mixdog 1.0.12 → 1.1.0

package/src/session-runtime/services/seeds.mjs

@@ -1,7 +1,17 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { pluginSkillsRoots } from '../../runtime/shared/plugin-manifest.mjs';
-import { readMarkdownDocument } from '../../runtime/shared/markdown-frontmatter.mjs';
+import {
+  EMPTY_HISTORY,
+  HISTORY_MARKER_FILE,
+  fileHash,
+  historyStamp,
+  holdsOnlyEditorFiles,
+  loadShippedHistory,
+  makeBackup,
+  packHashFromDir,
+  treeHashFromDir,
+} from '../../runtime/shared/shipped-definitions.mjs';
 
 export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   if (!rootDir) throw new Error('standalone rootDir is required');
@@ -17,8 +27,27 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   process.env.MIXDOG_PATCH_NATIVE_PREWARM ??= '0';
 
   mkdirSync(dataDir, { recursive: true });
-  retireSeededSkillCopies({ rootDir, dataDir });
-  retireSeededPackCopies({ rootDir, dataDir });
+  // Copies equal to the CURRENT shipped version are retired on every start; the
+  // (larger) historical comparison runs once per separation/history version.
+  const backup = makeBackup(dataDir);
+  const markerFile = join(dataDir, HISTORY_MARKER_FILE);
+  const stamp = historyStamp(rootDir);
+  let recorded = '';
+  try {
+    recorded = readFileSync(markerFile, 'utf8').trim();
+  } catch {
+    recorded = '';
+  }
+  const includeHistory = recorded !== stamp;
+  retireSeededSkillCopies({ rootDir, dataDir, backup, includeHistory });
+  retireSeededPackCopies({ rootDir, dataDir, backup, includeHistory });
+  if (includeHistory && !backup.failures) {
+    try {
+      writeFileSync(markerFile, `${stamp}\n`);
+    } catch {
+      /* marker only; the sweep simply repeats */
+    }
+  }
   cleanupRetiredChannelSecrets(dataDir);
 }
 
@@ -52,16 +81,21 @@ function cleanupRetiredChannelSecrets(dataDir) {
     });
 }
 
-// Built-in skills (src/defaults/skills/<name>/) used to be copied into the
-// user data skills dir once and never refreshed, so every install kept the
-// version it first saw. They are now read in place by the skill collector and
-// a user-global skill of the same name shadows them. A leftover seeded copy
-// would therefore pin the old text forever: remove it when it is still
-// byte-identical to some bundled skill (the user never touched it) and keep
-// it when it differs, because then it is the user's own override.
-export function retireSeededSkillCopies({ rootDir, dataDir }) {
+// Shipped definitions live in code (read in place from the package); the data
+// dir should hold only copies the user changed. Older releases copied, or the
+// editors saved, full copies that then pin the text of the day they were made.
+// A copy is "unchanged" when it equals the current shipped version or ANY past
+// shipped version (hashes in defaults/shipped-history.json, generated from git
+// by scripts/build-shipped-history.mjs, normalised for CRLF/trailing space).
+// Unchanged copies are moved — never deleted — into
+// <dataDir>/backups/defaults-separation-<timestamp>/, so the shipped version
+// applies again; anything else is the user's own and stays.
+
+// Built-in skills (<root>/defaults/skills/<name>/): compared as a whole tree.
+export function retireSeededSkillCopies({ rootDir, dataDir, backup = makeBackup(dataDir), includeHistory = true }) {
   const targetRoot = join(dataDir, 'skills');
   if (!existsSync(targetRoot)) return [];
+  const history = (includeHistory ? loadShippedHistory(rootDir) : EMPTY_HISTORY).skills;
   const retired = [];
   // The bundle is a plugin root; walk the same skill roots the collector reads.
   for (const bundledDir of pluginSkillsRoots(join(rootDir, 'defaults'))) {
@@ -75,79 +109,53 @@ export function retireSeededSkillCopies({ rootDir, dataDir }) {
       if (!entry.isDirectory()) continue;
       const copy = join(targetRoot, entry.name);
       if (!existsSync(copy)) continue;
-      if (!sameTree(join(bundledDir, entry.name), copy)) continue;
-      if (removeEntry(copy)) retired.push(entry.name);
+      const copyHash = treeHashFromDir(copy);
+      if (!copyHash) continue;
+      const known = [treeHashFromDir(join(bundledDir, entry.name)), ...(history[entry.name] || [])];
+      if (!known.includes(copyHash)) continue;
+      if (backup.move(copy)) retired.push(entry.name);
     }
   }
   return retired;
 }
 
-function sameTree(left, right) {
-  let leftEntries;
-  let rightEntries;
-  try {
-    leftEntries = readdirSync(left, { withFileTypes: true });
-    rightEntries = readdirSync(right, { withFileTypes: true });
-  } catch {
-    return false;
-  }
-  const names = (entries) => entries.map((entry) => entry.name).sort();
-  if (names(leftEntries).join('\0') !== names(rightEntries).join('\0')) return false;
-  for (const entry of leftEntries) {
-    const a = join(left, entry.name);
-    const b = join(right, entry.name);
-    if (entry.isDirectory()) {
-      if (!sameTree(a, b)) return false;
-      continue;
-    }
-    if (!sameFile(a, b)) return false;
-  }
-  return true;
-}
-
-// A seed copied from a CRLF checkout and a package shipped with LF are the
-// same text; only carriage returns are ignored, nothing else.
-function sameBytes(left, right) {
-  const strip = (buffer) => Buffer.from(buffer.toString('utf8').replace(/\r\n/g, '\n'), 'utf8');
-  return strip(left).equals(strip(right));
-}
-
 // Shipped workflows (<root>/workflows/<id>/WORKFLOW.md), agents
 // (<root>/agents/<id>/AGENT.md + agent.json) and output styles
-// (<root>/output-styles/<name>.md) are read in place, and a data-dir entry of
-// the same id shadows them. The editors save a full copy, so saving a built-in
-// pack without changing anything pins the text that shipped that day and no
-// later app update ever reaches that user. Such a copy holds nothing of the
-// user's: drop it so the current built-in applies again.
+// (<root>/output-styles/<name>.md).
 //
-// "Unchanged" is the editable surface — name, description, body — because the
-// editors cannot round-trip the rest (frontmatter flags, manifest id/entry),
-// so a byte compare would read every no-op save as an override. A copy holding
-// any other file (added references, a `.deleted` tombstone) is the user's own
-// and is never touched.
+// "Unchanged" for a pack means every loader-visible field matches: name,
+// description, body and all other frontmatter/manifest fields (permission,
+// hidden, model/tool fields, entry...). Only normalisation (CRLF, trailing
+// space, quoting, an id equal to the folder name, the default entry) is
+// ignored. A copy holding any file beyond the editor's own (added references,
+// a `.deleted` tombstone) is the user's and is never touched; stray backups
+// such as AGENT.md.bak do not count and travel to the backup with the copy.
 const PACK_KINDS = [
-  { dir: 'workflows', entry: 'WORKFLOW.md', files: ['WORKFLOW.md'] },
-  { dir: 'agents', entry: 'AGENT.md', files: ['AGENT.md', 'agent.json'] },
+  { dir: 'workflows', historyKey: 'workflows', entry: 'WORKFLOW.md', files: ['WORKFLOW.md'] },
+  { dir: 'agents', historyKey: 'agents', entry: 'AGENT.md', files: ['AGENT.md', 'agent.json'] },
 ];
 
-export function retireSeededPackCopies({ rootDir, dataDir }) {
+export function retireSeededPackCopies({ rootDir, dataDir, backup = makeBackup(dataDir), includeHistory = true }) {
+  const history = includeHistory ? loadShippedHistory(rootDir) : EMPTY_HISTORY;
   const retired = [];
   for (const kind of PACK_KINDS) {
     for (const name of childNames(join(dataDir, kind.dir), 'dir')) {
       const bundled = join(rootDir, kind.dir, name);
       const copy = join(dataDir, kind.dir, name);
-      if (!existsSync(join(bundled, kind.entry))) continue;
-      if (!holdsOnly(copy, kind.files)) continue;
-      if (!samePackDefinition(bundled, copy, kind.entry)) continue;
-      if (removeEntry(copy)) retired.push(`${kind.dir}/${name}`);
+      const current = packHashFromDir(bundled, kind.entry, name);
+      if (!current) continue;
+      if (!holdsOnlyEditorFiles(copy, kind.files, kind.entry)) continue;
+      const copyHash = packHashFromDir(copy, kind.entry, name);
+      if (![current, ...(history[kind.historyKey][name] || [])].includes(copyHash)) continue;
+      if (backup.move(copy)) retired.push(`${kind.dir}/${name}`);
     }
   }
   for (const name of childNames(join(dataDir, 'output-styles'), 'md')) {
-    const bundled = join(rootDir, 'output-styles', name);
+    const bundled = fileHash(join(rootDir, 'output-styles', name));
+    if (!bundled) continue;
     const copy = join(dataDir, 'output-styles', name);
-    if (!existsSync(bundled)) continue;
-    if (!sameFile(bundled, copy)) continue;
-    if (removeEntry(copy)) retired.push(`output-styles/${name}`);
+    if (![bundled, ...(history.outputStyles[name] || [])].includes(fileHash(copy))) continue;
+    if (backup.move(copy)) retired.push(`output-styles/${name}`);
   }
   return retired;
 }
@@ -163,80 +171,3 @@ function childNames(root, kind) {
     kind === 'dir' ? entry.isDirectory() : entry.isFile() && entry.name.toLowerCase().endsWith('.md');
   return entries.filter(wanted).map((entry) => entry.name);
 }
-
-// The copy may hold only the files an editor save writes; anything else in
-// there was put there by the user and outranks the shipped pack.
-function holdsOnly(dir, allowed) {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return false;
-  }
-  return entries.length > 0 && entries.every((entry) => entry.isFile() && allowed.includes(entry.name));
-}
-
-function samePackDefinition(bundledDir, copyDir, entry) {
-  const bundled = packDefinition(bundledDir, entry);
-  const copy = packDefinition(copyDir, entry);
-  if (!bundled || !copy) return false;
-  return bundled.name === copy.name && bundled.description === copy.description && bundled.body === copy.body;
-}
-
-// Same resolution the pack loaders use: agent.json wins over the markdown
-// frontmatter for name/description, and the body is the markdown minus it.
-function packDefinition(dir, entry) {
-  const manifest = readJsonFile(join(dir, 'agent.json'));
-  const raw = readTextFile(join(dir, oneLine(manifest.entry) || entry));
-  const doc = readMarkdownDocument(raw);
-  const body = String(doc.body || '')
-    .replace(/\r\n/g, '\n')
-    .trim();
-  if (!body) return null;
-  return {
-    name: oneLine(manifest.name || doc.frontmatter.name),
-    description: oneLine(manifest.description || doc.frontmatter.description),
-    body,
-  };
-}
-
-function readJsonFile(file) {
-  try {
-    const parsed = JSON.parse(readFileSync(file, 'utf8'));
-    return parsed && typeof parsed === 'object' ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-
-function readTextFile(file) {
-  try {
-    return readFileSync(file, 'utf8');
-  } catch {
-    return '';
-  }
-}
-
-function oneLine(value) {
-  return String(value || '')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
-
-function sameFile(left, right) {
-  try {
-    return sameBytes(readFileSync(left), readFileSync(right));
-  } catch {
-    return false;
-  }
-}
-
-function removeEntry(target) {
-  try {
-    rmSync(target, { recursive: true, force: true });
-    return true;
-  } catch {
-    // best-effort; a stuck copy simply keeps shadowing until removed by hand
-    return false;
-  }
-}

package/src/session-runtime/services/usage-dashboard-model.mjs

@@ -445,9 +445,38 @@ function usageTotal(rows) {
   return total;
 }
 
+// Credit feature of a subscription provider; null unless the account has it
+// enabled. Codex counts credits, Claude's extra usage is USD.
+export function creditsFromSnapshot(providerId, snapshot) {
+  const balance = snapshot?.balance;
+  if (providerId === 'openai-oauth') {
+    if (balance?.unit !== 'credits') return null;
+    const amount = num(balance.remainingCredits, null);
+    const unlimited = balance.unlimited === true;
+    if (!(balance.hasCredits === true || unlimited || (amount !== null && amount > 0))) return null;
+    return { unit: 'credits', balance: amount, ...(unlimited ? { unlimited: true } : {}) };
+  }
+  if (providerId === 'anthropic-oauth') {
+    const extra = (snapshot?.quotaWindows || []).find((w) => w?.label === 'EXTRA');
+    const spend = balance && num(balance.remainingUsd, null) !== null ? balance : null;
+    if (!extra && !spend) return null;
+    const remaining = num(spend?.remainingUsd ?? extra?.remainingUsd, null);
+    const monthlyLimit = num(spend?.budgetUsd ?? extra?.limitUsd, null);
+    const spent = num(spend?.spentUsd ?? extra?.usedUsd, null);
+    return {
+      unit: 'usd',
+      balance: remaining ?? (monthlyLimit !== null && spent !== null ? Math.max(0, monthlyLimit - spent) : null),
+      ...(monthlyLimit !== null ? { monthlyLimit } : {}),
+      ...(spent !== null ? { spent } : {}),
+    };
+  }
+  return null;
+}
+
 function snapshotRow(row) {
   return {
     ...row,
+    ...(row.credits ? { credits: { ...row.credits } } : {}),
     windows: row.windows.map((window) => ({ ...window })),
     ...(row.resetCredits
       ? {

package/src/session-runtime/services/usage-dashboard.mjs

@@ -12,7 +12,9 @@ import {
   readCachedApiUsageSnapshot,
 } from '../../runtime/agent/orchestrator/providers/api-usage.mjs';
 import { num } from '../../runtime/agent/orchestrator/providers/lib/usage-primitives.mjs';
+import { readProviderAccountPool } from '../../runtime/shared/provider-accounts.mjs';
 import {
+  creditsFromSnapshot,
   applyApiUnavailable,
   applyKnownRemaining,
   applyKnownUsage,
@@ -31,6 +33,8 @@ import {
   usageDashboardSnapshot,
 } from './usage-dashboard-model.mjs';
 
+const CREDIT_PROVIDERS = new Set(['openai-oauth', 'anthropic-oauth']);
+
 async function oauthSnapshot(providerId, { refresh, getProvider, log }) {
   const cached = readCachedOAuthUsageSnapshot({ provider: providerId, model: '' });
   if (!refresh && cached) return cached;
@@ -206,6 +210,7 @@ async function oauthProviderRow(item, { providers, preview, snapshotOptions, row
   row.primary = row.authenticated ? '' : 'not signed in';
   row.detail = row.authenticated ? 'Checking provider usage' : item.detail || 'OAuth credentials missing';
   row.tone = rowTone(row);
+  if (CREDIT_PROVIDERS.has(item.id)) row.useCredits = readProviderAccountPool(item.id).useCredits === true;
   rows.push(row);
   emit(true);
 
@@ -222,6 +227,8 @@ async function oauthProviderRow(item, { providers, preview, snapshotOptions, row
       const resetCredits = normaliseResetCredits(snapshot?.resetCredits);
       row.windows = windows;
       if (resetCredits) row.resetCredits = resetCredits;
+      const credits = creditsFromSnapshot(item.id, snapshot);
+      if (credits) row.credits = credits;
       row.updatedAt = num(snapshot?.cachedAt, null);
       if (known) {
         applyKnownRemaining(row, known, { estimated: false });

package/src/session-runtime/session-address.mjs

@@ -0,0 +1,125 @@
+// session-address.mjs — the durable address of an addressed runtime.
+//
+// A daemon-addressed runtime (reserved or loaded by the session service) owns
+// exactly ONE conversation id for its whole life. `reservedSessionId` is the
+// one-shot "materialize me" token and is cleared on first adoption; the
+// address outlives it. The address is bound at reservation and at
+// resume/load-on-demand, and thereafter:
+//   - "no live session object" never permits creating another conversation;
+//   - an OPEN durable record under the address is resumed (same id);
+//   - a CLOSED record makes the runtime terminal (never recreated/overwritten);
+//   - a missing/unreadable record is an explicit failure (never minted).
+// Admission (open → closing → terminal) is the canonical-close fence.
+import { SessionClosedError } from '../runtime/agent/orchestrator/session/manager/session-errors.mjs';
+
+export class SessionAddressError extends Error {
+  constructor(message, sessionId = null) {
+    super(message);
+    this.name = 'SessionAddressError';
+    this.sessionId = sessionId;
+  }
+}
+
+export function initSessionAddress(rt) {
+  rt.addressedSessionId = null;
+  rt.admission = 'open';
+  rt.lifecycleGeneration = 0;
+}
+
+/** Bind (or re-confirm) the durable address. A second, different id is a
+ *  re-key attempt and is refused. */
+export function bindSessionAddress(rt, id) {
+  const next = String(id || '').trim();
+  if (!next) throw new SessionAddressError('session address is required');
+  if (rt.addressedSessionId && rt.addressedSessionId !== next) {
+    throw new SessionAddressError(
+      `runtime is addressed as ${rt.addressedSessionId}; it cannot be re-keyed to ${next} (use a new session entry)`,
+      rt.addressedSessionId
+    );
+  }
+  rt.addressedSessionId = next;
+  return next;
+}
+
+export const isAddressedTo = (rt, id) => !!rt.addressedSessionId && rt.addressedSessionId === String(id || '');
+
+/** Refuse an explicit transition that would move an addressed runtime to
+ *  another conversation. */
+export function assertNotAddressed(rt, operation) {
+  if (rt.addressedSessionId) {
+    throw new SessionAddressError(
+      `${operation} would re-key addressed session ${rt.addressedSessionId}; create a new session entry instead`,
+      rt.addressedSessionId
+    );
+  }
+}
+
+export const isAdmissionOpen = (rt) => !rt.admission || rt.admission === 'open';
+
+export function assertAdmissionOpen(rt) {
+  if (isAdmissionOpen(rt)) return;
+  throw new SessionClosedError(rt.addressedSessionId || 'unknown', 'session is closed to new work', 'canonical-close');
+}
+
+/** Resume may only reopen the conversation this runtime is addressed as. */
+export function assertResumeTarget(rt, id) {
+  assertAdmissionOpen(rt);
+  if (rt.addressedSessionId && rt.addressedSessionId !== String(id || '')) {
+    throw new SessionAddressError(
+      `runtime is addressed as ${rt.addressedSessionId}; it cannot resume ${id} (use a new session entry)`,
+      rt.addressedSessionId
+    );
+  }
+}
+
+/** Fence admission before the manager close can cancel owned shells. */
+export function beginCanonicalClose(rt, sessionId) {
+  const previous = rt.admission || 'open';
+  if (!rt.addressedSessionId) rt.addressedSessionId = String(sessionId);
+  rt.admission = 'closing';
+  return previous;
+}
+
+/** Settle the fence: terminal after a durable close, restored otherwise. */
+export function finishCanonicalClose(rt, previous, closed) {
+  if (closed) markTerminal(rt);
+  else rt.admission = previous;
+}
+
+export function markTerminal(rt) {
+  if (rt.admission !== 'terminal') {
+    rt.admission = 'terminal';
+    rt.lifecycleGeneration = (rt.lifecycleGeneration || 0) + 1;
+  }
+}
+
+/** Lifecycle view used by the notification bus; null = not an owner here. */
+export function ownerLifecycle(rt, sessionId) {
+  if (!isAddressedTo(rt, sessionId)) return null;
+  return { state: rt.admission || 'open', generation: rt.lifecycleGeneration || 0 };
+}
+
+/** The durable record under the address: open | closed | missing. */
+export function addressedRecord(rt, mgr) {
+  let record = null;
+  try {
+    record = mgr.getSession(rt.addressedSessionId);
+  } catch {
+    record = null;
+  }
+  if (!record) return { state: 'missing', record: null };
+  if (record.closed === true || record.status === 'closed') return { state: 'closed', record };
+  return { state: 'open', record };
+}
+
+export function closedAddressError(rt) {
+  markTerminal(rt);
+  return new SessionClosedError(rt.addressedSessionId, 'durable record is closed', 'canonical-close');
+}
+
+export function missingAddressError(rt) {
+  return new SessionAddressError(
+    `session ${rt.addressedSessionId} record is missing or unreadable; refusing to create another conversation`,
+    rt.addressedSessionId
+  );
+}

package/src/session-runtime/session-create.mjs

@@ -8,11 +8,22 @@ import { runAbortable, throwIfAborted } from '../runtime/shared/abort-race.mjs';
 import { elapsedMs, prepareRoute } from './session-create/route-prep.mjs';
 import { materializeSession, prewarmWsTransport } from './session-create/materialize.mjs';
 import { dispatchSessionStart } from './session-create/session-start-hook.mjs';
+import { SessionClosedError } from '../runtime/agent/orchestrator/session/manager/session-errors.mjs';
+import {
+  SessionAddressError,
+  addressedRecord,
+  assertAdmissionOpen,
+  closedAddressError,
+  isAddressedTo,
+  missingAddressError,
+} from './session-address.mjs';
 
 export function createSessionCreator(deps, routes) {
   const { rt, mgr } = deps;
 
-  /** A still-open live session short-circuits creation. */
+  /** A still-open live session short-circuits creation. For an addressed
+   *  runtime a closed/missing record is terminal/explicit failure — never
+   *  "no session, so create one". */
   function liveSession() {
     if (!rt.session?.id) return null;
     const live = mgr.getSession(rt.session.id);
@@ -20,14 +31,56 @@ export function createSessionCreator(deps, routes) {
       rt.session = live;
       return live;
     }
+    if (isAddressedTo(rt, rt.session.id)) {
+      if (live) throw closedAddressError(rt);
+      throw missingAddressError(rt);
+    }
     rt.session = null;
     return null;
   }
 
+  /** Same-id recovery of an OPEN durable conversation (idle eviction, manager
+   *  unload, load-on-demand, crash restore) through the lifecycle resume. */
+  async function resumeAddressed(signal) {
+    if (typeof deps.resumeAddressedSession !== 'function') {
+      throw new SessionAddressError('addressed session resume is unavailable', rt.addressedSessionId);
+    }
+    const id = rt.addressedSessionId;
+    await runAbortable(signal, () => deps.resumeAddressedSession(id), 'Session creation aborted');
+    assertAdmissionOpen(rt);
+    if (rt.session?.id === id) return rt.session;
+    const { state } = addressedRecord(rt, mgr);
+    if (state === 'closed') throw closedAddressError(rt);
+    throw new SessionAddressError(`session ${id} could not be resumed; refusing to create another`, id);
+  }
+
+  /** Decide, from the durable record under the address, whether this runtime
+   *  may materialize (first time, reserved) or must resume. Synchronous so no
+   *  await sits between the decision and the adoption. */
+  function addressDecision() {
+    if (!rt.addressedSessionId) return 'create';
+    const { state } = addressedRecord(rt, mgr);
+    if (state === 'closed') throw closedAddressError(rt);
+    if (state === 'open') return 'resume';
+    if (rt.reservedSessionId === rt.addressedSessionId) return 'create';
+    throw missingAddressError(rt);
+  }
+
   async function buildSession(reason, signal, startedAt) {
     const { coreMemoryContext, providerImpl } = await prepareRoute(deps, routes, signal, startedAt);
+    // The fence/record may have changed during the awaits above (close during
+    // reservation prewarm): re-validate synchronously right before adoption.
+    assertAdmissionOpen(rt);
+    if (addressDecision() === 'resume') return await resumeAddressed(signal);
     materializeSession(deps, reason, coreMemoryContext);
     await dispatchSessionStart(deps, reason, signal);
+    assertAdmissionOpen(rt);
+    if (!rt.session)
+      throw new SessionClosedError(
+        rt.addressedSessionId || 'unknown',
+        'session closed during creation',
+        'canonical-close'
+      );
     prewarmWsTransport(rt, providerImpl);
     throwIfAborted(signal);
     bootProfile('session:create:ready', {
@@ -42,11 +95,13 @@ export function createSessionCreator(deps, routes) {
   return async function createCurrentSession(reason = 'demand', options = {}) {
     const signal = options?.signal || null;
     throwIfAborted(signal);
+    assertAdmissionOpen(rt);
     if (rt.sessionCreatePromise) {
       return await runAbortable(signal, () => rt.sessionCreatePromise, 'Session creation aborted');
     }
     const live = liveSession();
     if (live) return live;
+    const decision = addressDecision();
 
     const startedAt = performance.now();
     bootProfile('session:create:start', { mode: rt.mode, reason });
@@ -58,7 +113,7 @@ export function createSessionCreator(deps, routes) {
         bootProfile('agent-loop:prewarm-failed', { error: error?.message || String(error) });
       });
     }
-    const promise = buildSession(reason, signal, startedAt);
+    const promise = decision === 'resume' ? resumeAddressed(signal) : buildSession(reason, signal, startedAt);
     rt.sessionCreatePromise = promise;
     try {
       return await promise;

package/src/session-runtime/settings-builtin-tools-api.mjs

@@ -9,7 +9,9 @@ import {
 } from '../runtime/agent/orchestrator/runtime-core/builtin-features.mjs';
 import { LOCAL_PROVIDER_ID } from '../runtime/local-provider/managed-runtime.mjs';
 import { getEmbeddingInfo } from '../runtime/memory/lib/embedding-provider.mjs';
+import { onnxRuntimeSupported } from '../runtime/shared/onnx-runtime-support.mjs';
 import {
+  EFFORT_JUDGE_UNSUPPORTED,
   effortJudgeAvailable,
   effortJudgeInfo,
   effortJudgeInstalling,
@@ -82,6 +84,7 @@ export function createBuiltinToolSettings(
           enabled: memoryToolsEnabledFn(),
           installed: builtinInstalled(config, 'memory'),
           info: getEmbeddingInfo(),
+          semanticSearchSupported: onnxRuntimeSupported(),
         },
         git: { enabled: gitToolsEnabledFn(), installed: builtinInstalled(config, 'git') },
         office: { enabled: officeToolsEnabledFn(), installed: builtinInstalled(config, 'office') },
@@ -96,6 +99,7 @@ export function createBuiltinToolSettings(
           installed: builtinInstalled(config, 'localProvider') && localProviderRuntimeInstalled,
         },
         autoEffort: {
+          supported: onnxRuntimeSupported(),
           enabled: builtinFeatureActive(config, 'autoEffort'),
           // On by default: "installed" means the judge model is on disk;
           // "installing" covers the boot download the settings did not start.
@@ -135,6 +139,9 @@ export function createBuiltinToolSettings(
       if (!TOGGLEABLE_BUILTINS.includes(name)) {
         throw new TypeError('Built-in tool must be git, office, tidy, localProvider, or autoEffort.');
       }
+      if (name === 'autoEffort' && enabled !== false && !onnxRuntimeSupported()) {
+        throw new Error(EFFORT_JUDGE_UNSUPPORTED);
+      }
       if (name === 'localProvider' && enabled !== false && getLocalProviderStatus?.()?.runtime?.installed !== true) {
         await prepareBuiltinFeature?.(name);
       }
@@ -165,6 +172,7 @@ export function createBuiltinToolSettings(
       if (!INSTALLABLE_BUILTIN_IDS.includes(name)) {
         throw new TypeError('Built-in feature must be git, memory, office, tidy, localProvider, or autoEffort.');
       }
+      if (name === 'autoEffort' && !onnxRuntimeSupported()) throw new Error(EFFORT_JUDGE_UNSUPPORTED);
       await prepareBuiltinFeature?.(name);
       const config = getConfig();
       let nextConfig = setBuiltinInstalledInConfig({ ...config }, name, true);

package/src/session-runtime/settings-compaction-api.mjs

@@ -1,4 +1,8 @@
 // Context lifecycle settings: compaction budgets and the idle auto-clear.
+import {
+  refreshLiveSessionsProviderCacheOpts,
+  refreshSessionProviderCacheOpts,
+} from '../runtime/agent/orchestrator/session/manager/session-lifecycle.mjs';
 
 // Every spelling of the main-context buffer budget; a new representation
 // replaces the previous one.
@@ -46,6 +50,13 @@ export function createCompactionSettings({
   formatDurationMs,
   invalidateContextStatusCache,
 }) {
+  // The Lead messages-tail TTL derives from the auto-clear idle window.
+  const refreshLeadCacheOpts = () => {
+    const config = getConfig();
+    refreshSessionProviderCacheOpts(getSession(), config);
+    refreshLiveSessionsProviderCacheOpts(config);
+  };
+
   /** Apply a per-provider idle override (or its reset) and return the resolved view. */
   const saveProviderIdle = (config, next, providerKey, input) => {
     const providerIdleMs = { ...(next.providerIdleMs || {}) };
@@ -57,6 +68,7 @@ export function createCompactionSettings({
       providerIdleMs[providerKey] = Math.max(60_000, Math.round(idleMs));
     }
     saveConfigAndAdopt({ ...config, autoClear: { ...next, providerIdleMs } });
+    refreshLeadCacheOpts();
   };
 
   return {
@@ -157,6 +169,7 @@ export function createCompactionSettings({
           if (!hasOwn(input, 'enabled')) next.enabled = true;
         }
         saveConfigAndAdopt({ ...config, autoClear: next });
+        refreshLeadCacheOpts();
       }
       const resolved = this.getAutoClear();
       return { ...resolved, label: formatDurationMs(resolved.idleMs) };