mixdog 1.0.12 → 1.1.0

package/src/tui/session/session-api/integrations.mjs

@@ -47,7 +47,8 @@ export function createSessionIntegrationsApi(bag, { oauthFlows }) {
       // though the session runtime implements it.
       return await requireRuntimeMethod('consumeCodexRateLimitResetCredit', 'Codex reset is unavailable')(options);
     },
-    getTurnReviewDiff: (options = {}) => turnReviewReply((reviewOptions) => runtime.getTurnReviewDiff?.(reviewOptions), options),
+    getTurnReviewDiff: (options = {}) =>
+      turnReviewReply((reviewOptions) => runtime.getTurnReviewDiff?.(reviewOptions), options),
     getSessionReviewDiff: async () => {
       return (await runtime.getSessionReviewDiff?.()) ?? { supported: false, files: [], patch: '' };
     },
@@ -106,6 +107,7 @@ export function createSessionIntegrationsApi(bag, { oauthFlows }) {
       (input) => runtime.saveCustomProvider(input),
       (result) => `custom provider saved: ${result.id}`
     ),
+    updateCustomProviderModel: (id, modelId, patch) => runtime.updateCustomProviderModel(id, modelId, patch),
     removeCustomProvider: async (id) => {
       const result = await runtime.removeCustomProvider(id);
       refreshRouteStats();
@@ -173,5 +175,7 @@ export function createSessionIntegrationsApi(bag, { oauthFlows }) {
       (name, enabled) => runtime.setWebhookEnabled(name, enabled),
       (_result, name, enabled) => `webhook ${enabled ? 'enabled' : 'disabled'}: ${name}`
     ),
+    // Signed test request only; nothing changes, so no announcement.
+    testWebhook: (name) => runtime.testWebhook(name),
   };
 }

package/src/tui/session/session-api/lifecycle/dispose.mjs

@@ -31,6 +31,7 @@ export function createDisposeAction(bag, { oauthFlows }) {
       clearToastTimers();
       disposeTranscriptSpill?.();
       disposeGoalContinuation?.();
+      bag.disposeQuotaResume?.();
       try {
         clearInterval(lifecycle.runtimePulseTimer);
       } catch {}

package/src/tui/session/session-api/lifecycle/inheritance.mjs

@@ -12,8 +12,8 @@ export function createInheritanceActions(bag, { restoreTranscriptItems }) {
    * daemon resolves actions on THIS surface, so `inheritFrom` has to live here
    * and not only on the runtime beneath it.
    */
-  const inheritFrom = async (sourceSessionId) => {
-    const result = await runtime.inheritFrom(sourceSessionId);
+  const inheritFrom = async (sourceSessionId, options = null) => {
+    const result = await runtime.inheritFrom(sourceSessionId, options);
     const sessionId = String(result?.sessionId || runtime.sessionId || getState().sessionId || '');
     // Only model messages travel with the conversation. Rebuild the visible
     // transcript from them right here so the heir opens showing the carried

package/src/tui/session/session-api/lifecycle/session-reset.mjs

@@ -80,6 +80,9 @@ export function createSessionResetActions(bag) {
   return {
     clear: () =>
       withResetLock(async () => {
+        const clearedId = getState().sessionId;
+        // A cleared session has no failed turn left to resume.
+        bag.supersedeQuotaResume?.(clearedId);
         const rollbackSnapshot = beginTuiReset();
         set(blankSessionPatch());
         try {
@@ -101,6 +104,7 @@ export function createSessionResetActions(bag) {
             if (rollbackSnapshot) restoreTuiAfterFailedSessionReset(rollbackSnapshot);
             return false;
           }
+          bag.supersedeQuotaResume?.(id);
           if (deletingCurrent) commitEmptySession(rollbackSnapshot, { sessionId: null, cwd: runtime.cwd });
           return true;
         } catch (error) {

package/src/tui/session/session-api/lifecycle.mjs

@@ -12,10 +12,51 @@ import { createDisposeAction } from './lifecycle/dispose.mjs';
 export function createSessionLifecycleApi(bag, { restoreTranscriptItems, oauthFlows }) {
   const { runtime, pushNotice, removeNotice, setProgressHint, finishToolApproval } = bag;
 
+  // Canonical close = execution fence at the local-session boundary. The fence
+  // is raised synchronously BEFORE the runtime/manager close (which cancels the
+  // session's shells and so triggers completion notifications), so no queue
+  // drain, completion wake, pending-resume kick or new submission can start
+  // work for a conversation that is being closed. A durable close that fails
+  // restores admission with every accepted input intact; one that succeeds
+  // leaves the session terminal and settles queued submissions explicitly.
+  function closeCanonical(reason) {
+    const flags = bag.flags || {};
+    const previous = flags.admission || 'open';
+    if (previous === 'terminal') return runtime.closeCanonicalSession?.(reason) === true;
+    flags.admission = 'closing';
+    let closed = false;
+    try {
+      closed = runtime.closeCanonicalSession?.(reason) === true;
+    } catch (error) {
+      flags.admission = previous;
+      restoreAdmission();
+      throw error;
+    }
+    if (!closed) {
+      flags.admission = previous;
+      restoreAdmission();
+      return false;
+    }
+    flags.admission = 'terminal';
+    flags.admissionGeneration = (Number(flags.admissionGeneration) || 0) + 1;
+    bag.settleClosedQueue?.();
+    return true;
+  }
+
+  function restoreAdmission() {
+    void bag.drain?.();
+    bag.flushDeferredExecutionPendingResumeKick?.();
+  }
+
   return {
     resolveToolApproval: (id, decision = {}) => {
       const approved = decision === true || decision?.approved === true;
-      return finishToolApproval(id, approved, decision?.reason || (approved ? 'approved by user' : 'denied by user'));
+      return finishToolApproval(
+        id,
+        approved,
+        decision?.reason || (approved ? 'approved by user' : 'denied by user'),
+        typeof decision?.device === 'string' ? decision.device : ''
+      );
     },
     pushNotice,
     removeNotice,
@@ -27,6 +68,32 @@ export function createSessionLifecycleApi(bag, { restoreTranscriptItems, oauthFl
     renameSessionTitle: (id, title) => {
       return runtime.renameSessionTitle?.(id, title) ?? false;
     },
+    // Quota escape hatch: re-route THIS session onto another model, in place,
+    // only after its latest settled turn failed on exhausted provider quota.
+    // Starts no turn — the caller resubmits through retryFailedTurn.
+    continueSessionInModel: async (sessionId, route) => {
+      const state = bag.getState();
+      if (state.busy || state.commandBusy) throw new Error('session is busy');
+      if (!sessionId || state.sessionId !== sessionId) throw new Error('session is not the active session');
+      const items = Array.isArray(state.items) ? state.items : [];
+      const last = items.findLast((item) => item?.kind === 'user' || item?.kind === 'turndone');
+      if (last?.kind !== 'turndone' || last.status !== 'failed' || !last.quota) {
+        throw new Error('latest turn did not fail on exhausted provider quota');
+      }
+      if (typeof runtime.continueSessionInModel !== 'function') throw new Error('runtime cannot continue in a model');
+      // Continuing elsewhere supersedes waiting for this provider's reset.
+      bag.supersedeQuotaResume?.(sessionId);
+      bag.set({ commandBusy: true });
+      try {
+        await runtime.continueSessionInModel(sessionId, route);
+        bag.set({ ...bag.routeState(), stats: { ...bag.getState().stats } });
+        bag.syncContextStats?.({ allowEstimated: true });
+        return true;
+      } finally {
+        bag.set({ commandBusy: false });
+        bag.flushEmitImmediate?.();
+      }
+    },
     // Desktop sidebar watcher hook: the daemon watches this directory so
     // heartbeat sidecar create/delete pushes instant working/dot updates.
     // Without it the watcher silently no-ops and the sidebar falls back to
@@ -44,7 +111,9 @@ export function createSessionLifecycleApi(bag, { restoreTranscriptItems, oauthFl
     deliverToolCompletion: (sessionId, text, meta = {}) =>
       runtime.deliverToolCompletion?.(sessionId, text, meta) === true,
 
-    closeCanonicalSession: (reason = 'canonical-session-close') => runtime.closeCanonicalSession?.(reason) === true,
+    closeCanonicalSession: (reason = 'canonical-session-close') => closeCanonical(reason),
+
+    bindSessionAddress: (sessionId) => runtime.bindSessionAddress?.(sessionId) === true,
 
     ...createDisposeAction(bag, { oauthFlows }),
   };

package/src/tui/session/session-api/media.mjs

@@ -4,7 +4,7 @@
  * claims, the TUI theme, and the media studio passthroughs.
  */
 import { listThemes, getThemeSetting, setThemeSetting } from '../../theme.mjs';
-import { getVoiceStatus, toggleVoice } from '../../lib/voice-setup.mjs';
+import { getVoiceStatus, toggleVoice } from '../../../runtime/channels/lib/voice-setup.mjs';
 
 const AUDIO_EXTENSIONS = [
   [/ogg/i, 'ogg'],
@@ -98,7 +98,7 @@ export function createSessionMediaApi(bag) {
       const result = await toggleVoice({
         pushNotice,
         setProgressHint,
-        enabled: typeof enabled === 'boolean' ? enabled : undefined,
+        enabled,
       });
       return {
         ...(await getVoiceStatus()),

package/src/tui/session/session-api/quota-resume.mjs

@@ -0,0 +1,21 @@
+/**
+ * quota-resume.mjs — the session object's quota auto-resume surface: the
+ * session-addressed controls (schedule/cancel the resume, retry a failed
+ * turn), the daemon scheduler's fire entry, and the global auto-resume
+ * setting. The lane behind them is ../quota-resume.mjs.
+ */
+import { quotaAutoResumeEnabled, setQuotaAutoResumeEnabled } from '../../../runtime/shared/quota-resume-store.mjs';
+
+export function createQuotaResumeApi(bag) {
+  return {
+    scheduleQuotaResume: (sessionId) => bag.scheduleQuotaResume(sessionId),
+    cancelQuotaResume: (sessionId) => bag.cancelQuotaResume(sessionId),
+    retryFailedTurn: (sessionId, turnKey) => bag.retryFailedTurn(sessionId, turnKey),
+    fireQuotaResume: (options) => bag.fireQuotaResume(options),
+    getQuotaAutoResume: () => quotaAutoResumeEnabled(),
+    setQuotaAutoResume: (enabled) => {
+      if (typeof enabled !== 'boolean') throw new TypeError('quota auto resume must be boolean');
+      return setQuotaAutoResumeEnabled(enabled);
+    },
+  };
+}

package/src/tui/session/session-api/routes.mjs

@@ -61,6 +61,8 @@ export function createSessionRouteApi(bag) {
 
   const setRoute = async (opts) => {
     if (getState().commandBusy && !routeWrite) return false;
+    // Any route change supersedes waiting for the old route's quota reset.
+    bag.supersedeQuotaResume?.(getState().sessionId);
     const token = ++routeSequence;
     const previousWrite = routeWrite;
     const routeOpts = opts && typeof opts === 'object' ? opts : {};

package/src/tui/session/session-api/settings.mjs

@@ -35,6 +35,7 @@ export function createSessionSettingsApi(bag) {
     // acknowledge an older route.
     setModel: withCommandLock(
       async (m) => {
+        bag.supersedeQuotaResume?.(getState().sessionId);
         await runtime.setRoute({ model: m });
         publishRoute();
         return true;

package/src/tui/session/session-api.mjs

@@ -11,6 +11,7 @@ import { createSessionSettingsApi } from './session-api/settings.mjs';
 import { createSessionControlsApi } from './session-api/controls.mjs';
 import { createSessionExtensionsApi } from './session-api/extensions.mjs';
 import { createSessionCommandsApi } from './session-api/commands.mjs';
+import { createQuotaResumeApi } from './session-api/quota-resume.mjs';
 
 export function createSessionApi(bag) {
   const api = { ...createSessionApiA(bag), ...createSessionApiB(bag) };
@@ -57,5 +58,6 @@ export function createSessionApiA(bag) {
     ...createSessionControlsApi(bag),
     ...createSessionExtensionsApi(bag),
     ...createSessionCommandsApi(bag),
+    ...createQuotaResumeApi(bag),
   };
 }

package/src/tui/session/session-flow/auto-clear.mjs

@@ -76,16 +76,20 @@ export function createAutoClearOps(bag, { reset, kickDrain }) {
   // Never forces busy=false mid-turn: bails while a turn is in flight.
   function flushDeferredClearedSessionUi() {
     if (!flags.pendingClearedSessionUi || getState().busy) return;
-    const { result } = flags.pendingClearedSessionUi;
+    const { result, sessionId } = flags.pendingClearedSessionUi;
     flags.pendingClearedSessionUi = null;
     flags.autoClearInFlight = false;
+    if (runtime.session?.id !== sessionId) return;
     if (applyAutoClearUi(result)) pushNotice(LATE_COMPLETION_NOTICE, 'info');
   }
 
-  function onLateCompact(lateResult) {
+  function onLateCompact(lateResult, sessionId) {
+    // The active session changed while the abandoned compaction ran: its
+    // result belongs to a session that is no longer shown.
+    if (runtime.session?.id !== sessionId) return;
     if (getState().busy) {
       // Do not wipe items/queued or force busy=false mid-turn.
-      flags.pendingClearedSessionUi = { result: lateResult };
+      flags.pendingClearedSessionUi = { result: lateResult, sessionId };
     } else {
       if (applyAutoClearUi(lateResult)) pushNotice(LATE_COMPLETION_NOTICE, 'info');
     }
@@ -94,7 +98,7 @@ export function createAutoClearOps(bag, { reset, kickDrain }) {
   // Validate both rejected calls and error results before either normal or
   // late completion can reset the UI. Never follow compact with clear:
   // that would discard conversation/execution records the compactor kept.
-  async function compactWithinTimeout(compactTimeoutMs) {
+  async function compactWithinTimeout(compactTimeoutMs, sessionId) {
     const compactPromise = runtime.compact({ requireReduction: true }).then((result) => {
       if (!result) throw new Error('no active session');
       if (result.error) throw new Error(result.error);
@@ -112,7 +116,10 @@ export function createAutoClearOps(bag, { reset, kickDrain }) {
     } catch (raceError) {
       flags.autoClearInFlight = true;
       compactPromise
-        .then(onLateCompact, () => {})
+        .then(
+          (lateResult) => onLateCompact(lateResult, sessionId),
+          () => {}
+        )
         .finally(() => {
           if (!flags.pendingClearedSessionUi) flags.autoClearInFlight = false;
         });
@@ -146,6 +153,7 @@ export function createAutoClearOps(bag, { reset, kickDrain }) {
   // results without a summary. Plain /clear remains a separate explicit wipe.
   async function performAutoClear({ compactTimeoutMs = AUTO_CLEAR_COMPACT_TIMEOUT_MS } = {}) {
     flags.autoClearRunning = true;
+    const sessionId = runtime.session?.id;
     const startedAt = Date.now();
     // commandBusy blocks concurrent session commands (resume/newSession/
     // setModel) AND new submits for the duration of the async clear — the
@@ -161,7 +169,7 @@ export function createAutoClearOps(bag, { reset, kickDrain }) {
       // Without this, long idle clears can look like a frozen prompt followed by
       // an already-complete status row.
       await new Promise((resolve) => setTimeout(resolve, 0));
-      return applyAutoClearUi(await compactWithinTimeout(compactTimeoutMs));
+      return applyAutoClearUi(await compactWithinTimeout(compactTimeoutMs, sessionId));
     } catch (error) {
       const message = presentErrorText(error, { surface: 'compact' });
       pushItem({

package/src/tui/session/session-flow/drain.mjs

@@ -12,7 +12,7 @@ import {
   mergePastedImages,
   mergePastedTexts,
 } from '../queue-helpers.mjs';
-import { appendTuiSteeringPersist } from '../tui-steering-persist.mjs';
+import { appendTuiSteeringPersist, dropTuiSteeringPersist } from '../tui-steering-persist.mjs';
 import { parseModelVisibleCompletionWrapper } from '../agent-envelope.mjs';
 import { rewoundFailedTurnItems } from './failed-turn-rewind.mjs';
 
@@ -55,9 +55,11 @@ function renderBatchItems(batch, pushUserOrSyntheticItem) {
     const sender = String(entry.transcriptMeta?.sender || '')
       .trim()
       .toLowerCase();
-    let itemExtras = sender ? { sender } : null;
+    const device = typeof entry.transcriptMeta?.device === 'string' ? entry.transcriptMeta.device : '';
+    const attribution = { ...(sender ? { sender } : {}), ...(device ? { device } : {}) };
+    let itemExtras = sender || device ? attribution : null;
     if (Array.isArray(entry.images) && entry.images.length) {
-      itemExtras = { images: entry.images, ...(sender ? { sender } : {}) };
+      itemExtras = { images: entry.images, ...attribution };
     }
     pushUserOrSyntheticItem(entry.text, entry.id, isQueuedEntryEditable(entry) ? 'user' : 'injected', itemExtras);
   }
@@ -160,7 +162,41 @@ export function createDrainLoop(bag, { queue, steering, submissions, flushDeferr
     return pending.some((entry) => !isSlashQueuedEntry(entry));
   }
 
+  const admission = () => flags.admission || 'open';
+
+  // Canonical close settled: nothing queued can ever run. Every accepted
+  // submission is settled explicitly (rejected), never silently dropped, and
+  // its durable steering mirror is released so a restart cannot resurrect it
+  // into the closed conversation.
+  function settleClosedQueue() {
+    const entries = pending.splice(0);
+    pendingNotificationKeys.clear();
+    clearBlockedDrainRetry();
+    if (entries.length === 0) return;
+    queue.removeQueuedEntries(entries);
+    const mirrored = entries.filter(
+      (entry) => steering.shouldMirrorSteeringEntry(entry) && !entry.steeringPersistRestored
+    );
+    if (mirrored.length > 0) {
+      void Promise.resolve(dropTuiSteeringPersist(steering.leadSessionId(), mirrored)).catch(() => {});
+    }
+    for (const entry of entries) {
+      if (entry.id) submissions.forget(entry.id);
+      try {
+        entry.onSettled?.({ status: 'rejected', reason: 'session-closed', result: null, session: null });
+      } catch {}
+    }
+  }
+
   async function drain() {
+    // Execution admission fence: a closing session starts nothing (the close
+    // path re-kicks the queue if the durable close fails); a closed one
+    // settles what was queued.
+    if (admission() === 'closing') return;
+    if (admission() === 'terminal') {
+      settleClosedQueue();
+      return;
+    }
     if (flags.draining) return;
     // Bail while any session command holds commandBusy (auto-clear implies it,
     // but so do setModel/newSession/resume/etc). Running a turn concurrently
@@ -196,6 +232,7 @@ export function createDrainLoop(bag, { queue, steering, submissions, flushDeferr
     try {
       while (pending.length > 0) {
         if (flags.drainEpoch !== drainEpoch) return;
+        if (admission() !== 'open') return;
         // Drain one priority/mode bucket at a time (unified command queue):
         // prompt steering stays editable and task notifications stay
         // non-editable but model-visible.
@@ -230,13 +267,23 @@ export function createDrainLoop(bag, { queue, steering, submissions, flushDeferr
       if (flags.drainEpoch === drainEpoch) {
         flags.draining = false;
         flushDeferredClearedSessionUi();
-        if (hasModelDrainablePending()) void drain();
+        if (admission() === 'terminal') settleClosedQueue();
+        else if (hasModelDrainablePending()) void drain();
         else flushDeferredExecutionPendingResumeKick();
       }
     }
   }
 
   function enqueue(text, options = {}) {
+    // Admission fence. While closing, only user prompts are accepted (retained
+    // so a failed close loses nothing); notification-driven/model-visible
+    // enqueues are refused. A closed session accepts nothing.
+    const state = admission();
+    const mode = options.mode || 'prompt';
+    if (state !== 'open' && (state === 'terminal' || mode !== 'prompt')) {
+      tuiDebug(`enqueue refused: session admission=${state} mode=${mode}`);
+      return false;
+    }
     const submissionId = String(options.id || '').trim();
     // Idempotent intake: a transport that re-sent this exact submission (its
     // first attempt landed but the response was lost) must not double-post.
@@ -282,5 +329,5 @@ export function createDrainLoop(bag, { queue, steering, submissions, flushDeferr
     return true;
   }
 
-  return { drain, enqueue };
+  return { drain, enqueue, settleClosedQueue };
 }

package/src/tui/session/session-flow/queue/take-entries.mjs

@@ -79,10 +79,9 @@ export function createTakeEntriesOps({ pending, pendingNotificationKeys, removeQ
       .filter((text) => String(text || '').trim())
       .join('\n');
     const combinedText = [queuedText, String(currentText || '')].filter((text) => text.trim()).join('\n');
+    const verb = unreadable === 1 ? ' was' : 's were';
     return {
-      ...(unreadable
-        ? { notice: `${unreadable} attachment${unreadable === 1 ? ' was' : 's were'} no longer available and dropped.` }
-        : {}),
+      ...(unreadable ? { notice: `${unreadable} attachment${verb} no longer available and dropped.` } : {}),
       count: queued.length,
       ids: queued.map((item) => String(item.id || '')).filter(Boolean),
       text: combinedText,

package/src/tui/session/session-flow/queue.mjs

@@ -70,6 +70,9 @@ export function createQueueOps(bag, { kickDrain }) {
     pending.unshift(...restored);
     const visible = restored.filter(isQueuedEntryVisible);
     if (visible.length > 0) set({ queued: [...visible, ...getState().queued] });
+    // Requeued from a turn that settled after the canonical close: settle
+    // explicitly instead of parking work no drain will ever run.
+    if (bag.flags?.admission === 'terminal') bag.settleClosedQueue?.();
     return true;
   }
 

package/src/tui/session/session-flow/steering.mjs

@@ -116,7 +116,12 @@ export function createSteeringOps(bag, { queue, submissions }) {
     return !isGoalQueuedEntry(entry) || bag.shouldRunGoalContinuation?.(entry) === true;
   }
 
+  // Pre-send steering is an admission route: a closing/closed session injects
+  // nothing into a model request.
+  const admissionOpen = () => !bag.flags?.admission || bag.flags.admission === 'open';
+
   function hasPendingSteering() {
+    if (!admissionOpen()) return false;
     return pending.some(
       (entry) =>
         isSteerableEntry(entry) &&
@@ -134,6 +139,7 @@ export function createSteeringOps(bag, { queue, submissions }) {
     else if (_sessionIdOrOptions && typeof _sessionIdOrOptions === 'object') options = _sessionIdOrOptions;
     const maxPriority = options.maxPriority || 'next';
     const out = [];
+    if (!admissionOpen()) return out;
     for (;;) {
       const batch = queue.dequeueQueueBatch(maxPriority, { predicate: isSteerableEntry });
       if (batch.length === 0) break;
@@ -156,6 +162,8 @@ export function createSteeringOps(bag, { queue, submissions }) {
   }
 
   async function restoreLeadSteeringFromDisk() {
+    // A closed/closing conversation never gets queue work restored into it.
+    if (!admissionOpen()) return;
     const rows = await drainTuiSteeringPersist(leadSessionId());
     if (!rows.length) return;
     const livePersistIds = new Set(pending.map((entry) => entry?.steeringPersistId).filter(Boolean));
@@ -190,6 +198,9 @@ export function createSteeringOps(bag, { queue, submissions }) {
       if (isQueuedEntryVisible(entry)) restored.push(entry);
     }
     if (restored.length > 0) set({ queued: [...getState().queued, ...restored] });
+    // The conversation closed while the rows were being read: settle them
+    // explicitly (rejected + durable mirror released), never leave them parked.
+    if (bag.flags?.admission === 'terminal') bag.settleClosedQueue?.();
     if (droppedDelivered > 0) {
       try {
         process.stderr.write(`[tui] skipped ${droppedDelivered} already-delivered steering row(s) on restore\n`);

package/src/tui/session/session-flow.mjs

@@ -36,6 +36,7 @@ export function createSessionFlow(bag) {
     dequeueQueueBatch: queue.dequeueQueueBatch,
     drain: loop.drain,
     enqueue: loop.enqueue,
+    settleClosedQueue: loop.settleClosedQueue,
     hasPendingSteering: steering.hasPendingSteering,
     drainPendingSteering: steering.drainPendingSteering,
     restoreLeadSteeringFromDisk: steering.restoreLeadSteeringFromDisk,

package/src/tui/session/tool-approval.mjs

@@ -56,12 +56,17 @@ export function createToolApproval({ getState, set, nextId, getDisposed, timeout
     armToolApprovalTimeout(entry);
     set({ toolApproval: entry.request });
   }
-  function finishToolApproval(id, approved, reason = '') {
+  function finishToolApproval(id, approved, reason = '', device = '') {
     const targetId = String(id || '');
     if (activeToolApproval && activeToolApproval.id === targetId) {
       const entry = activeToolApproval;
       activeToolApproval = null;
-      set({ toolApproval: null });
+      // Only an answer from a known device is attributed; a timeout or an
+      // interrupt names nobody.
+      const toolApprovalResult = device
+        ? { id: targetId, approved: approved === true, device: String(device), at: Date.now() }
+        : null;
+      set({ toolApproval: null, toolApprovalResult });
       settleToolApproval(entry, approved === true, String(reason || ''));
       presentNextToolApproval();
       return true;

package/src/tui/session/transcript-intake.mjs

@@ -109,6 +109,7 @@ export function createTranscriptIntake({ getState, flags, pushItem, patchItem, t
       text,
       ...transcriptMeta,
       ...(extra && typeof extra.sender === 'string' && extra.sender ? { sender: extra.sender } : {}),
+      ...(extra && typeof extra.device === 'string' && extra.device ? { device: extra.device } : {}),
       // Byte-free attachment metadata (name/mime/size) from the queue entry —
       // lets the desktop transcript render image chips without ever carrying
       // base64 payloads through snapshots.

package/src/tui/session/turn.mjs

@@ -152,6 +152,8 @@ function promptRestoreFor(displayText, options, submittedIds, content = null) {
     onCommitted: typeof options.onCommitted === 'function' ? options.onCommitted : null,
     restorable: options.restorable !== false,
     submittedIds,
+    // Which device submitted the prompt: only that device may get it back.
+    device: typeof options.transcriptMeta?.device === 'string' ? options.transcriptMeta.device : '',
     reclaimed: false,
     committed: false,
     requeueEntries: Array.isArray(options.requeueOnAbort) ? options.requeueOnAbort.slice() : [],
@@ -190,6 +192,9 @@ function steeringItemExtras(steeringMeta) {
     ...(typeof steeringMeta?.transcriptMeta?.sender === 'string' && steeringMeta.transcriptMeta.sender
       ? { sender: steeringMeta.transcriptMeta.sender }
       : {}),
+    ...(typeof steeringMeta?.transcriptMeta?.device === 'string' && steeringMeta.transcriptMeta.device
+      ? { device: steeringMeta.transcriptMeta.device }
+      : {}),
   };
 }
 
@@ -389,7 +394,7 @@ function completeTurn(ctx, result, session) {
   turn.finishedNormally = true;
 }
 
-function failTurn(ctx, error) {
+export function failTurn(ctx, error) {
   const { turn, stream, cards, pushNotice } = ctx;
   flushStreamBatch(stream); // ensure any batched text lands before the error notice
   if (isCancelLikeError(error)) {
@@ -401,12 +406,20 @@ function failTurn(ctx, error) {
   turn.failed = true;
   cards.aggregates.finalizeToolHeaders();
   turn.usageLimited = isUsageLimitError(error);
+  const exhausted = error?.quotaExhausted;
+  if (exhausted && typeof exhausted === 'object') {
+    turn.quota = {
+      provider: String(exhausted.provider || turn.routeMeta?.provider || ''),
+      model: String(exhausted.model || turn.routeMeta?.model || ''),
+      resetAt: Number.isFinite(exhausted.resetAt) ? exhausted.resetAt : null,
+    };
+  }
   turn.failureDetail = toolErrorDisplay(error, 'turn').replace(/^Error:\s*/i, '');
   turn.failureDiagnostic = safeErrorDetails(errText(error));
   pushNotice(turn.failureDetail, 'error', { owner: 'transcript' });
 }
 
-function turnDoneItem({ turn, stream, cards, getState, nextId }) {
+export function turnDoneItem({ turn, stream, cards, getState, nextId }) {
   return {
     kind: 'turndone',
     id: nextId(),
@@ -425,6 +438,7 @@ function turnDoneItem({ turn, stream, cards, getState, nextId }) {
     ...(turn.failureDetail ? { detail: turn.failureDetail } : {}),
     ...(turn.failureDiagnostic ? { errorDetails: turn.failureDiagnostic } : {}),
     ...turn.routeMeta,
+    ...(turn.failed && turn.quota ? { quota: turn.quota } : {}),
   };
 }
 
@@ -462,6 +476,14 @@ function publishTurnClose(ctx, closingItems) {
     toolMode: runtime.toolMode,
     ...agentStatusState({ force: true }),
   });
+  // Same frame as the failed turndone and busy=false: the resume is queued
+  // (and `quotaResume` published) before anything can observe the idle
+  // session, so a cancel at any later point finds it and wins.
+  if (turn.failed && turn.quota) {
+    try {
+      ctx.bag.beginQuotaSettlement?.();
+    } catch {}
+  }
   ctx.flushDeferredExecutionPendingResumeKick();
 }
 
@@ -502,8 +524,12 @@ async function settleTurn(ctx) {
   try {
     options.onSettled?.(detail);
   } catch {}
+  // A quota failure suspends only a Goal that was running when it struck.
+  const quotaFailed = turn.failed && turn.quota && isCurrentTurn();
+  const goalBefore = quotaFailed ? runtime.goalStatus?.() || null : null;
+  let settledGoal = null;
   try {
-    await bag.onGoalTurnSettled?.({
+    settledGoal = await bag.onGoalTurnSettled?.({
       status: finalStatus,
       error: turn.failureDiagnostic || turn.failureDetail || null,
       usageLimited: turn.usageLimited,
@@ -520,6 +546,17 @@ async function settleTurn(ctx) {
       }),
     });
   } catch {}
+  if (turn.failed && turn.quota) {
+    const suspended =
+      quotaFailed &&
+      !flags.disposed &&
+      goalBefore?.status === 'active' &&
+      settledGoal?.status === 'usage_limited' &&
+      settledGoal.id === goalBefore.id;
+    try {
+      bag.finishQuotaSettlement?.({ suspendedGoalId: suspended ? settledGoal.id : '' });
+    } catch {}
+  }
   if (flags.goalSteeringAbortEpoch === turn.epoch) flags.goalSteeringAbortEpoch = null;
   ctx.tuiDebug(
     `runTurn end turn=${turn.index} status=${finalStatus} elapsedMs=${Date.now() - turn.startedAt} pending=${ctx.pending.length}`

package/src/vendor/statusline/bin/statusline-route.mjs

@@ -17,6 +17,7 @@ import {
 } from '../src/gateway/route-meta.mjs';
 import { getModelMetadataSync } from '../../../runtime/agent/orchestrator/providers/model-catalog.mjs';
 import { resolveRuntimeRoot } from '../../../runtime/shared/runtime-root.mjs';
+import { withDefaultPresets } from '../../../runtime/agent/orchestrator/config-presets.mjs';
 
 function positiveInt(value) {
   const n = parseInt(String(value || ''), 10);
@@ -142,7 +143,7 @@ function resolveConfiguredModelTarget(cfg, rawModel) {
   const lower = stripped.toLowerCase();
   const agent = cfg?.agent && typeof cfg.agent === 'object' ? cfg.agent : {};
   const providers = agent.providers && typeof agent.providers === 'object' ? agent.providers : {};
-  const presets = Array.isArray(agent.presets) ? agent.presets : [];
+  const presets = withDefaultPresets(agent.presets);
   for (const p of presets) {
     if (!p || typeof p !== 'object' || !p.provider || !p.model) continue;
     const providerEntry = providers[p.provider];
@@ -455,7 +456,7 @@ function configuredGatewayStatus(options = {}) {
     model = aliasTarget.model;
   }
   if (!provider || !model) return null;
-  const presets = Array.isArray(cfg?.agent?.presets) ? cfg.agent.presets : [];
+  const presets = withDefaultPresets(cfg?.agent?.presets);
   const preset = presets.find(p =>
     p?.provider === provider &&
     p?.model === model &&