mixdog 1.2.0 → 1.2.1

package/src/runtime/shared/skill-script-runtime.mjs

@@ -0,0 +1,264 @@
+// The interpreter a built-in skill's bundled scripts run on.
+//
+// `${MIXDOG_SKILL_DIR}` is a real directory every process can read, but the
+// pptx scripts import the runtime by relative path (../../../../runtime/...)
+// and its native dependencies (sharp, @napi-rs/canvas, pdf.js). A packaged
+// desktop keeps those only inside runtime.asar, which plain Node cannot open,
+// so `node "<dir>/scripts/x.mjs"` works from an npm install and fails there.
+//
+// So the daemon that runs the model's shells hands them its OWN runtime: a
+// per-installation directory, first on every model shell's PATH, holds
+// `mixdog-skill-node` launchers that run this process's executable (Electron
+// in node mode, or node) on src/skill-script-entry.mjs, which maps the script
+// back into the archive before importing it. Each daemon builds its own shell
+// env, so an SSH-remote or mobile session gets its execution host's runtime.
+// Launchers carry two paths and nothing else: no credentials, no daemon
+// identity.
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { writeFileAtomicSync } from './atomic-file.mjs';
+import { resolvePluginData } from './plugin-paths.mjs';
+
+/** This module's package root (src/runtime/shared → the package). */
+export const SKILL_SCRIPT_PACKAGE_ROOT = path.resolve(fileURLToPath(new URL('.', import.meta.url)), '..', '..', '..');
+
+function pathApi(platform) {
+  return platform === 'win32' ? path.win32 : path.posix;
+}
+
+/** The `…/runtime.asar` prefix of a location inside the runtime archive, or null. */
+export function archiveRootOf(location, platform = process.platform) {
+  const sep = platform === 'win32' ? '[\\\\/]' : '/';
+  const match = new RegExp(`^(.*?${sep}runtime\\.asar)(?=${sep}|$)`).exec(String(location || ''));
+  return match ? pathApi(platform).normalize(match[1]) : null;
+}
+
+/**
+ * The path a script must be imported from. A built-in skill's directory is
+ * handed out under `runtime.asar.unpacked` (skillExecutionDir), but its
+ * relative imports only resolve from the archive, so a script under the
+ * sidecar of the archive that holds this package maps back into it. Source
+ * trees and npm installs keep the real path (symlinks resolved, as the ESM
+ * loader resolves them for import.meta.url).
+ */
+export function canonicalSkillScriptPath(
+  target,
+  {
+    packageRoot = SKILL_SCRIPT_PACKAGE_ROOT,
+    platform = process.platform,
+    cwd = process.cwd(),
+    realpath = realpathSync,
+  } = {}
+) {
+  const api = pathApi(platform);
+  let location = api.resolve(cwd, String(target));
+  try {
+    location = realpath(location);
+  } catch {
+    // A missing script fails at import with its own path in the message.
+  }
+  const archive = archiveRootOf(packageRoot, platform);
+  if (!archive) return location;
+  const sidecar = `${archive}.unpacked${api.sep}`;
+  const fold = (value) => (platform === 'win32' ? value.replaceAll('/', '\\').toLowerCase() : value);
+  if (!fold(location).startsWith(fold(sidecar))) return location;
+  return `${archive}${api.sep}${location.slice(sidecar.length)}`;
+}
+
+/** The runtime this process would hand a skill script to. */
+export function skillScriptRuntime({
+  execPath = process.execPath,
+  versions = process.versions,
+  packageRoot = SKILL_SCRIPT_PACKAGE_ROOT,
+  platform = process.platform,
+} = {}) {
+  return {
+    platform,
+    interpreter: execPath,
+    // Electron's own version marker, not ELECTRON_RUN_AS_NODE: model shells
+    // scrub that variable, and a daemon may have inherited it without being
+    // Electron at all.
+    electron: Boolean(versions?.electron),
+    packageRoot,
+    entry: pathApi(platform).join(packageRoot, 'src', 'skill-script-entry.mjs'),
+  };
+}
+
+function batchQuote(value) {
+  return `"${String(value).replaceAll('%', '%%')}"`;
+}
+
+function posixQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+/**
+ * The command `${MIXDOG_SKILL_NODE}` renders to. It is the same word in every
+ * shell: model shells find it on PATH (withSkillLauncherPath), as the
+ * extensionless sh launcher (bash, sh, zsh, Git Bash) or as the .cmd beside
+ * it (cmd through PATHEXT on Windows). PowerShell model commands define a
+ * function of the same name first (renderPowerShellSkillFunction), which
+ * takes precedence over both.
+ */
+export const SKILL_LAUNCHER_COMMAND = 'mixdog-skill-node';
+
+/**
+ * sh launcher text. Electron node mode is set only inside the launcher, for
+ * the one child it execs; every argument and the exit code pass through.
+ */
+export function renderPosixSkillLauncher({ interpreter, entry, electron }) {
+  return `${[
+    '#!/bin/sh',
+    '# Mixdog skill-script launcher, generated for one installation. Do not edit.',
+    ...(electron ? ['ELECTRON_RUN_AS_NODE=1', 'export ELECTRON_RUN_AS_NODE'] : []),
+    `exec ${posixQuote(interpreter)} ${posixQuote(entry)} "$@"`,
+  ].join('\n')}\n`;
+}
+
+/** .cmd launcher text, same contract as the sh launcher. */
+export function renderWindowsSkillLauncher({ interpreter, entry, electron }) {
+  // cmd decodes a batch file in the console code page line by line, so a
+  // non-ASCII path needs UTF-8 for the lines after chcp; the caller's code
+  // page is restored before exit.
+  const unicode = /\P{ASCII}/u.test(`${interpreter}${entry}`);
+  return `${[
+    '@echo off',
+    'rem Mixdog skill-script launcher, generated for one installation. Do not edit.',
+    'setlocal EnableExtensions DisableDelayedExpansion',
+    ...(unicode
+      ? ['for /f "tokens=2 delims=:." %%C in (\'chcp\') do set "MIXDOG_SKILL_CP=%%C"', 'chcp 65001 >nul']
+      : []),
+    ...(electron ? ['set "ELECTRON_RUN_AS_NODE=1"'] : []),
+    `${batchQuote(interpreter)} ${batchQuote(entry)} %*`,
+    'set "MIXDOG_SKILL_EXIT=%ERRORLEVEL%"',
+    ...(unicode ? ['if defined MIXDOG_SKILL_CP chcp %MIXDOG_SKILL_CP% >nul'] : []),
+    'exit /b %MIXDOG_SKILL_EXIT%',
+  ].join('\r\n')}\r\n`;
+}
+
+/** Environment variable carrying a PowerShell caller's arguments to the entry. */
+export const SKILL_ARGV_ENV = 'MIXDOG_SKILL_ARGV';
+const SKILL_ARGV_TAG = 'mixdog1';
+
+function psQuote(value) {
+  // PowerShell also treats the typographic single quotes as quote characters.
+  return `'${String(value).replace(/['\u2018\u2019\u201a\u201b]/g, '$&$&')}'`;
+}
+
+/**
+ * One-line PowerShell definition of `mixdog-skill-node`, prepended to every
+ * PowerShell model command. Through PATH, PowerShell would reach the .cmd via
+ * `cmd.exe /c` with arguments it does not quote, so `'a&b'` ran `b`. The
+ * function runs this daemon's executable on the entry as a plain native
+ * command, so PowerShell's own native-command handling provides streaming,
+ * ordering, backpressure, line endings, `2>&1`/`2>$null`/`2>file`,
+ * `$LASTEXITCODE`, Ctrl-C and early stop. The caller's arguments never reach
+ * that command line: they travel in SKILL_ARGV_ENV (UTF-8 base64), because
+ * Windows PowerShell 5.1 drops empty native arguments and does not escape
+ * embedded double quotes. A failing script ends the command with its exit
+ * code (`exit`), because a PowerShell function cannot fail `$?` or the
+ * -Command exit code.
+ *
+ * SKILL_ARGV_ENV and (Electron daemons only) ELECTRON_RUN_AS_NODE are set on
+ * $env just for the call and restored in `finally`; the bootstrap deletes
+ * both before importing the script. Accepted tradeoff: while the call runs,
+ * a process a concurrent downstream pipeline stage starts can see them.
+ */
+export function renderPowerShellSkillFunction({ interpreter, entry, electron }) {
+  const names = [SKILL_ARGV_ENV, ...(electron ? ['ELECTRON_RUN_AS_NODE'] : [])];
+  const values = ['$__mxa', ...(electron ? ["'1'"] : [])];
+  const body = [
+    `$__mxa = '${SKILL_ARGV_TAG}'`,
+    "foreach ($__mxv in $args) { foreach ($__mxe in @($__mxv)) { if ($null -ne $__mxe) { $__mxa += ',' + [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$__mxe)) } } }",
+    names.map((name, i) => `$__mxo${i} = $env:${name}`).join('; '),
+    [
+      'try {',
+      ...names.map((name, i) => `$env:${name} = ${values[i]};`),
+      `& ${psQuote(interpreter)} ${psQuote(entry)}`,
+      '} finally {',
+      names.map((name, i) => `$env:${name} = $__mxo${i}`).join('; '),
+      '}',
+    ].join(' '),
+    'if ($LASTEXITCODE) { exit $LASTEXITCODE }',
+  ];
+  return `function ${SKILL_LAUNCHER_COMMAND} { ${body.join('; ')} }`;
+}
+
+/** The arguments a PowerShell caller sent through SKILL_ARGV_ENV, or null. */
+export function decodeSkillArgv(value) {
+  const text = typeof value === 'string' ? value : '';
+  if (!text.startsWith(SKILL_ARGV_TAG)) return null;
+  const rest = text.slice(SKILL_ARGV_TAG.length);
+  if (!rest) return [];
+  return rest
+    .slice(1)
+    .split(',')
+    .map((item) => Buffer.from(item, 'base64').toString('utf8'));
+}
+
+/** Launcher files of `runtime`: the sh script everywhere, plus the .cmd on Windows. */
+export function skillLauncherFiles(runtime) {
+  return [
+    { name: SKILL_LAUNCHER_COMMAND, content: renderPosixSkillLauncher(runtime) },
+    ...(runtime.platform === 'win32'
+      ? [{ name: `${SKILL_LAUNCHER_COMMAND}.cmd`, content: renderWindowsSkillLauncher(runtime) }]
+      : []),
+  ];
+}
+
+/** Private per-installation launcher directory under the data dir. */
+export function skillLauncherDir(runtime, dataDir = resolvePluginData()) {
+  const digest = createHash('sha256')
+    .update(JSON.stringify([runtime.platform, runtime.interpreter, runtime.entry, runtime.electron]))
+    .digest('hex')
+    .slice(0, 16);
+  return pathApi(runtime.platform).join(dataDir, 'skill-launchers', digest);
+}
+
+const ensuredDirs = new Set();
+
+/**
+ * Write (atomically) or refresh the launchers for `runtime`; returns their
+ * directory. A directory already verified by this process is only checked for
+ * presence, so the per-command shell env build stays a couple of stats.
+ */
+export function ensureSkillLauncherDir(runtime = skillScriptRuntime(), dataDir = resolvePluginData()) {
+  const dir = skillLauncherDir(runtime, dataDir);
+  const api = pathApi(runtime.platform);
+  const files = skillLauncherFiles(runtime);
+  if (ensuredDirs.has(dir) && files.every(({ name }) => existsSync(api.join(dir, name)))) return dir;
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  for (const { name, content } of files) {
+    const file = api.join(dir, name);
+    let current = null;
+    try {
+      current = readFileSync(file, 'utf8');
+    } catch {
+      // Not written yet.
+    }
+    if (current !== content) writeFileAtomicSync(file, content, { mode: 0o700 });
+  }
+  ensuredDirs.add(dir);
+  return dir;
+}
+
+/**
+ * `env` with this installation's launcher directory first on PATH. Only model
+ * shell environments call this; the daemon's own env, hooks and internal
+ * workers keep their PATH. The directory holds nothing but the launchers, so
+ * no existing command is shadowed.
+ */
+export function withSkillLauncherPath(env, { runtime = skillScriptRuntime(), dataDir = resolvePluginData() } = {}) {
+  const dir = ensureSkillLauncherDir(runtime, dataDir);
+  const delimiter = runtime.platform === 'win32' ? ';' : ':';
+  // Windows env keys are case-insensitive and usually spelled `Path`.
+  const key =
+    (runtime.platform === 'win32' ? Object.keys(env).find((name) => name.toUpperCase() === 'PATH') : null) || 'PATH';
+  const entries = String(env[key] || '')
+    .split(delimiter)
+    .filter((entry) => entry && entry !== dir);
+  env[key] = [dir, ...entries].join(delimiter);
+  return env;
+}

package/src/runtime/shared/tool-primitives.mjs

@@ -22,8 +22,39 @@ function rawToolName(name) {
   return String(name || 'tool').replace(/^functions\./, '');
 }
 
-export function parseMcpToolName(name) {
-  const text = rawToolName(name);
+// Tool names shortened to fit provider limits -> their real server and tool,
+// recorded when the name is built so name-only callers in this process
+// resolve them. Bounded; the oldest entries go first.
+const MCP_TOOL_IDENTITY_MAX = 4096;
+const mcpToolIdentities = new Map();
+
+export function rememberMcpToolIdentity(name, server, tool) {
+  const key = String(name || '');
+  if (!key) return;
+  mcpToolIdentities.delete(key);
+  mcpToolIdentities.set(key, { server: String(server || ''), tool: String(tool || '') });
+  if (mcpToolIdentities.size > MCP_TOOL_IDENTITY_MAX) mcpToolIdentities.delete(mcpToolIdentities.keys().next().value);
+}
+
+/** Server and tool of a shortened MCP tool name, when this process built it. */
+export function knownMcpToolIdentity(name) {
+  const known = mcpToolIdentities.get(rawToolName(name));
+  return known ? { ...known } : null;
+}
+
+/** `{ server, tool }` of an MCP tool, or null. Takes a tool definition (its
+ *  `mcpServerName`/`mcpToolName` metadata wins) or a name (a recorded
+ *  shortened name first, else the `mcp__<server>__<tool>` form). */
+export function parseMcpToolName(nameOrTool) {
+  if (nameOrTool && typeof nameOrTool === 'object') {
+    const server = String(nameOrTool.mcpServerName || '').trim();
+    const parsed = parseMcpToolName(nameOrTool.name);
+    if (!server) return parsed;
+    return { server, tool: String(nameOrTool.mcpToolName || '') || parsed?.tool || '' };
+  }
+  const text = rawToolName(nameOrTool);
+  const known = mcpToolIdentities.get(text);
+  if (known) return { ...known };
   const match = /^mcp__(.+?)__(.+)$/.exec(text);
   if (!match) return null;
   return { server: match[1], tool: match[2] };
@@ -169,6 +200,8 @@ export function toolSearchDisplayLabel(args = {}) {
 export function displayToolSearchTarget(value) {
   const text = String(value || '').trim();
   if (/^skill:/i.test(text)) return text.slice('skill:'.length);
+  const known = knownMcpToolIdentity(text);
+  if (known) return `${known.server}.${known.tool}`;
   const mcp = /^mcp__(.*?)__(.+)$/.exec(text);
   if (mcp) return `${mcp[1]}.${mcp[2]}`;
   return stripToolPrefix(text);

package/src/runtime/shared/turn-worktree-snapshot.mjs

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
 import { access, copyFile, lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { PATCH_EDIT_MAX_BYTES } from './bounded-file-read.mjs';
 import { cleanString as clean } from './clean.mjs';
 import { runGitOffThread } from './git-runner.mjs';
@@ -44,8 +44,26 @@ function pathKey(value) {
 
 /** `resolve` plus symlinks of the nearest existing ancestor: git reports the
  *  worktree root canonically (macOS /var -> /private/var), callers may not. */
-function canonicalPath(value) {
+function canonicalPath(value, dirs = null) {
   const full = resolve(value);
+  if (dirs) {
+    // Same result as the walk below without repeating it per file: the parent
+    // directory is canonicalized once per call; the final component only
+    // matters when it is itself a link (or its state is unknown).
+    const parent = dirname(full);
+    if (parent !== full) {
+      let canonicalParent = dirs.get(parent);
+      if (canonicalParent === undefined) {
+        canonicalParent = canonicalPath(parent);
+        dirs.set(parent, canonicalParent);
+      }
+      try {
+        if (!lstatSync(full).isSymbolicLink()) return join(canonicalParent, basename(full));
+      } catch (error) {
+        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return join(canonicalParent, basename(full));
+      }
+    }
+  }
   let head = full;
   while (!existsSync(head)) {
     const parent = dirname(head);
@@ -139,8 +157,10 @@ function stateForRoot(root) {
 /** Report written paths (or `null`: anything may have changed). The next
  *  review poll of an affected worktree captures instead of reusing. */
 export function noteTurnWorktreeChange(paths = null) {
+  if (states.size === 0) return;
   const list = Array.isArray(paths) ? paths.filter((value) => clean(value)) : [];
-  const keys = list.map((value) => pathKey(canonicalPath(value)));
+  const dirs = new Map();
+  const keys = list.map((value) => pathKey(canonicalPath(value, dirs)));
   for (const state of states.values()) {
     const root = pathKey(state.root);
     if (keys.length === 0 || keys.some((key) => key === root || key.startsWith(`${root}/`))) {
@@ -781,7 +801,7 @@ function scheduleShadowGc(state) {
 async function removeShadowDir(gitDir, removed, kept) {
   if (!(await exists(gitDir))) return;
   await rm(gitDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }).catch(() => {});
-  (await exists(gitDir) ? kept : removed).push(gitDir);
+  ((await exists(gitDir)) ? kept : removed).push(gitDir);
 }
 
 /** Drop every trace of one worktree root: serialize behind its pending capture

package/src/runtime/shared/worker-requests.mjs

@@ -14,8 +14,11 @@ import { parentPort, Worker } from 'node:worker_threads';
  * worker is detached before it is terminated, so no request is ever sent to
  * (or lost with) a worker that is shutting down.
  * `request.running()` reports whether a worker thread is currently attached.
+ *
+ * `onEvent` (optional): receives what the worker sends with postWorkerEvent
+ * (messages that answer no request).
  */
-export function createWorkerRequestClient(url, { idleExitMs = 0, ...workerOptions } = {}) {
+export function createWorkerRequestClient(url, { idleExitMs = 0, onEvent = null, ...workerOptions } = {}) {
   let worker = null;
   let nextRequestId = 0;
   // Requests belong to the worker they were posted to: a replacement worker
@@ -50,7 +53,12 @@ export function createWorkerRequestClient(url, { idleExitMs = 0, ...workerOption
       owned.clear();
       for (const entry of entries) entry.reject(error);
     };
-    created.on('message', ({ id, result, error }) => {
+    created.on('message', (message) => {
+      if (message && Object.hasOwn(message, 'event')) {
+        onEvent?.(message.event);
+        return;
+      }
+      const { id, result, error } = message;
       const entry = owned.get(id);
       if (!entry) return;
       owned.delete(id);
@@ -109,6 +117,11 @@ export function createWorkerRequestClient(url, { idleExitMs = 0, ...workerOption
   return request;
 }
 
+/** Worker side: send `event` to the client's `onEvent`, outside any request. */
+export function postWorkerEvent(event) {
+  parentPort.postMessage({ event });
+}
+
 /** Worker side: answer every request with `handler(payload)` (sync or async). */
 export function serveWorkerRequests(handler) {
   parentPort.on('message', ({ id, payload }) => {

package/src/session-runtime/automation-agents.mjs

@@ -57,10 +57,16 @@ export function deliverAutomationCompletion(sessionId, text, meta = {}) {
   return true;
 }
 
+// Ask options for a follow-up turn fed by agent results: the runtime reporting
+// worker output, not the user — stored as a task notification and never a
+// source of explicit skill selection.
+export const AUTOMATION_RESULT_TURN_OPTS = Object.freeze({ promptSource: 'task-notification' });
+
 /**
  * Runs an automation conversation to its end: the first turn, then one more
  * turn per batch of agent results while agents it started are still out.
- * Resolves with the last turn's result.
+ * `nextTurn(text, askOpts)` receives AUTOMATION_RESULT_TURN_OPTS as the
+ * results' provenance. Resolves with the last turn's result.
  */
 export async function runAutomationTurns(sessionId, firstTurn, nextTurn, { waitMs = AGENT_RESULT_WAIT_MS } = {}) {
   const run = { pending: new Set(), ready: [], wake: null };
@@ -79,7 +85,7 @@ export async function runAutomationTurns(sessionId, firstTurn, nextTurn, { waitM
         run.wake = null;
         if (!arrived) break;
       }
-      result = await nextTurn(run.ready.splice(0).join('\n\n'));
+      result = await nextTurn(run.ready.splice(0).join('\n\n'), { ...AUTOMATION_RESULT_TURN_OPTS });
     }
     return result;
   } finally {

package/src/session-runtime/boot/apis.mjs

@@ -60,6 +60,10 @@ import { createGoalFacadeApi } from '../goal-facade-api.mjs';
 import { createRuntimeReviewApi } from '../runtime-review-api.mjs';
 import { createWorkspaceTransitions, refreshWorkspacePrompt } from '../workspace/transitions.mjs';
 import { saveSession } from '../../runtime/agent/orchestrator/session/store.mjs';
+import { modelToolSchemaAllowlist } from '../../runtime/agent/orchestrator/runtime-core/tool-profile.mjs';
+import { sessionOptions } from '../session-create/session-options.mjs';
+import { createConversationImportApi } from '../conversation-import/service.mjs';
+import { importError } from '../conversation-import/discovery.mjs';
 import { bootProfile } from '../boot-profile.mjs';
 import { STANDALONE_DATA_DIR } from '../runtime-paths.mjs';
 import {
@@ -88,12 +92,22 @@ export function wireApis(boot) {
   });
   boot.providerAuthApi = providerAuthApiFor(boot);
   boot.mediaApi = createMediaApi();
+  boot.conversationImportApi = conversationImportApiFor(boot);
   boot.sessionTitles = createSessionTitleController({
     dataRoot: () => dataDirOf(boot.cfgMod),
     promoteGeneratedTitle: (sessionId, title, stage) => boot.mgr.updateSessionGeneratedTitle(sessionId, title, stage),
   });
   boot.lifecycleApi = lifecycleApiFor(boot);
   boot.resourceApi = resourceApiFor(boot);
+  // Plugin MCP servers are derived live; copies an earlier enable action wrote
+  // into mcpServers are adopted once (an injected headless config is left as is).
+  if (!boot.params.initialConfig || typeof boot.params.initialConfig !== 'object') {
+    try {
+      boot.resourceApi.migratePluginMcpCopies();
+    } catch (error) {
+      bootProfile('plugin-mcp:adopt-failed', { error: error?.message || String(error) });
+    }
+  }
   boot.disposeGlobalExtensionSubscription = () => {
     boot.disposeConfigSync?.();
     boot.resourceApi.disposeGlobalExtensionSubscription?.();
@@ -282,6 +296,45 @@ function settingsApiFor(boot) {
   });
 }
 
+// Conversation import: imported sessions are built with the Lead options a new
+// session of this runtime would get (current route, tools, workflow, memory),
+// minus its reservation, profile ownership and desktop placement.
+function conversationImportApiFor(boot) {
+  const { rt, mgr } = boot;
+  return createConversationImportApi({
+    // The async catalog (the daemon's SQLite catalog worker, else JSON),
+    // loaded on first use so boot does not pull in the cold reader.
+    listSessionSummaries: async () => {
+      const reader = await import('../../runtime/agent/orchestrator/session/store-summary-reader.mjs');
+      return reader.listStoredSessionSummariesAsync();
+    },
+    createSession: (options) => mgr.createSession(options),
+    prepareLeadOptions: async () => {
+      await boot.awaitKeychainPrewarm();
+      const route = rt.route?.provider && rt.route?.model ? rt.route : resolveRoute(rt.config, {});
+      if (!route?.provider || !route?.model) throw importError('noModelRoute');
+      await boot.ensureProvidersReady(rt.config.providers || {});
+      const coreMemoryContext = await boot.loadCoreMemoryContext();
+      const leadView = Object.assign(Object.create(rt), {
+        route,
+        reservedSessionId: null,
+        sessionProfile: null,
+        desktopSession: null,
+      });
+      return sessionOptions(
+        {
+          rt: leadView,
+          cfgMod: boot.cfgMod,
+          activeWorkflowContext: workflowHelpers.activeWorkflowContext,
+          schemaAllowedTools: modelToolSchemaAllowlist(rt.toolProfile),
+          featureDisallowedTools: boot.featureDisallowedTools,
+        },
+        coreMemoryContext
+      );
+    },
+  });
+}
+
 function providerAuthApiFor(boot) {
   const { rt, cfgMod, reg, ensureProvidersReady } = boot;
   return createProviderAuthApi({
@@ -403,6 +456,8 @@ function resourceApiFor(boot) {
     normalizeMcpServerInput: boot.normalizeMcpServerInput,
     mcpStatus: boot.mcpStatus,
     getMcpServerConfig: boot.getMcpServerConfig,
+    resolveMcpCatalog: boot.resolveMcpCatalog,
+    pluginMcpServer: boot.pluginMcpServer,
     skillsStatus: boot.skillsStatus,
     skillContent: boot.skillContent,
     addGlobalSkill: boot.addGlobalSkill,

package/src/session-runtime/boot/config.mjs

@@ -87,7 +87,8 @@ function initRuntimeState(rt, params) {
   rt.activeTurnAbortControllers = new Set();
   rt.firstTurnCompleted = false;
   rt.codeGraphFirstTurnPrewarmDone = false;
-  rt.startupProviderCatalogRefreshStarted = false;
+  // Last registry catalog-refresh promise this runtime attached handling to.
+  rt.startupProviderCatalogRefreshObserved = null;
   // True while the boot-time provider-catalog refresh is in flight: warming a
   // model cache it is about to invalidate only burns the load twice.
   rt.startupProviderCatalogRefreshPending = false;
@@ -106,7 +107,9 @@ function activeTurnControls(rt) {
         aborted = true;
         try {
           controller.abort(reason);
-        } catch {}
+        } catch {
+          // Best-effort: one throwing abort listener must not stop the others.
+        }
       }
       return aborted;
     },

package/src/session-runtime/boot/facade.mjs

@@ -18,6 +18,7 @@ export function buildFacade(boot) {
       ...boot.providerAuthApi,
       ...boot.usageStatsApi,
       ...boot.mediaApi,
+      ...boot.conversationImportApi,
       ...boot.runtimeReviewApi,
     },
     goalApi: boot.goalFacadeApi,

package/src/session-runtime/boot/infrastructure.mjs

@@ -7,11 +7,7 @@ import { createStandaloneHookBus } from '../services/hook-bus.mjs';
 import { updateCurrentCwdOverride, writeLastSessionCwd } from '../../runtime/shared/user-cwd.mjs';
 import { listRegisteredPlugins, pluginAdminStatus } from '../services/plugin-admin.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import {
-  countSkillFiles,
-  pluginManifest,
-  pluginMcpServerName,
-} from '../../runtime/agent/orchestrator/runtime-core/plugin-mcp.mjs';
+import { countSkillFiles, pluginManifest } from '../../runtime/agent/orchestrator/runtime-core/plugin-mcp.mjs';
 import { bootProfile } from '../boot-profile.mjs';
 import { createMcpGlue } from '../mcp-glue.mjs';
 import { createSelfUpdateController } from '../self-update.mjs';
@@ -41,20 +37,30 @@ function wireMcp(boot) {
     mcpConnectGeneration: 0,
     mcpConnectInFlight: null,
   };
-  const { mcpStatus, getMcpServerConfig, connectConfiguredMcp, awaitInitialMcpConnect, normalizeMcpServerInput } =
-    createMcpGlue({
-      mcpClient,
-      getConfig: () => rt.config,
-      getCurrentCwd: () => rt.currentCwd,
-      getMcpScopeId: () => rt.mcpScopeId,
-      getDesktopSession: () => rt.desktopSession,
-      setDesktopSession: (v) => {
-        rt.desktopSession = v;
-      },
-      state: mcpState,
-    });
+  const {
+    mcpStatus,
+    resolveMcpCatalog,
+    pluginMcpServer,
+    pluginMcpSummary,
+    getMcpServerConfig,
+    connectConfiguredMcp,
+    awaitInitialMcpConnect,
+    normalizeMcpServerInput,
+  } = createMcpGlue({
+    mcpClient,
+    getConfig: () => rt.config,
+    getCurrentCwd: () => rt.currentCwd,
+    getMcpScopeId: () => rt.mcpScopeId,
+    // Plugin-declared servers are derived from the registry on every resolve.
+    getPluginDataDir: () => dataDirOf(boot.cfgMod),
+    listPlugins: () => listRegisteredPlugins({ dataDir: boot.cfgMod.getPluginData() }),
+    state: mcpState,
+  });
   Object.assign(boot, {
     mcpStatus,
+    resolveMcpCatalog,
+    pluginMcpServer,
+    pluginMcpSummary,
     getMcpServerConfig,
     connectConfiguredMcp,
     awaitInitialMcpConnect,
@@ -250,7 +256,12 @@ function wireCwdPlugins(boot) {
     listRegisteredPlugins,
     pluginAdminStatus,
     pluginManifest,
-    pluginMcpServerName,
+    pluginMcpSummary: boot.pluginMcpSummary,
+    // Plugin MCP servers without a declared cwd follow this runtime's cwd:
+    // reconnect just those (and refresh advertised roots) in place.
+    onCwdChanged: () => {
+      void boot.connectConfiguredMcp({ reconcile: true }).catch(() => {});
+    },
     countSkillFiles,
     writeLastSessionCwd,
     updateCurrentCwdOverride,