mixdog 1.2.2 → 1.2.3

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -5,6 +5,7 @@ import { formatLocalAndUtcTimestamp } from '../../../../shared/time-format.mjs';
 import { SUMMARY_PREFIX } from '../compact.mjs';
 import { isProtectedContextUserMessage } from '../compact/messages.mjs';
 import { attachmentTextForPart, isAttachmentReference } from '../../../../attachments/store.mjs';
+import { samePath } from '../../../../shared/worktrees/paths.mjs';
 
 export function promptContentText(content) {
   if (typeof content === 'string') return content;
@@ -144,7 +145,11 @@ function replaceSystemMessageContent(session, target, content) {
   return true;
 }
 
-export function refreshSessionBp3Environment(session, cwd) {
+export function refreshSessionBp3Environment(session, requestedCwd) {
+  // A staged workspace change (see stageWorkspaceReroot) keeps the system
+  // prompt rooted where it was until the next re-root: the `# Session` Cwd
+  // stays the rooted one, the change reaches the model as a tail notice.
+  const cwd = session?.workspaceReroot?.rootCwd || requestedCwd;
   // Split layout (bp3EnvSplit): the volatile environment lives in its own
   // UNMARKED cacheTier:'env' system block; the tier3 core block is never
   // rewritten, so the refresh cannot invalidate the BP3 cache write.
@@ -242,20 +247,12 @@ export function replaceWorkspaceEnvironment(environmentTail, environmentContext)
 }
 
 /**
- * Re-root an existing session's prompt at a new workspace without touching
- * the conversation: environment facts, project memory and instruction files
- * are replaced in place (never appended), then the `# Session` block is
- * rebuilt for `cwd`. Messages are replaced, not mutated, so delta saves write
- * a full snapshot.
- * @param {object} session
- * @param {{ cwd: string, environmentContext?: string, coreMemoryContext?: string, instructionFilesContext?: string }} context
- * @returns {boolean}
+ * Re-root a session's prompt at a workspace in place: environment facts,
+ * project memory and instruction files are replaced (never appended), then
+ * the `# Session` block is rebuilt for `cwd`. Messages are replaced, not
+ * mutated, so delta saves write a full snapshot.
  */
-export function refreshSessionWorkspaceContext(
-  session,
-  { cwd, environmentContext, coreMemoryContext, instructionFilesContext } = {}
-) {
-  if (!session) return false;
+function rerootSessionWorkspace(session, { cwd, environmentContext, coreMemoryContext, instructionFilesContext }) {
   if (typeof session.bp3EnvironmentContext === 'string') {
     session.bp3EnvironmentContext = replaceWorkspaceEnvironment(session.bp3EnvironmentContext, environmentContext);
   }
@@ -275,7 +272,204 @@ export function refreshSessionWorkspaceContext(
   return refreshSessionBp3Environment(session, cwd);
 }
 
+const SESSION_BLOCK_CWD_RE = /(?:^|\n)# Session\nCwd: ([^\n]+)/;
+const WORKER_ENV_CWD_RE = /(?:^|\n)- Cwd: ([^\n]+?) — the active Project root/;
+
+function textOf(message) {
+  return typeof message?.content === 'string' ? message.content : '';
+}
+
+/**
+ * The workspace the session's system prompt currently presents: its Cwd and
+ * the environment facts, project memory and instruction-files slices, read
+ * back from the blocks refreshSessionBp3Environment/composeSystemPrompt wrote.
+ */
+function presentedWorkspace(session) {
+  const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
+  const instructionAt = bp3SliceAt(core, INSTRUCTION_FILES_HEADING);
+  const head = instructionAt ? core.slice(0, instructionAt.cut) : core;
+  const memory = (head ? head.split(BP3_PART_SEPARATOR) : []).find((part) => part.startsWith(CORE_MEMORY_HEADING));
+  const tail = typeof session.bp3EnvironmentContext === 'string' ? session.bp3EnvironmentContext : '';
+  const facts = tail.split(BP3_PART_SEPARATOR)[0] || '';
+  const promptText = [textOf(bpEnvSystemMessage(session)), textOf(bp3SystemMessage(session))].join('\n');
+  const cwd = promptText.match(SESSION_BLOCK_CWD_RE)?.[1] || facts.match(WORKER_ENV_CWD_RE)?.[1] || null;
+  return {
+    cwd: cwd ? cwd.trim() : null,
+    environmentContext: facts.startsWith('- ') ? facts.trim() : '',
+    coreMemoryContext: memory ? memory.slice(CORE_MEMORY_HEADING.length).trim() : '',
+    instructionFilesContext: instructionAt ? core.slice(instructionAt.start).trim() : '',
+  };
+}
+
+const WORKSPACE_SLICES = ['environmentContext', 'coreMemoryContext', 'instructionFilesContext'];
+
+/**
+ * A workspace change of a session that already has a conversation: the
+ * system prompt stays byte-identical (provider prompt cache intact) and the
+ * change is staged on `session.workspaceReroot`:
+ *   rootCwd — the Cwd the system prompt stays rooted at;
+ *   seen    — what the model has been told (the prompt, then acknowledged notices);
+ *   target  — the current workspace, applied to the prompt at the next re-root
+ *             (compaction, a route change, a cleared conversation).
+ * `undefined` slices keep what is there. The state object is replaced, never
+ * mutated, so a transaction snapshot of the field restores it exactly.
+ */
+function stageWorkspaceReroot(session, context) {
+  const prior = session.workspaceReroot;
+  const seen = prior ? prior.seen : presentedWorkspace(session);
+  const target = { ...(prior ? prior.target : {}), cwd: String(context.cwd || '').trim() };
+  for (const slice of WORKSPACE_SLICES) {
+    if (context[slice] !== undefined) target[slice] = trimmedSlice(context[slice]);
+  }
+  // The move into a worktree belongs to this change only; a later one drops it.
+  delete target.move;
+  const from = String(context.move?.from || '').trim();
+  if (from) target.move = { from, changes: context.move.changes ?? null };
+  session.workspaceReroot = {
+    version: 1,
+    revision: (Number(prior?.revision) || 0) + 1,
+    rootCwd: prior ? prior.rootCwd : seen.cwd,
+    seen,
+    target,
+  };
+  return true;
+}
+
+/**
+ * Re-root an existing session's prompt at a new workspace. A session without
+ * a conversation is re-rooted in place (no cache to keep); one with a
+ * conversation keeps its system messages untouched and stages the change
+ * (stageWorkspaceReroot): the model learns it from the tail notice of its
+ * next user turn (snapshotPendingWorkspaceNotice), and the next re-root
+ * (applyPendingWorkspaceReroot) rewrites the prompt.
+ * `move` ({ from, changes: 'carried'|'left'|null }: the session left the
+ * project folder `from` for a worktree) adds to the notice what happened to
+ * the uncommitted changes and that paths under `from` now resolve under `cwd`.
+ * @param {object} session
+ * @param {{ cwd: string, environmentContext?: string, coreMemoryContext?: string, instructionFilesContext?: string, move?: { from: string, changes?: 'carried'|'left'|null } }} context
+ * @returns {boolean}
+ */
+export function refreshSessionWorkspaceContext(session, context = {}) {
+  if (!session) return false;
+  if (hasUserConversationMessage(session.messages)) return stageWorkspaceReroot(session, context);
+  applyPendingWorkspaceReroot(session);
+  return rerootSessionWorkspace(session, context);
+}
+
+/**
+ * Give `stored` (the canonical transcript) the system prefix of `messages`
+ * (a running turn's working array built on it), message objects included.
+ */
+export function syncSystemPrefix(stored, messages) {
+  const systemCount = (list) => {
+    let count = 0;
+    while (count < list.length && list[count]?.role === 'system') count += 1;
+    return count;
+  };
+  stored.splice(0, systemCount(stored), ...messages.slice(0, systemCount(messages)));
+}
+
+/**
+ * Apply a staged workspace change to the system prompt (the session's own
+ * messages, plus `messages` when a running turn works on another array whose
+ * system prefix is the session's) and drop the staged state: the prompt now
+ * presents the current workspace, so no notice is due any more.
+ * @returns {boolean} whether a staged change was applied
+ */
+export function applyPendingWorkspaceReroot(session, messages = session?.messages) {
+  const pending = session?.workspaceReroot;
+  if (!pending) return false;
+  delete session.workspaceReroot;
+  const stored = session.messages;
+  const other = Array.isArray(messages) && messages !== stored;
+  if (other) session.messages = messages;
+  try {
+    rerootSessionWorkspace(session, pending.target);
+  } finally {
+    if (other) session.messages = stored;
+  }
+  if (other && Array.isArray(stored)) syncSystemPrefix(stored, messages);
+  return true;
+}
+
+function sameWorkspacePath(left, right) {
+  return !!left && !!right && samePath(left, right);
+}
+
+/** The lines a move from the project folder into a worktree adds to the notice. */
+function workspaceMoveLines(move, cwd) {
+  if (!move?.from || sameWorkspacePath(move.from, cwd)) return [];
+  const changes =
+    move.changes === 'carried'
+      ? 'Uncommitted changes were moved into the worktree; ignored files (dependencies, build output, env files) were not.'
+      : move.changes === 'left'
+        ? `Uncommitted changes were left in ${move.from}; they are not present here.`
+        : '';
+  return [
+    changes,
+    `For continued work, substitute ${cwd} for the project root ${move.from} in paths mentioned earlier; absolute paths are not remapped automatically. Re-read affected files before editing them.`,
+  ].filter(Boolean);
+}
+
+function workspaceNoticeContent({ seen, target }) {
+  if (!target?.cwd || sameWorkspacePath(seen?.cwd, target.cwd)) return '';
+  const changed = (slice) => target[slice] !== undefined && target[slice] !== (seen?.[slice] || '');
+  const sections = [
+    [
+      '# Working Folder Changed',
+      `The working folder is now ${target.cwd}. This replaces the Cwd and environment facts given earlier in this conversation; relative paths and shell commands resolve here.`,
+      ...workspaceMoveLines(target.move, target.cwd),
+      changed('environmentContext') ? target.environmentContext : '',
+    ]
+      .filter(Boolean)
+      .join('\n'),
+  ];
+  if (changed('instructionFilesContext')) {
+    sections.push(
+      target.instructionFilesContext
+        ? `The instruction files below replace all previously provided instruction files.\n\n${target.instructionFilesContext}`
+        : 'The new working folder has no instruction files: the previously provided instruction files no longer apply.'
+    );
+  }
+  if (changed('coreMemoryContext')) {
+    sections.push(
+      target.coreMemoryContext
+        ? `The core memory below replaces all previously provided core memory.\n\n${CORE_MEMORY_HEADING}${target.coreMemoryContext}`
+        : 'The new working folder has no core memory: the previously provided core memory no longer applies.'
+    );
+  }
+  return `<system-reminder>\n${sections.join('\n\n')}\n</system-reminder>`;
+}
+
+/**
+ * The workspace notice the next user turn carries, or null: nothing when the
+ * folder did not change from what the model was told, and only the slices
+ * that changed. Lifecycle mirrors deferred-tool-delta.mjs (snapshot → acknowledge
+ * when the provider accepted the turn), so a failed turn re-sends it.
+ * @returns {{ revision: number, content: string } | null}
+ */
+export function snapshotPendingWorkspaceNotice(session) {
+  const pending = session?.workspaceReroot;
+  if (!pending) return null;
+  const content = workspaceNoticeContent(pending);
+  return content ? { revision: pending.revision, content } : null;
+}
+
+/** The notice of `revision` reached the model: what it was told is now the target. */
+export function acknowledgePendingWorkspaceNotice(session, revision) {
+  const pending = session?.workspaceReroot;
+  if (!pending || pending.revision !== Number(revision)) return false;
+  const seen = { ...pending.seen, cwd: pending.target.cwd };
+  for (const slice of WORKSPACE_SLICES) {
+    if (pending.target[slice] !== undefined) seen[slice] = pending.target[slice];
+  }
+  session.workspaceReroot = { ...pending, seen };
+  return true;
+}
+
 export function resetSessionBp3Environment(session) {
+  // A cleared conversation has no cache to keep: the prompt re-roots now.
+  applyPendingWorkspaceReroot(session);
   if (session?.bp3EnvSplit === true) {
     const target = bpEnvSystemMessage(session);
     if (!target || typeof session?.bp3EnvironmentContext !== 'string') return false;

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -18,6 +18,7 @@ import { forgetSessionSaveBaseline } from '../store/save-worker.mjs';
 import { forgetSessionLoadCache } from '../store/load-cache.mjs';
 import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs';
 import { cancelNativeTasks } from '../../tools/lib/native-spawn-client.mjs';
+import { forgetSideQuestion } from '../side-question-store.mjs';
 
 /**
  * Close a session. Plants a `closed=true` tombstone on disk with a bumped
@@ -66,7 +67,10 @@ export function closeSession(id, reason = 'manual', opts = {}) {
   //    it once disk generation moves past that. Without this bump the late
   //    write could silently overwrite the session after the user resumes
   //    it back (BL: burned-session late-save clobber).
-  const newGen = tombstone ? markSessionClosed(id, reason) : bumpSessionGeneration(id, reason);
+  const outcome = { absent: false };
+  const newGen = tombstone
+    ? markSessionClosed(id, reason, { outcome })
+    : bumpSessionGeneration(id, reason, { outcome });
   // Durable lifecycle barrier check. ANY nonnumeric result means the barrier
   // is not on disk — a write failure, a liveness/ownership veto, a contended
   // commit lock, or a missing record. Only a failed write publishes a
@@ -76,7 +80,13 @@ export function closeSession(id, reason = 'manual', opts = {}) {
   // crash checkpoint while the session stays open and resumable on disk — the
   // way a failed close silently destroys a turn. Leave every runtime
   // structure intact, surface the cause, and report failure to the caller.
-  if (typeof newGen !== 'number') {
+  //
+  // The one exception is a record that was legitimately already gone (never
+  // saved, or deleted): the barrier cancelled its pending writes under the
+  // commit lock and found no copy on disk or in memory, so there is nothing
+  // a late save could clobber and nothing left open to resume. That close
+  // succeeds and tears the runtime down normally.
+  if (typeof newGen !== 'number' && outcome.absent !== true) {
     reportCloseBarrierFailure({ id, reason, tombstone, entry });
     return false;
   }
@@ -95,7 +105,7 @@ export function closeSession(id, reason = 'manual', opts = {}) {
  */
 function reportCloseBarrierFailure({ id, reason, tombstone, entry }) {
   const commitError = getSessionLifecycleCommitError(id);
-  let detail = 'no durable barrier written (veto, contended commit, or missing record)';
+  let detail = 'no durable barrier written (veto or contended commit)';
   if (commitError) {
     const code = commitError.code ? ` (${commitError.code})` : '';
     detail = `${commitError.message}${code}`;
@@ -163,6 +173,7 @@ function teardownSessionRuntime({ id, entry, reason, tombstone, newGen }) {
       /* ignore */
     }
   }
+  forgetSideQuestion(id, { cancel: true });
   closeProviderConnections(id, `session-close:${reason}`);
   // Diagnostic: one-line stderr so operators can distinguish the four close
   // pathways (request-abort / manual / idle-sweep / runner-crash). iterCount
@@ -288,6 +299,7 @@ export function unloadSessionRuntime(id, reason = 'runtime-unload') {
     if (IN_FLIGHT_STAGES.has(entry.stage)) return false;
   }
   _stopToolActivityHeartbeat(id);
+  forgetSideQuestion(id, { cancel: true });
   closeProviderConnections(id, `runtime-unload:${reason}`);
   releaseSessionReadCaches(id);
   _clearSessionRuntime(id);

package/src/runtime/agent/orchestrator/session/manager/session-crud.mjs

@@ -27,6 +27,7 @@ import { isSessionCompactionBlocked, getSessionAbortSignal, _runtimeEntries } fr
 import { mintSessionId } from './session-id.mjs';
 import { hideCompactionArchive } from '../compaction-archive-capture.mjs';
 import { writeStderrBestEffort } from '../../../../shared/best-effort-stderr.mjs';
+import { forgetSideQuestion } from '../side-question-store.mjs';
 
 /** Force-flush session metrics to disk. Used by watchdog terminal-reap (fix B). */
 export async function flushSessionMetrics(sessionId) {
@@ -91,13 +92,30 @@ export async function updateSessionManualTitle(id, title) {
   if (!session || session.closed === true) return false;
   const normalized = normalizeSessionTitle(title);
   if (!normalized) return false;
-  if (session.title === normalized && session.titleLocked === true) return false;
+  if (session.title === normalized && session.titleLocked === true && session.titleSource === 'user') return false;
   session.title = normalized;
   session.titleLocked = true;
+  session.titleSource = 'user';
   session.titleUpdatedAt = Date.now();
   await saveSessionAsync(session, { expectedGeneration: session.generation });
   return true;
 }
+// A title the model chose (session tool). Never overwrites a user title; a
+// legacy locked session without titleSource counts as user-titled. It locks
+// the title against auto-generated ones but stays replaceable by the model.
+export async function updateSessionAiTitle(id, title) {
+  const session = loadSession(id);
+  if (!session || session.closed === true) return { ok: false, reason: 'not-found' };
+  const normalized = normalizeSessionTitle(title);
+  if (!normalized) return { ok: false, reason: 'empty-title' };
+  if (session.titleLocked === true && session.titleSource !== 'ai') return { ok: false, reason: 'user-title' };
+  session.title = normalized;
+  session.titleLocked = true;
+  session.titleSource = 'ai';
+  session.titleUpdatedAt = Date.now();
+  await saveSessionAsync(session, { expectedGeneration: session.generation });
+  return { ok: true, title: normalized };
+}
 // --- Clear messages (keep system prompt + provider/model/cwd) ---
 // Token/provider accounting a cleared transcript starts from; shared by the
 // live session and the cold fork of its outgoing transcript.
@@ -262,8 +280,10 @@ export async function clearSessionMessages(sessionId, options = {}) {
 
   session.messages = keep;
   // Clear truncates the transcript wholesale; drop the provider prefix
-  // snapshot so the next send re-baselines instead of history_shrink.
+  // snapshot so the next send re-baselines instead of history_shrink, and
+  // the request a /btw side question would fork.
   delete session._providerPrefixGuardState;
+  forgetSideQuestion(sessionId);
   resetSessionBp3Environment(session);
   Object.assign(session, clearedTokenAccounting(now));
   session.compaction = {
@@ -372,9 +392,11 @@ export async function rewindSessionMessagesTo(sessionId, options = {}) {
   const removed = messages.length - start;
   session.messages = messages.slice(0, start);
   // The provider cache is keyed on the exact prefix we just truncated;
-  // the prefix-guard snapshot describes it too and must go with it.
+  // the prefix-guard snapshot and the /btw fork request describe it too and
+  // must go with it.
   session.providerState = undefined;
   delete session._providerPrefixGuardState;
+  forgetSideQuestion(sessionId);
   session.updatedAt = Date.now();
   session.lastUsedAt = Date.now();
   await saveSessionAsync(session, { expectedGeneration: session.generation });

package/src/runtime/agent/orchestrator/session/manager/session-fallback-title.mjs

@@ -0,0 +1,82 @@
+// manager/session-fallback-title.mjs
+// Durable, transcript-independent fallback title: the first usable
+// user-authored prompt, stored on `session.title` so the conversation keeps a
+// name after compaction replaces the transcript. Leaf module (no session-crud
+// import) so ask-turn-execute, compaction-runner and pre-send-compact can share it.
+import { compactSessionTitle } from '../../runtime-core/session-title.mjs';
+import { cleanSessionPreview, isSessionPreviewNoise, sessionMessageText } from '../../runtime-core/session-text.mjs';
+import { IMPORTED_MESSAGE_SOURCE } from '../imported-message.mjs';
+import { isActualUserInstructionMessage } from '../compact/messages.mjs';
+
+const UNTITLED_PLACEHOLDER = /^untitled(?:\s+session)?$/i;
+const MEDIA_PLACEHOLDER = /^\[(?:image|video|file)\]$/i;
+// Attachment envelopes carry payloads, not prose: closed blocks, then a block
+// that lost its closing tag (the rest of the text is payload), then bare
+// self-closing tags. Stripped before truncation so a large payload cannot
+// crowd the prompt out of the bounded source.
+const ATTACHMENT_TAGS = 'file|attachment|document|image|video|pdf';
+const ATTACHMENT_BLOCK = new RegExp(`<(${ATTACHMENT_TAGS})\\b[^>]*>[\\s\\S]*?<\\/\\1\\s*>`, 'gi');
+const ATTACHMENT_UNTERMINATED = new RegExp(`<(?:${ATTACHMENT_TAGS})\\b[^>]*>[\\s\\S]*$`, 'i');
+const ATTACHMENT_SELF_CLOSING = new RegExp(`<(?:${ATTACHMENT_TAGS})\\b[^>]*\\/>`, 'gi');
+const MEDIA_MARKER = /\[(?:Image|Video|File)(?:\s*#?\d+)?(?::[^\]\r\n]*)?\]/gi;
+
+function stripAttachmentEnvelopes(text) {
+  return text
+    .replace(ATTACHMENT_BLOCK, ' ')
+    .replace(ATTACHMENT_SELF_CLOSING, ' ')
+    .replace(ATTACHMENT_UNTERMINATED, ' ')
+    .replace(MEDIA_MARKER, ' ');
+}
+
+function isUsableTitle(title) {
+  const text = String(title || '').trim();
+  return !!text && !UNTITLED_PLACEHOLDER.test(text);
+}
+
+/** Bounded single-line title from user-authored text; '' when nothing usable. */
+export function fallbackTitleFromText(content) {
+  const raw = sessionMessageText(content);
+  if (!raw || /^\s*reference files:/i.test(raw)) return '';
+  const prose = stripAttachmentEnvelopes(raw);
+  if (isSessionPreviewNoise(prose)) return '';
+  const title = compactSessionTitle(cleanSessionPreview(prose, 4_000));
+  return isUsableTitle(title) && !MEDIA_PLACEHOLDER.test(title) ? title : '';
+}
+
+/** A turn the human typed: provenance lives in `meta` (`source` of an injected
+ *  goal/notification/compaction turn, `synthetic`), never on the message root. */
+function isHumanAuthoredTurn(message) {
+  if (message?.role !== 'user' || message.internal === true || message.synthetic === true) return false;
+  const meta = message.meta;
+  if (meta && typeof meta === 'object') {
+    if (meta.synthetic === true) return false;
+    if (meta.source && meta.source !== IMPORTED_MESSAGE_SOURCE) return false;
+  }
+  return isActualUserInstructionMessage(message);
+}
+
+/** Title from the first usable human user message of a transcript. */
+export function fallbackTitleFromMessages(messages) {
+  for (const message of Array.isArray(messages) ? messages : []) {
+    if (!isHumanAuthoredTurn(message)) continue;
+    const title = fallbackTitleFromText(message.content);
+    if (title) return title;
+  }
+  return '';
+}
+
+/** Fills `session.title` only when missing. Never touches a locked (manual/AI)
+ *  or generated title, and leaves generatedTitleStage unset so
+ *  updateSessionGeneratedTitle can still upgrade it. The caller persists. */
+export function applyFallbackSessionTitle(session, title) {
+  if (!session || !isUsableTitle(title) || isUsableTitle(session.title)) return false;
+  if (session.titleLocked === true || session.generatedTitleStage) return false;
+  session.title = title;
+  session.titleUpdatedAt = Date.now();
+  return true;
+}
+
+export function backfillFallbackSessionTitle(session, messages) {
+  if (!session || isUsableTitle(session.title)) return false;
+  return applyFallbackSessionTitle(session, fallbackTitleFromMessages(messages));
+}

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -37,8 +37,9 @@ import { getAgentRuntimeSync, warnAgentRuntimeResolveFailureOnce } from './agent
 import { ensureCodexWireSessionId, mintSessionId } from './session-id.mjs';
 import { providerCacheKey } from './provider-cache-key.mjs';
 import { buildSessionRecord, normalizeDesktopSessionMetadata, sessionOriginFields } from './session-record.mjs';
-import { refreshSessionBp3Environment } from './prompt-utils.mjs';
+import { applyPendingWorkspaceReroot, refreshSessionBp3Environment } from './prompt-utils.mjs';
 import { isWorktreeBound } from '../../../../shared/worktrees/contract.mjs';
+import { applyAgentToolExposure } from '../loop/tool-exposure-migration.mjs';
 
 // Owner liveness (attach-on-resume guard) and the durable turn-checkpoint
 // recovery it gates; re-exported so prior importers of this module stay
@@ -243,6 +244,8 @@ export function createSession(opts) {
     origin: sessionOriginFields(opts, { profile, presetObj, providerCacheOpts, surface }),
   });
   session.providerCacheOptsOverride = Boolean(resolved.providerCacheOpts);
+  // A non-native agent sends core + bridge, built from its filtered tools.
+  applyAgentToolExposure(session);
   refreshSessionBp3Environment(session, opts.cwd);
   // In-process registry + async debounced save: same-process create → load
   // reads live memory; disk flush is for cross-process / restart durability.
@@ -367,6 +370,11 @@ function resetSessionForRouteChange(id, session, previousModel, previousProvider
   session.lastContextTokensUpdatedAt = Date.now();
   session.lastContextTokensStaleAfterCompact = false;
   session.providerState = undefined;
+  // The previous route's prefix snapshot measured another prompt (model line,
+  // stripped replay); the new chain baselines on its first send.
+  delete session._providerPrefixGuardState;
+  // The new route resolves its own wire before its first request.
+  session.wireRoute = null;
   const prepared = _prepareResumeTools(session, session.preset || 'full');
   session.tools = prepared.tools;
   session.toolSpec = prepared.toolSpec;
@@ -384,6 +392,7 @@ function resetSessionForRouteChange(id, session, previousModel, previousProvider
   ]) {
     if (Array.isArray(session[key])) session[key] = filterModelEditToolNames(session[key], session.model);
   }
+  applyAgentToolExposure(session, { existing: true });
   _refreshSessionRuleVariantsForModel(session, previousModel, previousProvider);
   _forgetPreparedResume(id);
 }
@@ -436,6 +445,9 @@ export function updateSessionRoute(id, route = {}, options = {}) {
   // route and set sessionStartMetaInjected, so the ask-time refresh guard
   // skips it and an empty-session route change would otherwise keep the old
   // model line in the system prompt (model self-identity confusion).
+  // A new route starts a cold cache: a staged working-folder change re-roots
+  // the prompt now instead of riding a notice.
+  if (routeChanged) applyPendingWorkspaceReroot(session);
   refreshSessionBp3Environment(session, session.cwd);
   session.updatedAt = Date.now();
   setLiveSession(session);
@@ -513,7 +525,12 @@ function _refreshResumedTools(session, sessionId, preset) {
   // Keep the persisted tool mode in sync on resume (see createSession note).
   session.toolSpec = prepared.toolSpec;
   session.tools = prepared.tools;
-  const missing = oldTools.filter((t) => !session.tools.find((n) => n.name === t.name));
+  applyAgentToolExposure(session, { existing: true });
+  // A bridge surface keeps the rest of its tools in the catalog.
+  const available = new Set(
+    [...session.tools, ...(session.deferredToolCatalog || [])].map((tool) => tool?.name).filter(Boolean)
+  );
+  const missing = oldTools.filter((t) => !available.has(t.name));
   if (missing.length) {
     process.stderr.write(
       `[session] Warning: ${missing.length} tools no longer available: ${missing.map((t) => t.name).join(', ')}\n`

package/src/runtime/agent/orchestrator/session/manager/session-record.mjs

@@ -109,6 +109,9 @@ export function buildSessionRecord({ opts, route, presetObj, surface, prompt, me
     codexWireSessionId: providerName === 'openai-oauth' ? mintUuidV7() : null,
     provider: providerName,
     model: modelName,
+    // Resolved and pinned before the first request (wire-route.mjs). null —
+    // not absent — marks a session created under the per-model wire table.
+    wireRoute: null,
     messages,
     contextWindow: contextMeta.contextWindow,
     rawContextWindow: contextMeta.rawContextWindow,

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -48,6 +48,9 @@ const SESSION_ROUTE_TOOL_RANK = new Map(
 const FILESYSTEM_TOOL_NAMES = new Set(['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'edit', 'apply_patch']);
 const READONLY_FS_TOOL_NAMES = new Set(['code_graph', 'find', 'glob', 'list', 'grep', 'read']);
 
+// Lead-only control tools: never part of a worker/sub-agent session surface.
+export const AGENT_WORKER_DENIED_TOOLS = Object.freeze(new Set(['agent', 'ask_user', 'session']));
+
 export function finalizeSessionToolList(
   tools,
   { schemaAllowedTools = null, disallowedTools = null, ownerIsAgent = false } = {}
@@ -64,7 +67,7 @@ export function finalizeSessionToolList(
     out = out.filter((t) => !denySet.has(String(t?.name || '').toLowerCase()));
   }
   if (ownerIsAgent) {
-    out = out.filter((t) => String(t?.name || '').toLowerCase() !== 'agent');
+    out = out.filter((t) => !AGENT_WORKER_DENIED_TOOLS.has(String(t?.name || '').toLowerCase()));
     out = orderSessionTools(out);
   }
   return out;

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -123,9 +123,10 @@ export {
   updateSessionStatus,
   updateSessionGeneratedTitle,
   updateSessionManualTitle,
+  updateSessionAiTitle,
   flushSessionMetrics,
 } from './manager/session-crud.mjs';
-export { deleteSession, listOwnedAgentSessionIds } from './store.mjs';
+export { deleteSession, listOwnedAgentSessionIds, fenceSessionWrites } from './store.mjs';
 // Read-only parsed-session access (desktop pane peek): no resume, no
 // ownership, no liveness side effects.
 export { loadSession } from './store.mjs';

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -31,6 +31,8 @@ import { bumpUsageMetricsEpoch } from './manager/usage-metrics.mjs';
 import { resetReadStateAfterCompaction } from './read-dedup.mjs';
 import { scheduleCompactionArchive, stampCompactionMessageIds } from './compaction-archive-capture.mjs';
 import { writeStderrBestEffort } from '../../../shared/best-effort-stderr.mjs';
+import { applyPendingWorkspaceReroot } from './manager/prompt-utils.mjs';
+import { backfillFallbackSessionTitle } from './manager/session-fallback-title.mjs';
 import {
   acknowledgePendingGoalReminder,
   markPendingGoalReminder,
@@ -378,6 +380,7 @@ function adoptCompactedTranscript(ctx, run) {
   const { state } = ctx;
   const { messages, sessionRef, sessionId, opts } = state;
   const replaced = messages.slice();
+  if (sessionRef) backfillFallbackSessionTitle(sessionRef, replaced);
   messages.length = 0;
   messages.push(...run.compacted);
   // Display-only archive of the dropped conversation; the projection and the
@@ -388,6 +391,9 @@ function adoptCompactedTranscript(ctx, run) {
   ctx.droppedMessages = archived?.dropped ?? 0;
   ctx.droppedIdentities = archived?.identities ?? null;
   acknowledgeGoalReminder(sessionRef, run);
+  // The compacted transcript breaks the cache anyway: a staged working-folder
+  // change re-roots the system prompt now and needs no notice any more.
+  if (sessionRef) applyPendingWorkspaceReroot(sessionRef, messages);
   resetReadStateAfterCompaction(sessionId);
   // Cross-turn receipts reference tool results that compaction just removed
   // from context; a stub for them would point at nothing. Clear in place so

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -44,6 +44,7 @@ import { agentContextOverflowError } from './loop/context-overflow.mjs';
 import { estimateMessagesTokensSafe } from './loop/compact-debug.mjs';
 import { isOutputLimitStopReason } from './loop/termination.mjs';
 import { instrumentSendCallbacks } from './send-instrumentation.mjs';
+import { rejectedToolSchema } from './tool-schema-rejection.mjs';
 
 function normalizedIncompleteUsage(raw) {
   if (!raw || typeof raw !== 'object') return undefined;
@@ -405,6 +406,7 @@ async function recoverFromSendError(sendErr, state) {
     transportRetriesUsed = 0,
     imageStripUsed = false,
     thinkingReplayRepairUsed = false,
+    toolSchemaDropUsed = false,
     relayWitness,
   } = state;
   const outcome = readStreamOutcome(sendErr, relayWitness);
@@ -446,6 +448,17 @@ async function recoverFromSendError(sendErr, state) {
   ) {
     return retryTransport(sendErr, state);
   }
+  // A 400 naming one tool's input schema: the session drops that tool (with
+  // the notice) and the turn is replayed once without it. Nothing was
+  // generated, and the same body would fail every later turn.
+  if (toolSchemaDropUsed !== true) {
+    const exclusion = rejectedToolSchema(sendErr, state);
+    if (exclusion) {
+      logLoop(`[loop] provider rejected tool schema "${exclusion.name}" (${loopTag(state)}); dropping it and replaying once`);
+      traceLoop(state, 'tool_schema_drop', { tool: exclusion.name });
+      return { action: 'retry_tool_schema_drop', exclusion };
+    }
+  }
   // Anthropic replay-shape refusal: the latest assistant turn carries
   // thinking blocks the API will not accept back (a thinking run it did not
   // produce, or an empty text block). This is deterministic — the same body