mixdog 1.0.11 → 1.1.0

package/src/session-runtime/usage-stats-api.mjs

@@ -14,13 +14,26 @@ import {
 } from '../runtime/shared/provider-accounts.mjs';
 
 const MAX_MODEL_LIMIT = 50;
+const SNAPSHOT_REUSE_MS = 1000;
+const SNAPSHOT_CACHE_LIMIT = 8;
 
 const quotaText = (value) => (typeof value === 'string' ? value.slice(0, 200) : '');
 
 // What the ledger cannot know: each subscription account's label and place in
 // its provider's account pool, the order the account picker lists them in.
-function labelQuotaHistory(history, accountPool) {
+function labelQuotaHistory(history, accountPool, accountEmails) {
   const rosters = new Map();
+  const emails = new Map();
+  const emailsOf = (provider) => {
+    if (!emails.has(provider)) {
+      try {
+        emails.set(provider, accountEmails(provider) || {});
+      } catch {
+        emails.set(provider, {});
+      }
+    }
+    return emails.get(provider);
+  };
   const rosterOf = (provider) => {
     if (!ACCOUNT_PROVIDERS.includes(provider)) return [];
     if (!rosters.has(provider)) {
@@ -37,7 +50,19 @@ function labelQuotaHistory(history, accountPool) {
     subscriptions: (history.subscriptions || []).map((row) => {
       const roster = rosterOf(row.provider);
       const rank = roster.findIndex((entry) => entry.id === row.account);
-      return { ...row, accountLabel: roster[rank]?.label || '', accountRank: rank < 0 ? null : rank };
+      const email = rank < 0 ? '' : quotaText(emailsOf(row.provider)[row.account]);
+      // History of an account that left the roster stays stored, but the
+      // picker must not offer it. The implicit `default` account of a provider
+      // with no stored roster is still current.
+      const inRoster =
+        !ACCOUNT_PROVIDERS.includes(row.provider) || rank >= 0 || (row.account === 'default' && !roster.length);
+      return {
+        ...row,
+        accountLabel: roster[rank]?.label || '',
+        accountRank: rank < 0 ? null : rank,
+        accountInRoster: inRoster,
+        ...(email ? { accountEmail: email } : {}),
+      };
     }),
   };
 }
@@ -122,10 +147,13 @@ export function createUsageStatsApi({
   ledger = getUsageLedger,
   importHistory = importUsageHistory,
   accountPool = readProviderAccountPool,
+  // provider -> { [accountId]: email } for the picker's secondary text.
+  accountEmails = () => ({}),
   getSessionId = () => null,
 } = {}) {
   let importing = null;
   let imported = false;
+  const snapshots = new Map();
   // Until the first instrumented send establishes the cutover, the legacy
   // writer may still be active. A previous import is not a live subscription.
   async function ensureHistoryImported(store, liveSince) {
@@ -156,6 +184,15 @@ export function createUsageStatsApi({
       const period = usagePeriodFor(options, now);
       // The rollup query runs off the event loop (usage-rollup-worker.mjs).
       const rollup = await store.rollupAsync(usageRollupQuery(period));
+      // The ledger returns the same rollup object while nothing was committed
+      // (and while a rolling window lost no record), so identical back-to-back
+      // requests over it are one answer; the clock bound keeps the snapshot's
+      // time-relative fields from ageing.
+      const cacheKey = JSON.stringify([options, liveSince]);
+      const held = snapshots.get(cacheKey);
+      if (held && held.rollup === rollup && now - held.now >= 0 && now - held.now < SNAPSHOT_REUSE_MS) {
+        return held.snapshot;
+      }
       const snapshot = usageStatsSnapshot({
         rollup,
         days: normalizeDays(options?.days),
@@ -170,6 +207,9 @@ export function createUsageStatsApi({
       });
       snapshot.coverage.ledger = true;
       snapshot.coverage.liveSince = liveSince || null;
+      snapshots.delete(cacheKey);
+      snapshots.set(cacheKey, { rollup, now, snapshot });
+      if (snapshots.size > SNAPSHOT_CACHE_LIMIT) snapshots.delete(snapshots.keys().next().value);
       return snapshot;
     },
 
@@ -216,7 +256,7 @@ export function createUsageStatsApi({
         toMs: period?.toMs ?? null,
         now,
       });
-      return labelQuotaHistory(period ? { ...history, period } : history, accountPool);
+      return labelQuotaHistory(period ? { ...history, period } : history, accountPool, accountEmails);
     },
   };
 }

package/src/session-runtime/workflow-agents-api/agent-editor.mjs

@@ -4,21 +4,35 @@ import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-tex
 import { hasOwn } from '../../runtime/shared/object.mjs';
 import { serializeFrontmatterDoc } from '../../runtime/shared/markdown-frontmatter.mjs';
 import { isHiddenAgent } from '../../runtime/agent/orchestrator/internal-agents.mjs';
-import { AGENT_DELETED_MARKER, FIXED_AGENT_SLOTS, availableAgentId, clearAgentDefinitionCache } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
+import {
+  AGENT_DELETED_MARKER,
+  FIXED_AGENT_SLOTS,
+  availableAgentId,
+  clearAgentDefinitionCache,
+} from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
 import {
   canonicalizeAgentRouteStorage,
   isAgentDisabled,
   withAgentDisabled,
 } from '../../runtime/shared/agent-route-config.mjs';
 import { agentEditorId, effectiveAgentRoute, oneLine, resolveDataDir } from './shared.mjs';
+import { absorbSaveEqualToShipped } from '../../runtime/shared/shipped-definitions.mjs';
+import { STANDALONE_ROOT } from '../runtime-paths.mjs';
 
 const isFixedAgent = (id) => FIXED_AGENT_SLOTS.some((agent) => agent.id === id);
 const hasUserAgentFile = (dataDir, id) => existsSync(join(dataDir, 'agents', id, 'AGENT.md'));
 
-function writeAgentFiles(dir, { name, description, body }) {
+// Frontmatter the editor does not show (e.g. `permission`), taken from the
+// definition in effect: the user's own copy if any, else the shipped one.
+function hiddenFrontmatter(definition) {
+  const { name: _name, description: _description, ...rest } = definition?.frontmatter || {};
+  return rest;
+}
+
+function writeAgentFiles(dir, { name, description, body, extra = {} }) {
   const meta = { name, ...(description ? { description } : {}) };
   mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, 'AGENT.md'), serializeFrontmatterDoc(meta, body));
+  writeFileSync(join(dir, 'AGENT.md'), serializeFrontmatterDoc({ ...meta, ...extra }, body));
   // loadAgentDefinition prefers the manifest for name/description.
   writeFileSync(join(dir, 'agent.json'), `${JSON.stringify(meta, null, 2)}\n`);
   rmSync(join(dir, AGENT_DELETED_MARKER), { force: true });
@@ -99,8 +113,20 @@ export function createAgentEditorApi(deps) {
     if (!body) throw new Error('AGENT.md body must not be empty');
     const dataDir = resolveDataDir(deps);
     const { id, name, description } = resolveSaveTarget(payload, dataDir);
-    const existed = Boolean(loadAgentDefinition(dataDir, id));
-    writeAgentFiles(join(dataDir, 'agents', id), { name: name || id, description, body });
+    const current = loadAgentDefinition(dataDir, id);
+    const existed = Boolean(current);
+    const definition = { name: name || id, description, body };
+    // Equal to the shipped agent: keep no copy so it follows the shipped version.
+    const absorbed = absorbSaveEqualToShipped({
+      rootDir: deps.rootDir ?? STANDALONE_ROOT,
+      dataDir,
+      dir: 'agents',
+      id,
+      entry: 'AGENT.md',
+      files: ['AGENT.md', 'agent.json'],
+      definition,
+    });
+    if (!absorbed) writeAgentFiles(join(dataDir, 'agents', id), { ...definition, extra: hiddenFrontmatter(current) });
     clearAgentDefinitionCache(id);
     // A newly created agent starts enabled; a stale roster entry left by an
     // earlier agent of the same id must not disable it.

package/src/session-runtime/workflow-agents-api/agent-route.mjs

@@ -3,7 +3,7 @@ import { hasOwn } from '../../runtime/shared/object.mjs';
 import { isHiddenAgent } from '../../runtime/agent/orchestrator/internal-agents.mjs';
 import { normalizeWorkflowRoute } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
 import { ensureProviderEnabled } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
-import { fastCapableFor } from '../../runtime/agent/orchestrator/runtime-core/model-capabilities.mjs';
+import { selectionFastCapable } from '../route-state.mjs';
 import { canonicalizeAgentRouteStorage, withAgentDisabled } from '../../runtime/shared/agent-route-config.mjs';
 import { agentEditorId } from './shared.mjs';
 
@@ -43,16 +43,20 @@ export function createAgentRouteApi(deps) {
       clean(selectedRoute.provider) === clean(stored.provider) && clean(selectedRoute.model) === clean(stored.model);
     const inheritedEffort = sameModel ? stored.effort || null : null;
     const inheritedModelParameters = sameModel ? stored.modelParameters || {} : {};
+    const inheritedContextPercent = sameModel ? stored.contextPercent : undefined;
     selectedRoute = {
       ...selectedRoute,
       effort: requested.effort !== undefined ? selectedRoute.effort : inheritedEffort,
       fast: requested.fast !== undefined ? selectedRoute.fast === true : sameModel && stored.fast === true,
       modelParameters:
         requested.modelParameters !== undefined ? selectedRoute.modelParameters : inheritedModelParameters,
+      // resolveRoute reads contextPercent from Main's modelSettings bucket;
+      // an agent route owns its own.
+      contextPercent: requested.contextPercent !== undefined ? requested.contextPercent : inheritedContextPercent,
     };
     await ensureProvidersReady(ensureProviderEnabled(getConfig(), selectedRoute.provider));
     const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);
-    const fastCapable = fastCapableFor(
+    const fastCapable = selectionFastCapable(
       selectedRoute.provider,
       modelMeta,
       selectedRoute.effort,

package/src/session-runtime/workflow-agents-api/workflow-packs.mjs

@@ -1,8 +1,15 @@
 import { join } from 'node:path';
 import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { serializeFrontmatterDoc } from '../../runtime/shared/markdown-frontmatter.mjs';
-import { normalizeWorkflowId, workflowIdFromName, availableWorkflowId, DEFAULT_WORKFLOW_ID } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
+import {
+  normalizeWorkflowId,
+  workflowIdFromName,
+  availableWorkflowId,
+  DEFAULT_WORKFLOW_ID,
+} from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
 import { oneLine, resolveDataDir } from './shared.mjs';
+import { absorbSaveEqualToShipped } from '../../runtime/shared/shipped-definitions.mjs';
+import { STANDALONE_ROOT } from '../runtime-paths.mjs';
 
 // Workflow packs: the catalog/active switch plus the editor surface (desktop
 // Workflows page). User packs live at <dataDir>/workflows/<id>/WORKFLOW.md;
@@ -75,12 +82,25 @@ export function createWorkflowPacksApi(deps) {
     if (!body) throw new Error('WORKFLOW.md body must not be empty');
     const name = oneLine(payload.name) || id;
     const description = oneLine(payload.description);
-    const dir = join(resolveDataDir(deps), 'workflows', id);
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(
-      join(dir, 'WORKFLOW.md'),
-      serializeFrontmatterDoc({ id, name, ...(description ? { description } : {}) }, body)
-    );
+    const dataDir = resolveDataDir(deps);
+    // Equal to the shipped pack: keep no copy so it follows the shipped version.
+    const absorbed = absorbSaveEqualToShipped({
+      rootDir: deps.rootDir ?? STANDALONE_ROOT,
+      dataDir,
+      dir: 'workflows',
+      id,
+      entry: 'WORKFLOW.md',
+      files: ['WORKFLOW.md'],
+      definition: { name, description, body },
+    });
+    if (!absorbed) {
+      const dir = join(dataDir, 'workflows', id);
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(
+        join(dir, 'WORKFLOW.md'),
+        serializeFrontmatterDoc({ id, name, ...(description ? { description } : {}) }, body)
+      );
+    }
     return getWorkflowPack(id);
   }
 

package/src/standalone/daemon-boot-coordinator.mjs

@@ -7,6 +7,9 @@
 export function createDaemonBootCoordinator({
   prewarmKeychain,
   recoverActiveGoals,
+  // Starts the quota auto-resume clock once the keychain is warm (usage
+  // readings need provider credentials); overdue resumes run right away.
+  startQuotaResume = null,
   // Catalog module imports (session summaries, projects) cost ~1.1s cold and
   // used to land on the FIRST rail click. They ride the background lane
   // after Goal recovery, behind a short delay so the user's first action —
@@ -58,6 +61,13 @@ export function createDaemonBootCoordinator({
         `active Goal recovery found=${result.found} resumed=${result.resumed}` +
           ` skipped=${result.skipped} failed=${result.failed}`
       );
+      if (typeof startQuotaResume === 'function') {
+        try {
+          startQuotaResume();
+        } catch (error) {
+          log(`quota resume start failed (non-fatal): ${error?.message || error}`);
+        }
+      }
       if (typeof prewarmCatalogs === 'function') {
         await new Promise((resolve) => delay(resolve, catalogDelayMs));
         await measure('catalog-prewarm', prewarmCatalogs).catch((error) => {

package/src/standalone/daemon-desktop-runtime.mjs

@@ -17,6 +17,7 @@ export function createDesktopRuntime({ getLocalSessionBridge }) {
     },
     loadProjects: () => import('../runtime/shared/projects.mjs'),
     loadSessionStore: () => import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
+    loadSessionSearch: () => import('../runtime/session-search/session-search-db.mjs'),
     loadStatuslineSegments: () => import('../runtime/shared/statusline/statusline-segments.mjs'),
     loadConfig: () => import('../runtime/shared/config.mjs'),
     loadDocumentPreview: () => import('../runtime/office/pdf/document-preview.mjs'),

package/src/standalone/daemon-drain-policy.mjs

@@ -0,0 +1,9 @@
+/** Whether self-shutdown must wait for in-flight work. A forced replacement
+ *  never waits: shutdown() aborts busy sessions, service calls and agent runs. */
+export function drainDeferral(work, { force = false } = {}) {
+  if (force) return null;
+  const { activeCalls = 0, queuedCalls = 0, busySessions = 0, busyMemoryAgents = 0 } = work || {};
+  if (activeCalls > 0 || queuedCalls > 0) return 'calls';
+  if (busySessions > 0 || busyMemoryAgents > 0) return 'busy';
+  return null;
+}

package/src/standalone/daemon-stored-session-views.mjs

@@ -6,7 +6,10 @@
 //
 // Inputs: `desktopRuntime` (lazy module loaders) and `dataDir` (goal
 // snapshots). Output: the read-only half of the session-service options.
-import { listStoredActiveGoalSessionIds, readStoredGoalSnapshot } from '../runtime/agent/orchestrator/runtime-core/goal-runtime.mjs';
+import {
+  listStoredActiveGoalSessionIds,
+  readStoredGoalSnapshot,
+} from '../runtime/agent/orchestrator/runtime-core/goal-runtime.mjs';
 
 export function createStoredSessionViews({ desktopRuntime, dataDir }) {
   return {
@@ -31,14 +34,10 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
       const store = await desktopRuntime.loadSessionStore();
       const metadata = await store.readStoredSessionTranscript?.(sessionId, { metadataOnly: true });
       if (!metadata) return null;
-      const [{ createRuntimeReviewApi }, { turnReviewReply }] = await Promise.all([
-        import('../session-runtime/runtime-review-api.mjs'),
-        import('../runtime/shared/turn-review-reply.mjs'),
-      ]);
+      const { createRuntimeReviewApi } = await import('../session-runtime/runtime-review-api.mjs');
       const review = createRuntimeReviewApi({ getCwd: () => metadata.cwd || '', getSessionId: () => sessionId });
-      return action === 'getSessionReviewDiff'
-        ? review.getSessionReviewDiff()
-        : turnReviewReply(review.getTurnReviewDiff, args[0]);
+      // The runtime review API answers `known`/`summary` itself (turnReviewReply).
+      return action === 'getSessionReviewDiff' ? review.getSessionReviewDiff() : review.getTurnReviewDiff(args[0]);
     },
     forgetStoredSession: async (sessionId) => {
       const store = await desktopRuntime.loadSessionStore();

package/src/standalone/daemon.mjs

@@ -54,18 +54,23 @@ import {
 } from '../runtime/agent/orchestrator/providers/stream-json-pool.mjs';
 import { createAgentDispatchBroker } from './agent-dispatch-broker.mjs';
 import { createChannelTransport } from './channel-transport.mjs';
+import { drainDeferral } from './daemon-drain-policy.mjs';
 import { createChannelSessionRouter } from '../session-runtime/services/channel-session-router.mjs';
 import { createSessionTransport } from './session-transport.mjs';
 import { createSessionService } from './session-service.mjs';
 import { createLocalSessionBridge } from './daemon-local-session-bridge.mjs';
 import { createStoredSessionViews } from './daemon-stored-session-views.mjs';
+import * as quotaResumeStore from '../runtime/shared/quota-resume-store.mjs';
 import { createInlineSessionRuntimeHost } from './session-runtime-inline-host.mjs';
 import { getStandaloneMemoryRuntime } from '../session-runtime/services/memory-runtime-proxy.mjs';
 import { createBootPhaseProfiler } from './boot-phase-profiler.mjs';
 import { createDaemonBootCoordinator } from './daemon-boot-coordinator.mjs';
 import { createDaemonLog } from './daemon-log.mjs';
 import { daemonCrashCaptureDir } from '../session-runtime/services/daemon-crash-capture/paths.mjs';
-import { installDaemonExitRecorder, reconcileLostDaemonCaptures } from '../session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs';
+import {
+  installDaemonExitRecorder,
+  reconcileLostDaemonCaptures,
+} from '../session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs';
 import { createDaemonTelemetry } from './daemon-telemetry.mjs';
 import { createLagProfiler } from './daemon-lag-profiler.mjs';
 import { createChannelsRuntimeLoader } from './daemon-channels-loader.mjs';
@@ -128,8 +133,10 @@ let daemonTelemetry = null;
 
 function registerMemoryRuntimeLazy() {
   // Register the shared proxy immediately so daemon shutdown owns its
-  // lifecycle, but keep the isolated process off the startup path. A real
-  // memory call or the post-connect idle warmup starts the exact singleton.
+  // lifecycle, but keep the isolated process off the startup path. The first
+  // real memory call (memory/recall tools, the Memory install) starts the
+  // singleton; nothing warms it at boot. The PG cluster itself usually starts
+  // earlier: the channels schedules/webhooks stores open it at boot.
   if (process.env.MIXDOG_DAEMON_SKIP_MEMORY === '1') {
     log('memory runtime skipped (MIXDOG_DAEMON_SKIP_MEMORY=1)');
     return;
@@ -347,7 +354,11 @@ function maybeSelfShutdown(reason) {
     return;
   }
   const { activeCalls, queuedCalls, busySessions, busyMemoryAgents } = inFlightWork();
-  if (activeCalls > 0 || queuedCalls > 0) {
+  const deferral = drainDeferral(
+    { activeCalls, queuedCalls, busySessions, busyMemoryAgents },
+    { force: replacementRequested?.force === true }
+  );
+  if (deferral === 'calls') {
     log(`shutdown deferred (${reason}): activeCalls=${activeCalls} queuedCalls=${queuedCalls}`);
     if (!shutdownRecheckTimer) {
       shutdownRecheckTimer = setTimeout(() => {
@@ -360,7 +371,7 @@ function maybeSelfShutdown(reason) {
   }
   // A turn in flight outlives every view — closing the app or the terminal is
   // not a reason to abandon work the daemon is still running.
-  if (busySessions > 0 || busyMemoryAgents > 0) {
+  if (deferral === 'busy') {
     log(`shutdown deferred (${reason}): busySessions=${busySessions}` + ` memoryAgents=${busyMemoryAgents}`);
     if (!shutdownRecheckTimer) {
       shutdownRecheckTimer = setTimeout(() => {
@@ -378,8 +389,10 @@ function maybeSelfShutdown(reason) {
   void shutdown(reason);
 }
 
-function requestDaemonReplacement({ protocol, revision, version } = {}) {
+function requestDaemonReplacement({ protocol, revision, version, force } = {}) {
+  const forced = force === true;
   const requested = {
+    force: forced,
     protocol: Number(protocol),
     revision: Math.max(0, Number(revision) || 0),
     version: String(version || '0.0.0'),
@@ -391,12 +404,14 @@ function requestDaemonReplacement({ protocol, revision, version } = {}) {
   if (
     replacementRequested &&
     requested.revision === replacementRequested.revision &&
-    requested.version === replacementRequested.version
+    requested.version === replacementRequested.version &&
+    !(forced && replacementRequested.force !== true)
   )
     return true;
   replacementRequested = requested;
   const reason = `daemon replacement by revision/build ${requested.revision}/${requested.version}`;
-  log(`${reason} requested — preserving clients until live work settles`);
+  if (forced) log(`${reason} FORCED — aborting in-flight work (sessions, service calls, agent runs)`);
+  else log(`${reason} requested — preserving clients until live work settles`);
   sessionTransport?.beginDrain?.(reason);
   transport?.beginDrain?.(reason);
   maybeSelfShutdown(reason);
@@ -607,6 +622,13 @@ async function main() {
   // The daemon owns prompt attachments; its census runs off the boot path
   // (first attempt after the store's start delay, then per its interval).
   void import('../runtime/attachments/store.mjs').then((store) => store.startAttachmentGc()).catch(() => {});
+  // Session-search backfill: once per run, well after boot, low priority.
+  const sessionSearchBackfillTimer = setTimeout(() => {
+    void import('../runtime/session-search/session-search-ingest.mjs')
+      .then((search) => search.backfillSessionSearch())
+      .catch((error) => log(`session-search backfill failed: ${error?.message || error}`));
+  }, 60_000);
+  sessionSearchBackfillTimer.unref?.();
   // The first session per repository would otherwise run `git status` and
   // `git check-ignore` synchronously while composing its prompt. Registered
   // projects (a small JSON list, most recently selected first) are the cwds
@@ -691,6 +713,7 @@ async function main() {
   const bootCoordinator = createDaemonBootCoordinator({
     prewarmKeychain: () => sessionRuntimeHost.prewarmKeychain(),
     recoverActiveGoals: () => sessionService.recoverActiveGoals(),
+    startQuotaResume: () => sessionService.startQuotaResume(),
     // The modules every rail catalog request needs (session summaries,
     // projects, statusline segments) — warm them once the desktop is up so
     // the first Sessions/Projects click reads a hot module graph.
@@ -717,6 +740,11 @@ async function main() {
       maybeSelfShutdown('remote clients changed');
     },
     onDesktopReady: () => bootCoordinator.notifyDesktopReady(),
+    quotaResumeStore,
+    readQuotaUsable: async (provider, model) => {
+      const { providerQuotaUsable } = await import('../runtime/agent/orchestrator/providers/quota-reading.mjs');
+      return providerQuotaUsable(provider, model);
+    },
     log,
   });
   sessionTransport = createSessionTransport({

package/src/standalone/local-session-runtime.mjs

@@ -18,6 +18,8 @@ import { createAgentJobFeed } from '../tui/session/agent-job-feed.mjs';
 import { createContextState } from '../tui/session/context-state.mjs';
 import { createSessionFlow } from '../tui/session/session-flow.mjs';
 import { createRunTurn } from '../tui/session/turn.mjs';
+import { createQuotaResumeLane } from '../tui/session/quota-resume.mjs';
+import { publicQuotaResume, quotaResumeEntry } from '../runtime/shared/quota-resume-store.mjs';
 import { createSessionApi } from '../tui/session/session-api.mjs';
 import { createSessionDraftStore } from '../tui/session/draft-store.mjs';
 import { createInitialSessionState } from '../tui/session/initial-state.mjs';
@@ -197,6 +199,8 @@ export async function createLocalSessionRuntime({
   effort,
   fast,
   modelParameters,
+  contextPercent,
+  selectedContextWindow,
   toolMode = 'full',
   remote = false,
   cwd,
@@ -223,6 +227,8 @@ export async function createLocalSessionRuntime({
     effort,
     fast,
     modelParameters,
+    contextPercent,
+    selectedContextWindow,
     toolMode,
     remote,
     ...(cwd ? { cwd } : {}),
@@ -235,6 +241,8 @@ export async function createLocalSessionRuntime({
   const stateStartedAt = performance.now();
   const flags = {
     disposed: false,
+    // Canonical-close execution fence: 'open' | 'closing' | 'terminal'.
+    admission: 'open',
     draining: false,
     autoClearRunning: false,
     pendingSessionReset: false,
@@ -272,6 +280,7 @@ export async function createLocalSessionRuntime({
     },
     getPendingSessionReset: () => flags.pendingSessionReset,
     getVisibleGoal: () => (visibleGoalStatus ? visibleGoalStatus() : runtime.goalStatus?.() || null),
+    getQuotaResume: () => publicQuotaResume(quotaResumeEntry(runtime.id)),
   });
   draft.state = createInitialSessionState({ runtime, runtimeCwd, baseRouteState });
   bootProfile('session:route-state-ready', { ms: (performance.now() - stateStartedAt).toFixed(1) });
@@ -368,6 +377,7 @@ export async function createLocalSessionRuntime({
     set,
     nextId,
     getDisposed: () => flags.disposed,
+    getAdmission: () => flags.admission || 'open',
     patchItem,
     enqueue: (...args) => bag.enqueue(...args),
     drain: (...args) => bag.drain(...args),
@@ -474,6 +484,7 @@ export async function createLocalSessionRuntime({
     })
   );
   visibleGoalStatus = bag.visibleGoalStatus;
+  Object.assign(bag, createQuotaResumeLane(bag));
   bag.runTurn = createRunTurn(bag);
   bag.doctor = { runDoctorChecks, formatDoctorReport };
   const api = createSessionApi(bag);

package/src/standalone/session-client.mjs

@@ -199,7 +199,41 @@ export function sessionDaemonCompatibility(
   return { status: 'compatible', ...details };
 }
 
-async function replaceLowerDaemon(discovery, initialHealth, { log }) {
+/** Ask the running daemon to yield to this build immediately, aborting its
+ *  in-flight work. Resolves true when the request was accepted. */
+export async function forceDaemonUpgrade({ log = () => {} } = {}) {
+  const discovery = readSessionDiscovery();
+  if (!discovery) return false;
+  const result = await request({
+    port: discovery.port,
+    token: discovery.token,
+    method: 'POST',
+    path: '/upgrade',
+    body: {
+      protocol: SESSION_PROTOCOL,
+      revision: SESSION_REVISION,
+      version: runtimeVersion(),
+      force: true,
+    },
+    timeoutMs: 3_000,
+    control: true,
+  });
+  const accepted = result?.accepted === true;
+  log(`forced daemon upgrade ${accepted ? 'accepted' : 'not accepted'}`);
+  return accepted;
+}
+
+async function replaceLowerDaemon(discovery, initialHealth, { log, onUpgradeWait = null }) {
+  const info = { fromVersion: initialHealth?.version, toVersion: runtimeVersion() };
+  const notify = (state) => {
+    try {
+      onUpgradeWait?.({ state, ...info });
+    } catch {}
+  };
+  const done = () => {
+    notify('done');
+    return true;
+  };
   const configuredTimeoutMs = Number(process.env.MIXDOG_DAEMON_UPGRADE_TIMEOUT_MS);
   // A stuck older daemon (a worker that never finishes draining) must not hang
   // every newer client forever: the wait is always bounded, and the caller
@@ -226,17 +260,18 @@ async function replaceLowerDaemon(discovery, initialHealth, { log }) {
   });
   if (result?.accepted !== true) throw new Error('daemon replacement was not accepted');
   log(`waiting for daemon build ${initialHealth?.version || 'unknown'}` + ` to yield to ${runtimeVersion()}`);
+  notify('waiting');
   while (Date.now() < deadline) {
     const current = readSessionDiscovery();
-    if (!current || Number(current.pid) !== Number(discovery.pid)) return true;
+    if (!current || Number(current.pid) !== Number(discovery.pid)) return done();
     const health = await probeSessionHealth({
       port: current.port,
       token: current.token,
       timeoutMs: 800,
     });
-    if (!health || Number(health.pid) !== Number(discovery.pid)) return true;
+    if (!health || Number(health.pid) !== Number(discovery.pid)) return done();
     const compatibility = sessionDaemonCompatibility(health);
-    if (compatibility.status === 'compatible' || compatibility.status === 'daemon-newer') return true;
+    if (compatibility.status === 'compatible' || compatibility.status === 'daemon-newer') return done();
     await delay(100);
   }
   const error = new Error('newer daemon build is still waiting for active work to finish');
@@ -285,14 +320,20 @@ export function spawnDaemonCandidate({ cwd, log, timeoutMs = 30_000, entry = dae
 }
 
 /** Spawn-or-attach discovery for the machine-global daemon. */
-export async function ensureDaemon({ cwd = process.cwd(), log = () => {}, attempts = 5, readyTimeoutMs = null } = {}) {
+export async function ensureDaemon({
+  cwd = process.cwd(),
+  log = () => {},
+  attempts = 5,
+  readyTimeoutMs = null,
+  onUpgradeWait = null,
+} = {}) {
   const configuredTimeoutMs = Number(process.env.MIXDOG_DAEMON_READY_TIMEOUT_MS);
   let requestedTimeoutMs = DEFAULT_DAEMON_READY_TIMEOUT_MS;
   if (Number.isFinite(Number(readyTimeoutMs)) && Number(readyTimeoutMs) > 0)
     requestedTimeoutMs = Number(readyTimeoutMs);
   else if (configuredTimeoutMs > 0) requestedTimeoutMs = configuredTimeoutMs;
   const timeoutMs = Math.max(1, requestedTimeoutMs);
-  const deadline = Date.now() + timeoutMs;
+  let deadline = Date.now() + timeoutMs;
   const maxSpawnAttempts = Math.max(0, Math.floor(Number(attempts) || 0));
   let spawnAttempts = 0;
   let waitingOwnerPid = 0;
@@ -334,7 +375,10 @@ export async function ensureDaemon({ cwd = process.cwd(), log = () => {}, attemp
           return discovery;
         }
         if (compatibility.status === 'client-newer') {
-          await replaceLowerDaemon(discovery, health, { log });
+          await replaceLowerDaemon(discovery, health, { log, onUpgradeWait });
+          // The older daemon's drain has its own bound; readiness of the
+          // successor gets a fresh budget instead of the one the drain spent.
+          deadline = Date.now() + timeoutMs;
           continue;
         }
         const err = new Error('daemon session protocol identity is invalid');
@@ -512,6 +556,7 @@ export async function shutdownDaemonForRuntimeRoot(root, options = {}) {
 export const createSession = createSessionProxyFactory({
   attachSession,
   ensureDaemon,
+  forceDaemonUpgrade,
   closeIdleConnections: () => {
     daemonCallAgent.destroy();
     daemonUrgentAgent.destroy();

package/src/standalone/session-protocol.mjs

@@ -25,6 +25,7 @@ export const SESSION_READ_ACTIONS = Object.freeze([
   'getProfile',
   'getProviderSetup',
   'getProviderAccounts',
+  'getQuotaAutoResume',
   'getQuotaHistory',
   'getRecapSettings',
   'getWebSearchRoute',
@@ -95,6 +96,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'deleteSchedule',
   'saveCustomProvider',
   'removeCustomProvider',
+  'updateCustomProviderModel',
   'testCustomProvider',
   'discoverCustomProviderModels',
   'deleteSession',
@@ -115,6 +117,11 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'reloadSkills',
   'rememberPromptHistory',
   'removeMcpServer',
+  'continueSessionInModel',
+  'scheduleQuotaResume',
+  'cancelQuotaResume',
+  'retryFailedTurn',
+  'setQuotaAutoResume',
   'removeNotice',
   'removePlugin',
   'renameSessionTitle',
@@ -157,6 +164,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'installLocalProviderModel',
   'startLocalProviderInstallation',
   'cancelLocalProviderInstallation',
+  'discardLocalProviderInstallation',
   'setLocalProviderIdleTtl',
   'setLocalProviderContext',
   'registerHuggingFaceModel',
@@ -184,6 +192,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'startMediaJob',
   'switchContext',
   'taskControl',
+  'testWebhook',
   'toggleFast',
   'toggleVoice',
   'claimSetupRequest',

package/src/standalone/session-service/agent-tree/agent-child.mjs

@@ -37,6 +37,8 @@ export function createAgentChildFactory({ registry, rehydrateAgentSessions, crea
       effort: preset.effort,
       fast: preset.fast === true,
       modelParameters: preset.modelParameters,
+      contextPercent: spec.contextPercent,
+      selectedContextWindow: spec.selectedContextWindow,
       toolMode: 'full',
       sessionProfile,
     });