context footprint. Provider-reported input_tokens (lastContextTokens)
-      // swing non-monotonically and are not window-bounded on some providers
-      // (e.g. OpenAI gpt-5.5 Responses API), so they are kept only as secondary
-      // metadata (lastApiRequestTokens / usage.lastContextTokens) and never feed
-      // the gauge numerator.
-      const usedTokens = estimatedContextTokens;
-      const freeTokens = displayWindow ? Math.max(0, displayWindow - usedTokens) : 0;
-      // Use the same shared compact-policy math as manager/loop. Do not trust
-      // persisted trigger telemetry as an independent policy input: it is an
-      // output snapshot and was the source of repeated /context false positives.
-      const compactTriggerTokens = resolveCompactTriggerTokens(session || {}, compactBoundaryTokens) || 0;
-      const compactBufferTokens = compactBoundaryTokens
-        ? Math.max(0, compactBoundaryTokens - compactTriggerTokens)
-        : resolveCompactBufferTokens(compactBoundaryTokens, session?.compaction || {});
-      const value = {
-        sessionId: session?.id || null,
-        provider: route.provider,
-        model: route.model,
-        cwd: currentCwd,
-        toolMode: mode,
-        contextWindow: displayWindow || effectiveWindow || null,
-        effectiveContextWindow: effectiveWindow || null,
-        rawContextWindow: rawWindow || null,
-        effectiveContextWindowPercent: session?.effectiveContextWindowPercent || null,
-        usedTokens,
-        usedSource: 'estimated',
-        currentEstimatedTokens: estimatedContextTokens,
-        lastApiRequestTokens: lastContextTokens || 0,
-        lastApiRequestStale: lastUsageStale,
-        freeTokens,
-        compaction: {
-          ...(session?.compaction || {}),
-          boundaryTokens: compactBoundaryTokens || null,
-          triggerTokens: compactTriggerTokens || null,
-          bufferTokens: compactBufferTokens || null,
-          currentEstimatedTokens: estimatedContextTokens,
-          lastApiRequestTokens: lastContextTokens || 0,
-          lastApiRequestStale: lastUsageStale,
-        },
-        messages: messageSummary,
-        request: {
-          toolSchemaTokens,
-          toolSchemaBreakdown,
-          requestOverheadTokens,
-          reserveTokens: requestReserveTokens,
-        },
-        usage: {
-          lastInputTokens: Number(session?.lastInputTokens || 0),
-          lastUncachedInputTokens: Number(session?.lastUncachedInputTokens || 0),
-          lastOutputTokens: Number(session?.lastOutputTokens || 0),
-          lastCachedReadTokens: Number(session?.lastCachedReadTokens || 0),
-          lastCacheWriteTokens: Number(session?.lastCacheWriteTokens || 0),
-          lastContextTokens,
-          totalInputTokens: Number(session?.totalInputTokens || 0),
-          totalUncachedInputTokens: Number(session?.totalUncachedInputTokens || 0),
-          totalOutputTokens: Number(session?.totalOutputTokens || 0),
-          totalCachedReadTokens: Number(session?.totalCachedReadTokens || 0),
-          totalCacheWriteTokens: Number(session?.totalCacheWriteTokens || 0),
-        },
-      };
-      contextStatusCacheKey = cacheKey;
-      contextStatusCacheValue = value;
-      return value;
-    },
-    listProviders() {
-      return renderProviderStatus(displayConfig());
-    },
-    async getProviderSetup() {
-      return await cachedProviderSetup();
-    },
-    async getUsageDashboard(options = {}) {
-      return await getUsageDashboard(options);
-    },
-    async completeOnboarding(payload = {}) {
-      // Only fall back to the live runtime route when the caller actually sent a
-      // defaultRoute. The onboarding "partial save" path (Main left unset, only
-      // Search/agent picks) omits defaultRoute entirely and must NOT persist the
-      // current route as Main or recreate the session.
-      const defaultRoute = hasOwn(payload, 'defaultRoute')
-        ? normalizeWorkflowRoute(payload.defaultRoute, route)
-        : null;
-      const workflowInput = payload.workflowRoutes && typeof payload.workflowRoutes === 'object'
-        ? payload.workflowRoutes
-        : {};
-      const nextConfig = { ...config };
-      if (hasOwn(payload, 'defaultProvider')) {
-        const requested = clean(payload.defaultProvider);
-        if (requested) {
-          if (!isKnownProvider(requested)) throw new Error(`unknown provider "${payload.defaultProvider}"`);
-          nextConfig.defaultProvider = requested;
-        }
-      }
-      let presets = Array.isArray(nextConfig.presets) ? nextConfig.presets.slice() : [];
-      const workflowRoutes = { ...(nextConfig.workflowRoutes || {}) };
-      // Track slots actually written THIS call so maintenance mirroring never
-      // clobbers an existing slot the payload did not touch.
-      const touchedWorkflowSlots = new Set();
-
-      if (defaultRoute) {
-        presets = upsertWorkflowPreset(presets, 'lead', defaultRoute);
-        workflowRoutes.lead = defaultRoute;
-        nextConfig.default = workflowPresetId('lead');
-      }
-
-      for (const slot of WORKFLOW_ROUTE_SLOTS) {
-        const normalized = normalizeWorkflowRoute(workflowInput[slot]);
-        if (!normalized) continue;
-        workflowRoutes[slot] = normalized;
-        presets = upsertWorkflowPreset(presets, slot, normalized);
-        touchedWorkflowSlots.add(slot);
-      }
-
-      nextConfig.presets = presets;
-      nextConfig.workflowRoutes = workflowRoutes;
-      // Maintenance slots store a direct {provider, model} route. Only mirror a
-      // slot that was actually written this call (touchedWorkflowSlots); an
-      // untouched slot keeps its existing maintenance value.
-      nextConfig.maintenance = {
-        ...(nextConfig.maintenance || {}),
-        ...(touchedWorkflowSlots.has('explorer') ? { explore: normalizeWorkflowRoute(workflowRoutes.explorer) } : {}),
-        ...(touchedWorkflowSlots.has('memory') ? { memory: normalizeWorkflowRoute(workflowRoutes.memory) } : {}),
-      };
-      // Per-agent onboarding routes (id → route) for the full FIXED_AGENT_SLOTS
-      // roster. Mirrors setAgentRoute persistence: config.agents[id], an
-      // agent-<id> preset, and (for workflow-backed agents) the workflowRoute +
-      // maintenance slot. Agents omitted from the payload inherit defaultRoute.
-      const agentInput = payload.agentRoutes && typeof payload.agentRoutes === 'object'
-        ? payload.agentRoutes
-        : null;
-      if (agentInput) {
-        const nextAgents = { ...(nextConfig.agents || {}) };
-        const nextMaintenance = { ...(nextConfig.maintenance || {}) };
-        for (const agent of FIXED_AGENT_SLOTS) {
-          // Persist ONLY agents with an explicit override in the payload. An
-          // omitted agent is left untouched (existing value preserved, or
-          // unwritten so the runtime dynamically follows the Main Model). Never
-          // fall back to defaultRoute here — that would overwrite an agent the
-          // user did not choose.
-          const routeToSave = normalizeWorkflowRoute(agentInput[agent.id]);
-          if (!routeToSave) continue;
-          nextAgents[agent.id] = routeToSave;
-          presets = upsertWorkflowPreset(presets, agentPresetSlot(agent.id), routeToSave);
-          if (agent.workflowSlot) {
-            workflowRoutes[agent.workflowSlot] = routeToSave;
-            presets = upsertWorkflowPreset(presets, agent.workflowSlot, routeToSave);
-            if (agent.id === 'explore') nextMaintenance.explore = routeToSave;
-            if (agent.id === 'maintainer') nextMaintenance.memory = routeToSave;
-          }
-        }
-        nextConfig.agents = nextAgents;
-        nextConfig.presets = presets;
-        nextConfig.workflowRoutes = workflowRoutes;
-        nextConfig.maintenance = nextMaintenance;
-      }
-      nextConfig.onboarding = {
-        ...(nextConfig.onboarding || {}),
-        completed: true,
-        version: ONBOARDING_VERSION,
-        completedAt: new Date().toISOString(),
-      };
-
-      // Optional native web-search route. Only persisted when provided; mirrors
-      // setSearchRoute's config write (skip provider capability validation here
-      // since onboarding routes come from the vetted provider model list).
-      if (payload.searchRoute) {
-        const searchToSave = normalizeSearchRouteConfig(payload.searchRoute);
-        if (searchToSave) nextConfig.searchRoute = searchToSave;
-      }
-
-      saveConfigAndAdopt(nextConfig);
-      if (defaultRoute) {
-        route = resolveRoute(config, { provider: defaultRoute.provider, model: defaultRoute.model, effort: defaultRoute.effort });
-        if (session?.id) mgr.closeSession(session.id, 'cli-onboarding-complete');
-        await recreateCurrentSessionIfReady();
-      }
-      return this.getOnboardingStatus();
-    },
-    getChannelSetup() {
-      // Flush a pending debounced backend switch first so setup readers
-      // (Settings → Channel Setting, remote toggles) never observe the
-      // previous backend during the 150ms debounce window.
-      try { flushBackendSave(); } catch {}
-      return channelSetup();
-    },
-    getChannelWorkerStatus() {
-      return channels.status();
-    },
-    startRemote() {
-      return startRemote();
-    },
-    stopRemote(reason) {
-      return stopRemote(reason);
-    },
-    isRemoteEnabled() {
-      return isRemoteEnabled();
-    },
-    // Subscribe to non-user-initiated remote flips (seat superseded). Returns
-    // an unsubscribe function. TUI uses this to sync its Remote indicator and
-    // show a "remote taken over" notice.
-    onRemoteStateChange(listener) {
-      if (typeof listener !== 'function') return () => {};
-      remoteStateListeners.add(listener);
-      return () => remoteStateListeners.delete(listener);
-    },
-    setChannel(entry) {
-      const result = setChannel(entry);
-      reloadChannelsSoon();
-      return result;
-    },
-    setWebhookConfig(patch) {
-      const result = setWebhookConfig(patch);
-      reloadChannelsSoon();
-      return result;
-    },
-    saveSchedule(entry) {
-      const result = saveSchedule(entry);
-      reloadChannelsSoon();
-      return result;
-    },
-    deleteSchedule(name) {
-      const result = deleteSchedule(name);
-      reloadChannelsSoon();
-      return result;
-    },
-    setScheduleEnabled(name, enabled) {
-      const result = setScheduleEnabled(name, enabled);
-      reloadChannelsSoon();
-      return result;
-    },
-    saveWebhook(entry) {
-      const result = saveWebhook(entry);
-      reloadChannelsSoon();
-      return result;
-    },
-    deleteWebhook(name) {
-      const result = deleteWebhook(name);
-      reloadChannelsSoon();
-      return result;
-    },
-    setWebhookEnabled(name, enabled) {
-      const result = setWebhookEnabled(name, enabled);
-      reloadChannelsSoon();
-      return result;
-    },
-    async authenticateProvider(providerId, secret) {
-      const result = String(secret || '').trim()
-        ? saveProviderApiKey(cfgMod, providerId, secret)
-        : await loginOAuthProvider(cfgMod, providerId);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      warmProviderModelCache();
-      return result;
-    },
-    async loginOAuthProvider(providerId) {
-      const result = await loginOAuthProvider(cfgMod, providerId);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      warmProviderModelCache();
-      return result;
-    },
-    async beginOAuthProviderLogin(providerId) {
-      const result = await beginOAuthProviderLogin(cfgMod, providerId);
-      reloadFullConfig();
-      return {
-        ...result,
-        waitForCallback: result.waitForCallback?.then((completed) => {
-          reloadFullConfig();
-          if (completed) {
-            invalidateProviderCaches();
-            warmProviderModelCache();
-          }
-          return completed;
-        }),
-        completeCode: async (code) => {
-          const completed = await result.completeCode(code);
-          reloadFullConfig();
-          invalidateProviderCaches();
-          warmProviderModelCache();
-          return completed;
-        },
-      };
-    },
-    saveProviderApiKey(providerId, secret) {
-      const result = saveProviderApiKey(cfgMod, providerId, secret);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      warmProviderModelCache();
-      return result;
-    },
-    saveOpenAIUsageSessionKey(secret) {
-      const result = saveOpenAIUsageSessionKey(cfgMod, secret);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      return result;
-    },
-    saveOpenCodeGoUsageAuth(opts) {
-      const result = saveOpenCodeGoUsageAuth(cfgMod, opts);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      return result;
-    },
-    async loginOpenCodeGoUsage() {
-      const result = await loginOpenCodeGoUsage(cfgMod);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      return result;
-    },
-    setLocalProvider(providerId, opts) {
-      const result = setLocalProvider(cfgMod, providerId, opts);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      warmProviderModelCache();
-      return result;
-    },
-    forgetProviderAuth(providerId) {
-      const result = forgetProviderAuth(cfgMod, providerId);
-      reloadFullConfig();
-      invalidateProviderCaches();
-      warmProviderModelCache();
-      return result;
-    },
-    listPresets() {
-      return cfgMod.listPresets(displayConfig());
-    },
-    async listProviderModels(options = {}) {
-      return await collectProviderModels({
-        force: options.force === true || options.refresh === true,
-        quick: options.quick === true,
-      });
-    },
-    getSearchRoute() {
-      searchRoute = normalizeSearchRouteConfig(config.searchRoute) || normalizeSearchRouteConfig(searchRoute);
-      return searchRoute;
-    },
-    async listSearchModels(options = {}) {
-      return await collectSearchProviderModels({ force: options.force === true || options.refresh === true });
-    },
-    async setSearchRoute(next) {
-      let selectedRoute = normalizeSearchRouteConfig(next);
-      if (!selectedRoute && next?.model && searchRoute?.provider) {
-        selectedRoute = normalizeSearchRouteConfig({ ...next, provider: searchRoute.provider });
-      }
-      if (!selectedRoute) throw new Error('search route requires provider and model');
-      if (isDefaultSearchRouteConfig(selectedRoute)) {
-        ensureFullConfig();
-        const routeToSave = normalizeSearchRouteConfig({
-          provider: SEARCH_DEFAULT_PROVIDER,
-          model: SEARCH_DEFAULT_MODEL,
-          ...(selectedRoute.toolType ? { toolType: selectedRoute.toolType } : {}),
-        });
-        const nextConfig = { ...config };
-        nextConfig.searchRoute = routeToSave;
-        saveConfigAndAdopt(nextConfig);
-        searchRoute = normalizeSearchRouteConfig(config.searchRoute);
-        invalidateProviderCaches();
-        return searchRoute;
-      }
-      if (!isSearchCapableProvider(selectedRoute.provider)) {
-        throw new Error(`provider "${selectedRoute.provider}" does not support Mixdog native search`);
-      }
-      ensureFullConfig();
-      await reg.initProviders(ensureProviderEnabled(config, selectedRoute.provider));
-      const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);
-      if (!searchCapableFor(selectedRoute.provider, modelMeta)) {
-        throw new Error(`model "${selectedRoute.model}" is not marked as web-search capable`);
-      }
-      const fastCapable = fastCapableFor(selectedRoute.provider, modelMeta);
-      const effort = coerceEffortFor(selectedRoute.provider, modelMeta, selectedRoute.effort);
-      selectedRoute = {
-        ...selectedRoute,
-        ...(effort ? { effort } : {}),
-        fast: fastCapable ? selectedRoute.fast === true : false,
-      };
-      adoptConfig(saveModelSettings(cfgMod, selectedRoute, { fastCapable, baseConfig: config }), { hasSecrets: configHasSecrets });
-      const routeToSave = normalizeSearchRouteConfig(selectedRoute);
-      const nextConfig = { ...config };
-      nextConfig.searchRoute = routeToSave;
-      saveConfigAndAdopt(nextConfig);
-      searchRoute = normalizeSearchRouteConfig(config.searchRoute);
-      invalidateProviderCaches();
-      return searchRoute;
-    },
-    listAgents() {
-      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
-      return FIXED_AGENT_SLOTS.map((agent) => ({
-        ...agent,
-        locked: true,
-        route: agentRouteFromConfig(config, agent.id, dataDir),
-        definition: loadAgentDefinition(dataDir, agent.id),
-      }));
-    },
-    listWorkflows() {
-      const currentConfig = displayConfig();
-      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
-      const active = activeWorkflowId(currentConfig);
-      return listWorkflowPacks(dataDir).map((workflow) => ({
-        id: workflow.id,
-        name: workflow.name,
-        description: workflow.description,
-        source: workflow.source,
-        active: workflow.id === active,
-        agents: workflow.agents,
-      }));
-    },
-    getOutputStyle() {
-      return getOutputStyleStatusCached();
-    },
-    listOutputStyles() {
-      return getOutputStyleStatusCached();
-    },
-    async setOutputStyle(value) {
-      const before = getOutputStyleStatusCached({ fresh: true });
-      const selected = findOutputStyle(value, before.styles);
-      if (!selected) {
-        const names = before.styles.map((style) => style.label || style.id).join(', ') || 'Default';
-        throw new Error(`output style must be one of ${names}`);
-      }
-      // Adopt in-memory immediately so same-tick readers see the new style;
-      // persist off the key-handler tick. NOTE: the disk write goes through
-      // the dedicated flushOutputStyleSave debounce (sharedCfgMod whole-root
-      // RMW) — cfgMod.saveConfig only serializes agent-section fields and
-      // would drop the top-level outputStyle key.
-      const nextConfig = { ...config, outputStyle: selected.id };
-      if (nextConfig.agent && typeof nextConfig.agent === 'object' && !Array.isArray(nextConfig.agent)) {
-        const agent = { ...nextConfig.agent };
-        delete agent.outputStyle;
-        nextConfig.agent = agent;
-      }
-      adoptConfig(nextConfig);
-      scheduleOutputStyleSave(selected.id);
-      // Reuse the catalog already scanned above for `before` instead of a
-      // second forced-fresh filesystem scan; refresh the status cache
-      // in-memory (short TTL, same as getOutputStyleStatusCached) so reads
-      // during the debounce window see the just-selected style.
-      const freshStatus = { configured: selected.id, current: selected, styles: before.styles };
-      seedOutputStyleStatusCache(freshStatus);
-      const hasConversation = sessionHasConversationMessages(session);
-      let appliedToCurrentSession = !hasConversation;
-      if (session?.id && !hasConversation) {
-        const closedSessionId = session.id;
-        mgr.closeSession(closedSessionId, 'cli-output-style-switch');
-        session = null;
-        // Defer the recreate so the output-style picker can repaint first;
-        // any failure still surfaces via the existing notice path.
-        setTimeout(() => {
-          recreateCurrentSessionIfReady().catch((err) => {
-            try {
-              notifyFnForSession(closedSessionId)(
-                `Failed to start a new session after output style change: ${err?.message || err}`,
-                { level: 'error' },
-              );
-            } catch {}
-          });
-        }, 0);
-      }
-      invalidateContextStatusCache();
-      return { ...freshStatus, appliedToCurrentSession };
-    },
-    async setWorkflow(workflowId) {
-      const id = normalizeWorkflowId(workflowId, DEFAULT_WORKFLOW_ID);
-      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
-      const pack = loadWorkflowPack(dataDir, id);
-      if (!pack || pack.id !== id) throw new Error(`workflow "${workflowId}" not found`);
-      const nextConfig = { ...config };
-      nextConfig.workflow = { ...(nextConfig.workflow || {}), active: id };
-      saveConfigAndAdopt(nextConfig);
-      return workflowSummary(pack);
-    },
-    async setAgentRoute(agentId, next) {
-      const id = normalizeAgentId(agentId);
-      if (!id) throw new Error(`unknown agent "${agentId}"`);
-      let selectedRoute = resolveRoute(config, { ...(next || {}) });
-      await reg.initProviders(ensureProviderEnabled(config, selectedRoute.provider));
-      const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);
-      const fastCapable = fastCapableFor(selectedRoute.provider, modelMeta);
-      selectedRoute = { ...selectedRoute, fast: fastCapable ? selectedRoute.fast === true : false };
-      adoptConfig(saveModelSettings(cfgMod, selectedRoute, { fastCapable, baseConfig: config }), { hasSecrets: configHasSecrets });
-
-      const routeToSave = normalizeWorkflowRoute(selectedRoute);
-      if (!routeToSave) throw new Error('agent route requires provider and model');
-      const agent = FIXED_AGENT_SLOTS.find((item) => item.id === id);
-      const nextConfig = { ...config };
-      nextConfig.agents = {
-        ...(nextConfig.agents || {}),
-        [id]: routeToSave,
-      };
-      nextConfig.presets = upsertWorkflowPreset(nextConfig.presets, agentPresetSlot(id), routeToSave);
-      if (agent?.workflowSlot) {
-        nextConfig.workflowRoutes = {
-          ...(nextConfig.workflowRoutes || {}),
-          [agent.workflowSlot]: routeToSave,
-        };
-        nextConfig.presets = upsertWorkflowPreset(nextConfig.presets, agent.workflowSlot, routeToSave);
-        // Maintenance slots store a direct {provider, model} route now, so
-        // mirror the agent route straight in instead of a preset-id string.
-        nextConfig.maintenance = {
-          ...(nextConfig.maintenance || {}),
-          ...(id === 'explore' ? { explore: routeToSave } : {}),
-          ...(id === 'maintainer' ? { memory: routeToSave } : {}),
-        };
-      }
-      saveConfigAndAdopt(nextConfig);
-      return routeToSave;
-    },
-    async setDefaultProvider(provider) {
-      const requested = clean(provider);
-      if (!requested) throw new Error('provider is required');
-      if (!isKnownProvider(requested)) throw new Error(`unknown provider "${provider}"`);
-      saveConfigAndAdopt({ ...config, defaultProvider: requested });
-      return requested;
-    },
-    async ask(prompt, options = {}) {
-      activeTurnCount += 1;
-      // Lazy code-graph prewarm: kick off the build ONCE, on the first real
-      // turn, so a likely code lookup hits a warm cache — without paying the
-      // post-first-frame prewarm freeze on idle startup. The schedule is async
-      // + unref'd (worker thread), so it never blocks this turn.
-      if (codeGraphPrewarmLazy && !codeGraphFirstTurnPrewarmDone) {
-        codeGraphFirstTurnPrewarmDone = true;
-        scheduleCodeGraphPrewarm(0, 'first-turn');
-      }
-      const startedAt = Date.now();
-      try {
-        await refreshSessionForCwdIfNeeded('cwd-change');
-        if (!session?.id) await createCurrentSession('turn');
-        // Remote outbound: ensure a transcript writer bound to the current
-        // session.id + cwd. The channel worker's OutputForwarder tails this
-        // JSONL and pushes the surface view to Discord. Gated on remoteEnabled
-        // so non-remote sessions write nothing.
-        if (remoteEnabled) {
-          // Reset per-turn dedup tracker so an identical answer in a later turn
-          // is still written (the guard only prevents same-turn double-write).
-          _lastAppendedAssistant = '';
-          const prevKey = _twKey;
-          ensureRemoteTranscriptWriter();
-          // The writer moved to a NEW session/cwd (e.g. lazy first-turn
-          // session create after /remote, or /new mid-remote). Re-pin the
-          // channel worker's output forwarder onto the fresh transcript NOW —
-          // otherwise it keeps tailing the previous binding until an inbound
-          // Discord message triggers the steal path, so terminal-initiated
-          // turns would never forward. activate_channel_bridge is idempotent
-          // force-takeover (claim + rebind); fire-and-forget so the turn is
-          // never blocked on worker IPC.
-          if (_twKey && _twKey !== prevKey && channelsEnabled() && !envFlag('MIXDOG_DISABLE_CHANNEL_START')) {
-            void invokeChannelStart()
-              .then(() => {
-                // stopRemote()/superseded/close may have landed while the
-                // worker was starting — never re-claim for a turned-off session.
-                if (!remoteEnabled || closeRequested) return undefined;
-                return channels.execute('activate_channel_bridge', { active: true });
-              })
-              .catch((error) => bootProfile('channels:turn-rebind-failed', { error: error?.message || String(error) }));
-          }
-        }
-        hooks.emit('turn:start', { sessionId: session.id, prompt, cwd: currentCwd });
-        // UserPromptSubmit: bridge to the standard hook bus. A hook FAILURE
-        // must not block the turn, but a genuine blocked===true MUST throw.
-        let promptDispatch = null;
-        try {
-          promptDispatch = await hooks.dispatch('UserPromptSubmit', hookCommonPayload({ session_id: session.id, prompt }));
-        } catch { /* hook failure never blocks the turn */ }
-        if (promptDispatch?.blocked === true) {
-          throw new Error(`prompt blocked by hook: ${promptDispatch.reason || ''}`);
-        }
-        const hookContext = Array.isArray(promptDispatch?.additionalContext)
-          ? promptDispatch.additionalContext.join('\n\n')
-          : String(promptDispatch?.additionalContext || '');
-        const turnContext = [options.context || '', hookContext]
-          .map((part) => String(part || '').trim())
-          .filter(Boolean)
-          .join('\n\n');
-        const result = await mgr.askSession(
-          session.id,
-          prompt,
-          turnContext || null,
-          async (iter, calls) => {
-            for (const call of calls || []) {
-              hooks.emit('tool:planned', {
-                sessionId: session.id,
-                name: call?.name || 'tool',
-                callId: call?.id || null,
-              });
-              // Mirror each tool card the TUI shows into the transcript so the
-              // forwarder renders the same one-line tool summary on Discord.
-              // calls carry { name, arguments, id } (loop.mjs response.toolCalls);
-              // some providers use `input` — accept either.
-              if (remoteEnabled && _transcriptWriter) {
-                try { _transcriptWriter.appendToolUse(call?.name, call?.input ?? call?.arguments); }
-                catch (error) { process.stderr.write(`mixdog: transcript-writer: onToolCall failed: ${error?.message || error}\n`); }
-              }
-            }
-            if (typeof options.onToolCall === 'function') {
-              return await options.onToolCall(iter, calls);
-            }
-            return undefined;
-          },
-          currentCwd,
-          options.prefetch || null,
-          {
-            onTextDelta: options.onTextDelta,
-            onReasoningDelta: options.onReasoningDelta,
-            onAssistantText: (text) => {
-              // Capture the same assistant text the TUI renders (final answer +
-              // mid-turn preamble). Feed the writer, then ALWAYS call through to
-              // the caller's hook so terminal rendering is never affected.
-              if (remoteEnabled && _transcriptWriter) {
-                try {
-                  const value = typeof text === 'string' ? text : (text == null ? '' : String(text));
-                  if (value.trim()) {
-                    _transcriptWriter.appendAssistant(value);
-                    // Track the last line we wrote so the post-turn final
-                    // append below can skip an identical re-write (buffered
-                    // providers surface the final answer here AND in result).
-                    _lastAppendedAssistant = value;
-                  }
-                }
-                catch (error) { process.stderr.write(`mixdog: transcript-writer: onAssistantText failed: ${error?.message || error}\n`); }
-              }
-              return options.onAssistantText?.(text);
-            },
-            onUsageDelta: options.onUsageDelta,
-            onToolResult: (message) => {
-              // Surface Edit diffs only: the forwarder reads toolUseResult
-              // {oldString,newString}. Other tool results carry no diff payload,
-              // so we append only when those fields are present.
-              if (remoteEnabled && _transcriptWriter) {
-                try {
-                  const tur = message?.toolUseResult;
-                  if (tur && (tur.oldString != null || tur.newString != null)) {
-                    _transcriptWriter.appendToolResult({ oldString: tur.oldString ?? '', newString: tur.newString ?? '' });
-                  }
-                } catch (error) { process.stderr.write(`mixdog: transcript-writer: onToolResult failed: ${error?.message || error}\n`); }
-              }
-              return options.onToolResult?.(message);
-            },
-            onToolApproval: options.onToolApproval,
-            onCompactEvent: options.onCompactEvent,
-            onStageChange: options.onStageChange,
-            onStreamDelta: options.onStreamDelta,
-            drainSteering: options.drainSteering,
-            onSteerMessage: options.onSteerMessage,
-            notifyFn: notifyFnForSession(session.id),
-          },
-        );
-        session = mgr.getSession(session.id) || session;
-        // Final assistant text: onAssistantText fires only for buffered
-        // (non-streaming) providers and for mid-turn preamble. Streaming
-        // providers deliver the final answer via onTextDelta (which we do NOT
-        // tap, to avoid per-delta spam), so append the authoritative final
-        // content here from result.content. To avoid double-writing the
-        // buffered case, only append when it differs from the last assistant
-        // line onAssistantText already wrote.
-        if (remoteEnabled && _transcriptWriter) {
-          try {
-            const finalText = result?.content != null ? String(result.content) : '';
-            if (finalText.trim() && finalText !== _lastAppendedAssistant) {
-              _transcriptWriter.appendAssistant(finalText);
-              _lastAppendedAssistant = finalText;
-            }
-          } catch (error) {
-            process.stderr.write(`mixdog: transcript-writer: final append failed: ${error?.message || error}\n`);
-          }
-        }
-        hooks.emit('turn:end', { sessionId: session.id, elapsedMs: Date.now() - startedAt });
-        // Stop: bridge to the standard hook bus. Best-effort; ignore result,
-        // never throw.
-        try {
-          await hooks.dispatch('Stop', hookCommonPayload({ session_id: session.id }));
-        } catch { /* best-effort: Stop hook must never break the turn */ }
-        return { result, session };
-      } catch (error) {
-        hooks.emit('turn:error', { sessionId: session?.id || null, elapsedMs: Date.now() - startedAt, error: error?.message || String(error) });
-        // StopFailure: bridge a turn error to the standard hook bus. Spec:
-        // output + exit code ignored, so pure fire-and-forget. error_type is a
-        // simple regex mapping from the error message (default 'unknown').
-        try {
-          const msg = String(error?.message || error || '').toLowerCase();
-          const errorType = /rate.?limit|429|too many requests/.test(msg) ? 'rate_limit'
-            : /overloaded|529/.test(msg) ? 'overloaded'
-            : /authenticat|unauthorized|401|invalid.*api.?key/.test(msg) ? 'authentication_failed'
-            : /server.?error|5\d\d|internal error/.test(msg) ? 'server_error'
-            : 'unknown';
-          void hooks.dispatch('StopFailure', hookCommonPayload({ session_id: session?.id || null, error_type: errorType }));
-        } catch { /* best-effort: StopFailure hook must never break teardown */ }
-        throw error;
-      } finally {
-        activeTurnCount = Math.max(0, activeTurnCount - 1);
-        if (!firstTurnCompleted) {
-          firstTurnCompleted = true;
-          scheduleProviderWarmup();
-          scheduleProviderModelWarmup();
-        }
-      }
-    },
-    async clear(options = {}) {
-      if (!session?.id) return false;
-      const cleared = await mgr.clearSessionMessages(session.id, options);
-      if (!cleared) return false;
-      session = typeof cleared === 'object' ? cleared : (mgr.getSession(session.id) || session);
-      if (options.recoverAgent === true) {
-        try { agentTool.recoverWorkers?.({ clientHostPid: session?.clientHostPid || process.pid }); } catch {}
-      }
-      invalidateContextStatusCache();
-      return true;
-    },
-    // session_manage tool handoff: the engine polls this at turn end and, if
-    // set, runs the same clear path the idle auto-clear uses. One-shot read.
-    consumePendingSessionReset() {
-      const pending = pendingSessionReset;
-      pendingSessionReset = null;
-      if (!pending) return null;
-      // Session changed since scheduling (resume / new session) — drop it.
-      if (!session?.id || pending.sessionId !== session.id) return null;
-      return pending.action;
-    },
-    async compact(options = {}) {
-      if (!session?.id) return null;
-      if (activeTurnCount > 0) {
-        return { changed: false, reason: 'compact skipped: turn in progress' };
-      }
-      // Manual compact bypasses loop.mjs, so its PreCompact/PostCompact never
-      // fire here — dispatch them explicitly via the session-property hooks
-      // (wired at session create). Best-effort; a hook must not block compaction.
-      try { await session.preCompactHook?.({ trigger: 'manual' }); }
-      catch { /* best-effort: PreCompact hook must never break manual compact */ }
-      const result = await mgr.compactSessionMessages(session.id);
-      try { await session.postCompactHook?.({ trigger: 'manual' }); }
-      catch { /* best-effort: PostCompact hook must never break manual compact */ }
-      session = mgr.getSession(session.id) || session;
-      if (options.recoverAgent === true) {
-        try { agentTool.recoverWorkers?.({ clientHostPid: session?.clientHostPid || process.pid }); } catch {}
-      }
-      invalidateContextStatusCache();
-      return result;
-    },
-    async setToolMode(nextMode) {
-      mode = normalizeToolMode(nextMode);
-      invalidatePreSessionToolSurface();
-      if (session?.id) mgr.closeSession(session.id, 'cli-mode-switch');
-      await recreateCurrentSessionIfReady();
-      return mode;
-    },
-    agentStatus() {
-      return agentStatusState();
-    },
-    get clientHostPid() {
-      return session?.clientHostPid || process.pid;
-    },
-    agentControl(args = {}) {
-      const callerSessionId = session?.id || null;
-      return agentTool.execute(args, {
-        callerCwd: currentCwd,
-        invocationSource: 'user-command',
-        callerSessionId,
-        clientHostPid: session?.clientHostPid || process.pid,
-        notifyFn: notifyFnForSession(callerSessionId),
-      });
-    },
-    onNotification(listener) {
-      if (typeof listener !== 'function') return () => {};
-      notificationListeners.add(listener);
-      return () => notificationListeners.delete(listener);
-    },
-    toolsStatus(query = '') {
-      const surface = activeToolSurface();
-      const catalog = Array.isArray(surface?.deferredToolCatalog)
-        ? surface.deferredToolCatalog
-        : (Array.isArray(surface?.tools) ? surface.tools : []);
-      const activeNames = new Set((surface?.tools || []).map((tool) => tool?.name).filter(Boolean));
-      const needle = clean(query).toLowerCase();
-      const rows = catalog.map((tool) => toolRow(tool, activeNames)).filter((row) => row.name);
-      const tools = needle
-        ? rows.filter((row) => toolSearchMatches(row, needle))
-        : rows;
-      return {
-        mode,
-        count: rows.length,
-        activeCount: rows.filter((row) => row.active).length,
-        tools,
-        activeTools: sortedNamesByMeasuredUsage(activeNames),
-        discoveredTools: sortedNamesByMeasuredUsage(surface?.deferredDiscoveredTools || []),
-      };
-    },
-    selectTools(names) {
-      const list = Array.isArray(names) ? names : String(names || '').split(/[,\s]+/);
-      const result = selectDeferredTools(activeToolSurface(), list, mode);
-      return { ...result, status: this.toolsStatus() };
-    },
-    setCwd(path) {
-      applyResolvedCwd(resolveCwdPath(path));
-      return currentCwd;
-    },
-    mcpStatus() {
-      return mcpStatus();
-    },
-    async reconnectMcp() {
-      reloadFullConfig();
-      const status = await connectConfiguredMcp({ reset: true });
-      invalidatePreSessionToolSurface();
-      if (session?.id) mgr.closeSession(session.id, 'cli-mcp-reconnect');
-      await recreateCurrentSessionIfReady();
-      return status;
-    },
-    async addMcpServer(input = {}) {
-      const { name, config: serverConfig } = normalizeMcpServerInput(input);
-      const nextConfig = { ...config };
-      nextConfig.mcpServers = {
-        ...(nextConfig.mcpServers || {}),
-        [name]: serverConfig,
-      };
-      saveConfigAndAdopt(nextConfig);
-      const status = await connectConfiguredMcp({ reset: true });
-      invalidatePreSessionToolSurface();
-      if (session?.id) mgr.closeSession(session.id, 'cli-mcp-add');
-      await recreateCurrentSessionIfReady();
-      return { name, status };
-    },
-    async removeMcpServer(name) {
-      const serverName = clean(name);
-      if (!serverName) throw new Error('MCP server name is required');
-      const nextConfig = { ...config };
-      const current = nextConfig.mcpServers && typeof nextConfig.mcpServers === 'object'
-        ? { ...nextConfig.mcpServers }
-        : {};
-      if (!Object.prototype.hasOwnProperty.call(current, serverName)) {
-        throw new Error(`MCP server not configured: ${serverName}`);
-      }
-      delete current[serverName];
-      saveConfigAndAdopt({ ...nextConfig, mcpServers: current });
-      const status = await connectConfiguredMcp({ reset: true });
-      invalidatePreSessionToolSurface();
-      if (session?.id) mgr.closeSession(session.id, 'cli-mcp-remove');
-      await recreateCurrentSessionIfReady();
-      return status;
-    },
-    async setMcpServerEnabled(name, enabled) {
-      const serverName = clean(name);
-      if (!serverName) throw new Error('MCP server name is required');
-      const nextConfig = { ...config };
-      const current = nextConfig.mcpServers && typeof nextConfig.mcpServers === 'object'
-        ? { ...nextConfig.mcpServers }
-        : {};
-      if (!Object.prototype.hasOwnProperty.call(current, serverName)) {
-        throw new Error(`MCP server not configured: ${serverName}`);
-      }
-      current[serverName] = { ...(current[serverName] || {}), enabled: enabled !== false };
-      saveConfigAndAdopt({ ...nextConfig, mcpServers: current });
-      const status = await connectConfiguredMcp({ reset: true });
-      invalidatePreSessionToolSurface();
-      if (session?.id) mgr.closeSession(session.id, 'cli-mcp-toggle');
-      await recreateCurrentSessionIfReady();
-      return status;
-    },
-    skillsStatus() {
-      return skillsStatus();
-    },
-    skillContent(name) {
-      return skillContent(name);
-    },
-    async addSkill(input = {}) {
-      const skill = addProjectSkill(input);
-      if (session?.id) mgr.closeSession(session.id, 'cli-skill-add');
-      await recreateCurrentSessionIfReady();
-      return { skill, status: skillsStatus() };
-    },
-    async reloadSkills() {
-      if (session?.id) mgr.closeSession(session.id, 'cli-skills-reload');
-      await recreateCurrentSessionIfReady();
-      return skillsStatus();
-    },
-    pluginsStatus() {
-      return pluginsStatus();
-    },
-    async reloadPlugins() {
-      if (session?.id) mgr.closeSession(session.id, 'cli-plugins-reload');
-      await recreateCurrentSessionIfReady();
-      return pluginsStatus();
-    },
-    async addPlugin(source) {
-      const dataDir = cfgMod.getPluginData?.();
-      const plugin = registryAddPlugin(source, { dataDir });
-      if (session?.id) mgr.closeSession(session.id, 'cli-plugin-add');
-      await recreateCurrentSessionIfReady();
-      return { plugin, status: pluginsStatus() };
-    },
-    async updatePlugin(plugin = {}) {
-      const key = clean(plugin.id || plugin.name || plugin);
-      const dataDir = cfgMod.getPluginData?.();
-      const updated = registryUpdatePlugin(key, { dataDir });
-      if (session?.id) mgr.closeSession(session.id, 'cli-plugin-update');
-      await recreateCurrentSessionIfReady();
-      return { plugin: updated, status: pluginsStatus() };
-    },
-    async removePlugin(plugin = {}) {
-      const key = clean(plugin.id || plugin.name || plugin);
-      const dataDir = cfgMod.getPluginData?.();
-      const removed = registryRemovePlugin(key, { dataDir });
-      const nextConfig = { ...config };
-      const serverName = pluginMcpServerName(plugin);
-      const prefix = `${serverName}--`;
-      const hasMatch = nextConfig.mcpServers && Object.keys(nextConfig.mcpServers).some(
-        (k) => k === serverName || k.startsWith(prefix)
-      );
-      if (hasMatch) {
-        const current = { ...nextConfig.mcpServers };
-        for (const k of Object.keys(current)) {
-          if (k === serverName || k.startsWith(prefix)) delete current[k];
-        }
-        saveConfigAndAdopt({ ...nextConfig, mcpServers: current });
-        await connectConfiguredMcp({ reset: true });
-        invalidatePreSessionToolSurface();
-      }
-      if (session?.id) mgr.closeSession(session.id, 'cli-plugin-remove');
-      await recreateCurrentSessionIfReady();
-      return { plugin: removed, status: pluginsStatus() };
-    },
-    async enablePluginMcp(plugin = {}) {
-      const root = clean(plugin.root);
-      const script = pluginMcpEnableScript(root, plugin);
-      if (!root || !script) throw new Error('plugin has no MCP script');
-      const serverName = pluginMcpServerName(plugin);
-      const nextConfig = { ...config };
-      const manifestMcp = pluginRawMcpServers(root, script);
-      if (manifestMcp) {
-        const { rawServers, mcpRoot } = manifestMcp;
-        const keys = Object.keys(rawServers).filter((k) => {
-          const v = rawServers[k];
-          return v !== null && typeof v === 'object' && !Array.isArray(v);
-        });
-        const ownedPrefix = `${serverName}--`;
-        const nextServers = {};
-        for (const [k, v] of Object.entries(nextConfig.mcpServers || {})) {
-          if (k === serverName || k.startsWith(ownedPrefix)) continue;
-          nextServers[k] = v;
-        }
-        for (const serverKey of keys) {
-          const cfg = normalizePluginMcpServerConfig(rawServers[serverKey], mcpRoot);
-          cfg.env = {
-            ...(cfg.env || {}),
-            MIXDOG_PLUGIN_ROOT: root,
-            MIXDOG_PLUGIN_DATA: join(cfgMod.getPluginData?.() || STANDALONE_DATA_DIR, 'plugins', 'data', clean(plugin.id || plugin.name || serverName)),
-          };
-          const key = keys.length === 1 ? serverName : `${serverName}--${serverKey}`;
-          nextServers[key] = cfg;
-        }
-        nextConfig.mcpServers = nextServers;
-      } else {
-        const scriptPath = resolveContainedPluginPath(root, script);
-        if (!scriptPath || !existsSync(scriptPath)) throw new Error(`plugin MCP script not found: ${join(root, script)}`);
-        nextConfig.mcpServers = {
-          ...(nextConfig.mcpServers || {}),
-          [serverName]: {
-            command: 'node',
-            args: [scriptPath],
-            cwd: root,
-            env: {
-              MIXDOG_PLUGIN_ROOT: root,
-              MIXDOG_PLUGIN_DATA: join(cfgMod.getPluginData?.() || STANDALONE_DATA_DIR, 'plugins', 'data', clean(plugin.id || plugin.name || serverName)),
-            },
-          },
-        };
-      }
-      saveConfigAndAdopt(nextConfig);
-      const status = await connectConfiguredMcp({ reset: true });
-      invalidatePreSessionToolSurface();
-      if (session?.id) mgr.closeSession(session.id, 'cli-plugin-mcp-enable');
-      await recreateCurrentSessionIfReady();
-      return { serverName, status };
-    },
-    hooksStatus() {
-      return hooks.status();
-    },
-    addHookRule(rule) {
-      return hooks.addRule(rule);
-    },
-    setHookRuleEnabled(index, enabled) {
-      return hooks.setRuleEnabled(index, enabled);
-    },
-    deleteHookRule(index) {
-      return hooks.deleteRule(index);
-    },
-    async memoryControl(args = {}) {
-      const memoryMod = await getMemoryModule();
-      if (!memoryMod?.handleToolCall) throw new Error('memory runtime is not available');
-      return toolResponseText(await memoryMod.handleToolCall('memory', args || {}));
-    },
-    async recall(query, args = {}) {
-      const baseQuery = query || args?.query || '';
-      if (args?.currentSession !== false && session?.id) {
-        const currentText = currentSessionRecallRows(session, baseQuery, { limit: args?.limit });
-        if (!isEmptyRecallText(currentText)) return currentText;
-      }
-      const memoryMod = await getMemoryModule();
-      if (!memoryMod?.handleToolCall) throw new Error('memory runtime is not available');
-      const baseArgs = {
-        ...(args || {}),
-        query: baseQuery,
-        cwd: args?.cwd || currentCwd,
-        // Grouping hint for multi-session browse output: lets the memory
-        // service mark THIS session's group as "(current)". Not a filter.
-        ...(session?.id ? { currentSessionId: session.id } : {}),
-      };
-      let result = '(no results)';
-      if (session?.id && args?.currentSession !== false && args?.forceCycleOnEmpty !== false) {
-        // Empty-fallback: hydrate the current transcript into the memory DB
-        // (no LLM — ingest only) and re-search session-scoped with the raw
-        // leg on. The old path also ran a synchronous cycle1 (LLM chunking)
-        // here, which made an empty recall the slowest possible recall and
-        // called the LLM even with recap/memory off; the raw rows are
-        // searchable directly (FTS/trgm + post-ingest raw embeddings), so
-        // chunking is left to the background cycle.
-        const messages = Array.isArray(session.messages) ? session.messages : [];
-        if (messages.length > 0) {
-          await memoryMod.handleToolCall('memory', {
-            action: 'ingest_session',
-            sessionId: session.id,
-            cwd: currentCwd,
-            messages,
-          });
-          result = toolResponseText(await memoryMod.handleToolCall('recall', {
-            ...baseArgs,
-            sessionId: session.id,
-            currentSession: true,
-            projectScope: baseArgs.projectScope || 'all',
-            includeRaw: baseArgs.includeRaw !== false,
-            includeArchived: baseArgs.includeArchived !== false,
-          }));
-        }
-      }
-      if (isEmptyRecallText(result)) {
-        result = toolResponseText(await memoryMod.handleToolCall('recall', baseArgs));
-      }
-      return result;
-    },
-    async setRoute(next, options = {}) {
-      // Model/provider changes take effect on the NEXT session only — never
-      // rewrite a running session's provider/model in place. A live turn's
-      // prompt cache (Anthropic/OpenAI/etc.) is provider-keyed; flipping
-      // session.provider mid-conversation forces a full cache-miss rewrite
-      // of the entire history on the very next turn (seen as a promptΔ
-      // spike + cache_ratio=0% in session-bench). `route` (this closure
-      // variable) still updates immediately so the NEXT createCurrentSession()
-      // picks it up; only the currently-open session is left untouched.
-      const applyToCurrentSession = options?.applyToCurrentSession === true;
-      const requested = { ...(next || {}) };
-      validateRequestedModelSelector(config, requested);
-      const providerExplicitlyRequested = clean(next?.provider) !== '';
-      if (requested.effort === undefined && !requested.provider && !requested.model && hasOwn(route, 'effort')) {
-        requested.effort = route.effort;
-      }
-      if (!requested.provider && requested.model && !findPreset(config, requested.model)) {
-        requested.provider = route.provider;
-      }
-      let selectedRoute = resolveRoute(config, requested);
-      await reg.initProviders(ensureProviderEnabled(config, selectedRoute.provider));
-      const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);
-      // Guard (option A / strict reject): a free-text string must never become the
-      // lead model. When the caller did not pin a provider, the route did not
-      // match a preset, and the model is unknown to both the live provider
-      // catalog (modelMeta is still the {id,provider} placeholder) and the
-      // offline catalog, refuse BEFORE any config write so a partial save
-      // (saveModelSettings/adoptConfig/persistLeadRoute) can never land.
-      if (!providerExplicitlyRequested
-        && !selectedRoute.preset
-        && !modelMetaLooksResolved(modelMeta)
-        && !getModelMetadataSync(selectedRoute.model, selectedRoute.provider)) {
-        throw new Error(`unknown model: ${selectedRoute.provider}/${selectedRoute.model}`);
-      }
-      const fastCapable = fastCapableFor(selectedRoute.provider, modelMeta);
-      selectedRoute = { ...selectedRoute, fast: fastCapable ? selectedRoute.fast === true : false };
-      adoptConfig(saveModelSettings(cfgMod, selectedRoute, { fastCapable, baseConfig: config }), { hasSecrets: configHasSecrets });
-      const leadRoute = persistLeadRoute(selectedRoute);
-      route = resolveRoute(config, leadRoute
-        ? { model: workflowPresetId('lead') }
-        : selectedRoute);
-      await refreshRouteEffort(modelMeta);
-      refreshStatuslineUsageSnapshot(route);
-      scheduleStatuslineUsageRefresh();
-      if (!applyToCurrentSession) {
-        // `route` is updated for the next session; the open session (and its
-        // live provider/model/cache chain) is left alone on purpose.
-        return route;
-      }
-      if (session) {
-        const updated = mgr.updateSessionRoute?.(session.id, {
-          provider: route.provider,
-          model: route.model,
-          fast: route.fast === true,
-          effort: route.effectiveEffort || null,
-        });
-        if (updated) session = updated;
-        else {
-          session.provider = route.provider;
-          session.model = route.model;
-          session.fast = route.fast === true;
-          session.effort = route.effectiveEffort || null;
-        }
-        writeStatuslineRoute(statusRoutes, session, route);
-        invalidateContextStatusCache();
-      }
-      return route;
-    },
-
-    async setFast(value) {
-      const enabled = value === true;
-      const modelMeta = await lookupModelMeta(route.provider, route.model);
-      const fastCapable = fastCapableFor(route.provider, modelMeta);
-      if (enabled && !fastCapable) {
-        throw new Error(`fast mode is not available for ${route.provider}/${route.model}`);
-      }
-      route = resolveRoute(config, { provider: route.provider, model: route.model, effort: route.effort, fast: fastCapable ? enabled : false });
-      adoptConfig(saveModelSettings(cfgMod, route, { fastCapable, baseConfig: config }), { hasSecrets: configHasSecrets });
-      const leadRoute = persistLeadRoute(route);
-      if (leadRoute) route = resolveRoute(config, { model: workflowPresetId('lead') });
-      await refreshRouteEffort(modelMeta);
-      if (session) {
-        session.fast = route.fast === true;
-        session.effort = route.effectiveEffort || null;
-        writeStatuslineRoute(statusRoutes, session, route);
-        invalidateContextStatusCache();
-      }
-      return route.fast === true;
-    },
-
-    async toggleFast() {
-      return await this.setFast(!(route.fast === true));
-    },
-
-    async setEffort(value) {
-      const normalized = normalizeEffortInput(value);
-      route = { ...route, effort: normalized };
-      const modelMeta = await lookupModelMeta(route.provider, route.model);
-      const fastCapable = fastCapableFor(route.provider, modelMeta);
-      adoptConfig(saveModelSettings(cfgMod, route, { fastCapable, baseConfig: config }), { hasSecrets: configHasSecrets });
-      const leadRoute = persistLeadRoute(route);
-      if (leadRoute) {
-        route = resolveRoute(config, { model: workflowPresetId('lead') });
-      }
-      await refreshRouteEffort(modelMeta);
-      if (session) {
-        session.effort = route.effectiveEffort || null;
-        writeStatuslineRoute(statusRoutes, session, route);
-        invalidateContextStatusCache();
-      }
-      return route;
-    },
-    async close(reason = 'cli-exit', options = {}) {
-      const detach = options?.detach === true || options?.wait === false || options?.waitForExit === false;
-      closeRequested = true;
-      // SessionEnd: bridge teardown to the standard hook bus. reason mapped to
-      // standard values ('clear'/'exit' where applicable, else 'other'). Short
-      // await guard so a slow hook cannot wedge teardown; best-effort.
-      try {
-        const rl = String(reason || '').toLowerCase();
-        const endReason = /clear/.test(rl) ? 'clear'
-          : /exit|quit|cli-exit|shutdown|sigint|sigterm/.test(rl) ? 'exit'
-          : 'other';
-        if (session?.id) {
-          await withTeardownDeadline(
-            Promise.resolve(hooks.dispatch('SessionEnd', hookCommonPayload({ session_id: session.id, reason: endReason }))).catch(() => {}),
-            300,
-            undefined,
-          );
-        }
-      } catch { /* best-effort: SessionEnd hook must never wedge teardown */ }
-      // Persist any change that is still sitting in the debounce window so a
-      // toggle made right before exit is not lost. Synchronous + best-effort:
-      // teardown must continue even if the final write fails.
-      try { flushConfigSave(); } catch {}
-      try { flushBackendSave(); } catch {}
-      try { flushOutputStyleSave(); } catch {}
-      if (prewarmTimers.channelStartTimer) {
-        clearTimeout(prewarmTimers.channelStartTimer);
-        prewarmTimers.channelStartTimer = null;
-      }
-      for (const timerKey of [
-        'providerSetupWarmupTimer',
-        'providerWarmupTimer',
-        'providerModelWarmupTimer',
-        'modelCatalogWarmupTimer',
-      ]) {
-        if (warmupTimers[timerKey]) {
-          clearTimeout(warmupTimers[timerKey]);
-          warmupTimers[timerKey] = null;
-        }
-      }
-      if (prewarmTimers.codeGraphPrewarmTimer) {
-        clearTimeout(prewarmTimers.codeGraphPrewarmTimer);
-        prewarmTimers.codeGraphPrewarmTimer = null;
-      }
-      for (const timerKey of ['statuslineUsageWarmupTimer', 'statuslineUsageRefreshTimer']) {
-        if (warmupTimers[timerKey]) {
-          clearTimeout(warmupTimers[timerKey]);
-          warmupTimers[timerKey] = null;
-        }
-      }
-      try { cancelBackgroundTasks({ reason, notify: false }); } catch {}
-      const channelStop = channels.stop(reason, detach ? { waitForExit: false } : undefined);
-      try { agentTool.closeAll(reason); } catch {}
-      let mcpStop = null;
-      try { mcpStop = mcpClient.disconnectAll?.(); } catch {}
-      const openaiWsStop = globalThis.__mixdogOpenaiWsRuntimeLoaded === true
-        ? import('./runtime/agent/orchestrator/providers/openai-oauth-ws.mjs')
-          .then((mod) => mod?.drainOpenaiWsPool?.(reason))
-          .catch(() => {})
-        : null;
-      const patchStop = closePatchRuntimeIfLoaded(detach ? { waitForExit: false } : undefined);
-      const memoryStop = memoryModPromise
-        ? memoryModPromise
-          .then((mod) => (typeof mod?.stop === 'function' ? mod.stop() : null))
-          .catch(() => {})
-          .finally(() => {
-            memoryModPromise = null;
-          })
-        : null;
-      let ok = false;
-      if (session?.id) {
-        statusRoutes?.clearGatewaySessionRoute?.(session.id);
-        // Bug fix: runtime stop/exit (TUI Ctrl-C, process exit) previously
-        // always tombstoned the current session, so a session you were
-        // mid-conversation in vanished from the Resume list the instant you
-        // quit and was hard-deleted by the 24h tombstone sweep. Only
-        // tombstone truly-empty scratch sessions; non-empty sessions must
-        // survive exit resumable.
-        // liveTurnMessages holds the in-flight user prompt until turn
-        // commit — an active first-turn ask has its user message there,
-        // not yet in session.messages, so it must also be checked or a
-        // first-turn exit could still burn a real session.
-        const tombstone = !hasUserConversationMessage(session.messages)
-          && !hasUserConversationMessage(session.liveTurnMessages);
-        ok = mgr.closeSession(session.id, reason, { tombstone });
-        session = null;
-      }
-      const shellJobsStop = globalThis.__mixdogShellJobsRuntimeLoaded === true
-        ? import('./runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs')
-          .then((mod) => mod?.shutdownShellJobs?.(reason, { sync: !detach }))
-          .catch(() => {})
-        : null;
-      const bashSessionsStop = globalThis.__mixdogBashSessionRuntimeLoaded === true
-        ? import('./runtime/agent/orchestrator/tools/bash-session.mjs')
-          .then((mod) => mod?.shutdownBashSessions?.(reason))
-          .catch(() => {})
-        : null;
-      if (detach) {
-        try { await withTeardownDeadline(channelStop, 300, false); } catch {}
-        try { await withTeardownDeadline(shellJobsStop, 300, false); } catch {}
-        try { await withTeardownDeadline(bashSessionsStop, 300, false); } catch {}
-        try { await withTeardownDeadline(memoryStop, 1500, false); } catch {}
-        for (const stop of [mcpStop, openaiWsStop, patchStop]) {
-          Promise.resolve(stop).catch(() => {});
-        }
-        return ok;
-      }
-      await Promise.allSettled([
-        withTeardownDeadline(channelStop, 5500, false),
-        withTeardownDeadline(mcpStop, 1500, false),
-        withTeardownDeadline(openaiWsStop, 1500, false),
-        withTeardownDeadline(patchStop, 1500, false),
-        withTeardownDeadline(memoryStop, 5500, false),
-        withTeardownDeadline(shellJobsStop, 1500, false),
-        withTeardownDeadline(bashSessionsStop, 1500, false),
-      ]);
-      return ok;
-    },
-    abort(reason = 'cli-abort') {
-      if (!session?.id) return false;
-      return mgr.abortSessionTurn(session.id, reason);
-    },
-    listSessions() {
-      return mgr.listSessions({}).map(s => {
-        const owner = clean(s.owner || 'user').toLowerCase();
-        if (owner && !['cli', 'user', 'mixdog', 'legacy'].includes(owner)) return null;
-        const sourceType = clean(s.sourceType || '').toLowerCase();
-        const sourceName = clean(s.sourceName || '').toLowerCase();
-        const agent = clean(s.agent || '').toLowerCase();
-        const leadish = agent === 'lead'
-          || sourceType === 'lead'
-          // Bug fix: side-terminal cli sessions have a non-empty/non-'main' sourceName
-          // (e.g. terminal id) and were being hidden from resume even though they are
-          // legitimate user sessions, not agent-owned. Any sourceName is fine for cli.
-          || (sourceType === 'cli')
-          || (!sourceType && !sourceName && !isAgentOwner(owner));
-        if (!leadish) return null;
-        let preview = cleanSessionPreview(s.preview || '');
-        let messageCount = Math.max(0, Number(s.messageCount) || 0);
-        if (!preview && Array.isArray(s.messages)) {
-          const msgs = s.messages || [];
-          const userPreviews = msgs
-            .filter(m => m && m.role === 'user')
-            .map(m => cleanSessionPreview(sessionMessageText(m.content)))
-            .filter(text => !isSessionPreviewNoise(text));
-          preview = userPreviews[userPreviews.length - 1] || userPreviews[0] || '';
-          messageCount = msgs.filter(m => m && (m.role === 'user' || m.role === 'assistant')).length;
-        }
-        // Bug fix: sessions whose preview couldn't be derived (e.g. noise-only user
-        // turns) were silently dropped from the resume list even when they had real
-        // messages. Keep the row and let preview fall back to '' (TUI renders
-        // '(no message)' for empty preview); only drop truly-empty scratch sessions
-        // with zero visible messages.
-        if (!preview && messageCount === 0) return null;
-        return {
-          id: s.id,
-          updatedAt: s.updatedAt,
-          cwd: s.cwd || '',
-          model: s.model,
-          provider: s.provider,
-          messageCount,
-          preview,
-        };
-      }).filter(Boolean);
-    },
-    async newSession() {
-      if (session?.id) {
-        // Bug fix: /new used to unconditionally tombstone the outgoing
-        // session, so switching to a fresh session burned whatever you'd
-        // been working on — it dropped off the Resume list immediately and
-        // was hard-deleted after the 24h tombstone sweep. Only tombstone
-        // truly-empty scratch sessions; keep non-empty ones resumable.
-        const tombstone = !hasUserConversationMessage(session.messages)
-          && !hasUserConversationMessage(session.liveTurnMessages);
-        mgr.closeSession(session.id, 'cli-new', { tombstone });
-        // Bug fix: closeSession({tombstone:false}) keeps the outgoing
-        // session file intact so it stays resumable — but that meant
-        // createCurrentSession()'s live-session reuse check (session?.id →
-        // mgr.getSession(...) not closed) happily reloaded the SAME session,
-        // so /new never actually reset the transcript and the context gauge
-        // never returned to 0. Drop the in-memory reference so a fresh
-        // session is always created.
-        session = null;
-      }
-      invalidateContextStatusCache();
-      await createCurrentSession();
-      return session.id;
-    },
-    async resume(id) {
-      const previousId = session?.id || null;
-      const previousMessages = session?.messages || null;
-      const previousLive = session?.liveTurnMessages || null;
-      const resumed = await mgr.resumeSession(id, toolSpecForMode(mode));
-      if (!resumed) return null;
-      if (previousId && previousId !== resumed.id) {
-        statusRoutes?.clearGatewaySessionRoute?.(previousId);
-        // Bug fix: /resume used to unconditionally tombstone the session
-        // you were switching away from, so it vanished from the Resume
-        // list right away and was hard-deleted after the 24h sweep — the
-        // exact "burn a resumable session" bug this fix targets. Only
-        // tombstone truly-empty scratch sessions.
-        const tombstone = !hasUserConversationMessage(previousMessages)
-          && !hasUserConversationMessage(previousLive);
-        mgr.closeSession(previousId, 'cli-resume', { tombstone });
-      }
-      session = resumed;
-      currentCwd = resumed.cwd || currentCwd;
-      applyResolvedCwd(currentCwd, { markRefresh: false });
-      const resumeEffort = hasOwn(route, 'effort') ? route.effort : resumed.effort;
-      route = resolveRoute(config, { provider: resumed.provider, model: resumed.model, effort: resumeEffort });
-      await refreshRouteEffort();
-      session.effort = route.effectiveEffort || null;
-      session.cwd = currentCwd;
-      applyDeferredToolSurface(session, deferredSurfaceModeForLead(mode), standaloneTools, { provider: route.provider });
-      invalidatePreSessionToolSurface();
-      invalidateContextStatusCache();
-      sessionNeedsCwdRefresh = false;
-      writeStatuslineRoute(statusRoutes, session, route);
-      return {
-        id: resumed.id,
-        messages: resumed.messages || [],
-        cwd: currentCwd,
-        provider: resumed.provider,
-        model: resumed.model,
-      };
-    },
-  };
-}
+// Thin facade. The former ~3.3k-line implementation was split into cohesive
+// modules under src/session-runtime/ (runtime-core.mjs holds the orchestrator
+// createMixdogSessionRuntime plus the module-level wiring; env.mjs and
+// boot-profile.mjs hold the extracted env/boot helpers). This file re-exports
+// the exact same public API so existing importers (TUI engine,
+// scripts/tool-smoke.mjs, tests) keep their import paths unchanged.
+export * from './session-runtime/runtime-core.mjs';