mixdog 1.2.2 → 1.2.3

package/src/session-runtime/internal-tool-executor/workspace-tools.mjs

@@ -3,26 +3,35 @@
 import { statSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { listProjects } from '../../runtime/shared/projects.mjs';
+import { applySessionSidebarChange } from '../../runtime/shared/session-sidebar-host.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 
+const USER_TITLE_ERROR = 'session: the user already titled this session; the title was not changed';
+
 export function createWorkspaceToolHandlers({
   rt,
   goalRuntime,
   agentTool,
   notifyFnForSession,
-  applyResolvedCwd,
   getWorkspaceApi = () => null,
+  getSessionManager = () => null,
+  getLifecycleApi = () => null,
 }) {
   // The Lead's own worktree, on the user's request: the same authority the
   // branch chip menu drives, tolerating the calling turn but nothing else
   // running (workers, background shells).
-  const worktreeAction = async (action, args, callerCtx) => {
-    const workspace = getWorkspaceApi();
-    if (!workspace) throw new Error(`cwd: ${action} is unavailable in this runtime`);
+  const assertLead = (action, callerCtx) => {
     const callerSessionId = callerCtx?.callerSessionId || rt.session?.id || null;
     if (!rt.session?.id || callerSessionId !== rt.session.id) {
-      throw new Error(`cwd: ${action} belongs to the Lead session`);
+      throw new Error(`session: ${action} belongs to the Lead session`);
     }
+    return rt.session.id;
+  };
+
+  const worktreeAction = async (action, args, callerCtx) => {
+    const workspace = getWorkspaceApi();
+    if (!workspace) throw new Error(`session: ${action} is unavailable in this runtime`);
+    assertLead(action, callerCtx);
     const result =
       action === 'merge-worktree'
         ? await workspace.mergeWorkspace({ confirmed: true }, { ownTurn: true })
@@ -35,12 +44,95 @@ export function createWorkspaceToolHandlers({
   };
 
   const WORKTREE_ACTIONS = new Set(['merge-worktree', 'remove-worktree', 'list-worktrees', 'prune-worktrees']);
+  const SIDEBAR_ACTIONS = new Set(['favorite', 'archive']);
 
-  const cwd = async (args, { callerCtx, callerCwd }) => {
-    const action = clean(args?.action || (args?.path ? 'set' : 'get')).toLowerCase();
+  // Sidebar flags only (the desktop's favorite/archive metadata).
+  const sidebarAction = async (action, args, callerCtx) => {
+    const sessionId = assertLead(action, callerCtx);
+    if (typeof args?.value !== 'boolean') throw new Error(`session: value (boolean) is required for action=${action}`);
+    const change = action === 'favorite' ? { favorite: args.value } : { archived: args.value };
+    try {
+      await applySessionSidebarChange(sessionId, change);
+    } catch (error) {
+      throw new Error(`session: ${action} failed (${error?.message || error})`);
+    }
+    return JSON.stringify({ action, sessionId, ...change }, null, 2);
+  };
+
+  const session = async (args, { callerCtx, callerCwd }) => {
+    const action = clean(args?.action || (args?.path ? 'set-project' : 'status')).toLowerCase();
     if (WORKTREE_ACTIONS.has(action)) return worktreeAction(action, args, callerCtx);
+    if (SIDEBAR_ACTIONS.has(action)) return sidebarAction(action, args, callerCtx);
     let currentCwd = callerCwd;
-    if (action === 'list') {
+    if (action === 'status' || action === 'list-projects' || action === 'set-project') assertLead(action, callerCtx);
+    if (action === 'rename') {
+      const sessionId = assertLead(action, callerCtx);
+      if (rt.config?.aiSessionTitles === false) throw new Error('session: AI session titles are disabled in settings');
+      const title = clean(args?.title);
+      if (!title) throw new Error('session: title is required for action=rename');
+      const result = await getSessionManager()?.updateSessionAiTitle(sessionId, title);
+      if (!result?.ok) {
+        throw new Error(
+          result?.reason === 'user-title'
+            ? USER_TITLE_ERROR
+            : `session: rename failed (${result?.reason || 'unavailable'})`
+        );
+      }
+      // Mirror the store's truth onto the live session, never the AI title
+      // itself: a manual rename that landed while the save was awaited wins.
+      const stored = getSessionManager()?.getSession?.(sessionId);
+      if (stored && rt.session?.id === sessionId && stored !== rt.session) {
+        rt.session.title = stored.title;
+        rt.session.titleLocked = stored.titleLocked;
+        rt.session.titleSource = stored.titleSource;
+        rt.session.titleUpdatedAt = stored.titleUpdatedAt;
+      }
+      if (stored && stored.titleSource === 'user') throw new Error(USER_TITLE_ERROR);
+      return JSON.stringify({ action, sessionId, title: result.title }, null, 2);
+    }
+    if (action === 'compact') {
+      const sessionId = assertLead(action, callerCtx);
+      rt.pendingCompactSessionIds ??= new Set();
+      rt.pendingCompactSessionIds.add(sessionId);
+      return JSON.stringify(
+        { action, sessionId, scheduled: true, note: 'Compaction runs right after the current turn finishes.' },
+        null,
+        2
+      );
+    }
+    if (action === 'fork') {
+      const sessionId = assertLead(action, callerCtx);
+      const lifecycle = getLifecycleApi();
+      if (typeof lifecycle?.inheritToNewSession !== 'function') {
+        throw new Error('session: fork is unavailable in this runtime');
+      }
+      const result = await lifecycle.inheritToNewSession(sessionId, {
+        compact: args?.compact === true,
+        titleSuffix: ' (Fork)',
+      });
+      return JSON.stringify(
+        { action, sourceSessionId: sessionId, sessionId: result.sessionId, compacted: result.compacted === true },
+        null,
+        2
+      );
+    }
+    if (action === 'status') {
+      const current = rt.session;
+      return JSON.stringify(
+        {
+          sessionId: callerCtx?.callerSessionId || current?.id || null,
+          title: current?.title || null,
+          titleSource: current?.titleSource || null,
+          cwd: currentCwd,
+          project: current?.workspace?.projectPath || current?.desktopSession?.projectPath || currentCwd,
+          provider: current?.provider || null,
+          model: current?.model || null,
+        },
+        null,
+        2
+      );
+    }
+    if (action === 'list-projects') {
       return JSON.stringify(
         {
           cwd: currentCwd,
@@ -50,18 +142,23 @@ export function createWorkspaceToolHandlers({
         2
       );
     }
-    if (action === 'set') {
+    if (action === 'set-project') {
       const rawPath = clean(args?.path);
-      if (!rawPath) throw new Error('cwd: path is required for action=set');
+      if (!rawPath) throw new Error('session: path is required for action=set-project');
       const nextCwd = resolve(callerCwd || process.cwd(), rawPath);
       const stat = statSync(nextCwd);
-      if (!stat.isDirectory()) throw new Error(`cwd: not a directory: ${nextCwd}`);
-      currentCwd =
-        typeof callerCtx?.setCallerCwd === 'function'
-          ? clean(await callerCtx.setCallerCwd(nextCwd)) || nextCwd
-          : applyResolvedCwd(nextCwd, { persistProjectSelection: true });
-    } else if (action !== 'get') {
-      throw new Error(`cwd: unknown action "${action}"`);
+      if (!stat.isDirectory()) throw new Error(`session: not a directory: ${nextCwd}`);
+      // The Lead's own call: the runtime's Project switch authority admits it
+      // during the calling turn and refuses inside a managed worktree.
+      if (typeof callerCtx?.setCallerCwd === 'function') {
+        currentCwd = clean(await callerCtx.setCallerCwd(nextCwd)) || nextCwd;
+      } else {
+        const workspace = getWorkspaceApi();
+        if (!workspace) throw new Error('session: set-project is unavailable in this runtime');
+        currentCwd = await workspace.switchProject(nextCwd, { ownTurn: true });
+      }
+    } else {
+      throw new Error(`session: unknown action "${action}"`);
     }
     return JSON.stringify(
       {
@@ -74,7 +171,7 @@ export function createWorkspaceToolHandlers({
   };
 
   return {
-    cwd,
+    session,
     goal: async (args, { name, callerCtx }) =>
       await goalRuntime.executeTool(name, args || {}, {
         callerSessionId: callerCtx?.callerSessionId || rt.session?.id || rt.reservedSessionId || null,

package/src/session-runtime/internal-tool-executor.mjs

@@ -6,6 +6,7 @@
  * to channel tools.
  */
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { createAskUserToolHandlers } from './internal-tool-executor/ask-user-tool.mjs';
 import { createBridgeToolHandlers } from './internal-tool-executor/bridge-tools.mjs';
 import { createFeatureToolHandlers } from './internal-tool-executor/feature-tools.mjs';
 import { createKnowledgeToolHandlers } from './internal-tool-executor/knowledge-tools.mjs';
@@ -29,12 +30,14 @@ export function createInternalToolExecutor({
   runNativeWebSearch,
   activeToolSurface,
   mcpStatus,
-  applyResolvedCwd,
   skillToolContent,
   getWorkspaceApi,
+  getSessionManager,
+  getLifecycleApi,
 }) {
   const handlers = {
     ...createBridgeToolHandlers({ rt }),
+    ...createAskUserToolHandlers({ rt }),
     ...createFeatureToolHandlers({ rt, setupTool, officeToolsEnabled, mediaToolEnabled, tidyToolEnabled }),
     ...createKnowledgeToolHandlers({
       rt,
@@ -52,8 +55,9 @@ export function createInternalToolExecutor({
       goalRuntime,
       agentTool,
       notifyFnForSession,
-      applyResolvedCwd,
       getWorkspaceApi,
+      getSessionManager,
+      getLifecycleApi,
     }),
   };
 

package/src/session-runtime/lifecycle/cold-heir.mjs

@@ -0,0 +1,188 @@
+/**
+ * src/session-runtime/lifecycle/cold-heir.mjs - the record of a heir that is
+ * NOT opened: a sibling of the source session on the same route, cwd and
+ * Project, persisted to the store and left cold for a later resume.
+ *
+ * The heir starts from the source's own record (same provider/model, tool
+ * surface, system layer, desktop classification) the way /clear's cold fork
+ * does, minus everything that belongs to the source alone: its conversation,
+ * in-flight turn, provider continuation, usage readings, title, worktree and
+ * ownership/lineage links — the heir is a root Lead of its own, linked to the
+ * source only through `inheritedFromSessionId`.
+ */
+import {
+  ensureCodexWireSessionId,
+  mintSessionId,
+} from '../../runtime/agent/orchestrator/session/manager/session-id.mjs';
+import {
+  refreshSessionWorkspaceContext,
+  resetSessionBp3Environment,
+} from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
+import { buildWorkspacePromptContext } from '../../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
+import {
+  invalidateContextUsageSnapshot,
+  invalidateProviderContextBaseline,
+} from '../../runtime/agent/orchestrator/session/loop/compact-policy.mjs';
+import { deleteSession, evictLiveSession, saveSessionAsync } from '../../runtime/agent/orchestrator/session/store.mjs';
+import { projectWorkspace } from '../../runtime/shared/worktrees/contract.mjs';
+import { writeStderrBestEffort } from '../../runtime/shared/best-effort-stderr.mjs';
+import { replacementSessionCwd } from '../workspace/workspace-state.mjs';
+
+// Per-turn and per-process state of the source: the in-flight turn, its
+// transient serializer-stripped aliases, and one-shot pending work.
+const SOURCE_RUNTIME_FIELDS = [
+  'liveTurnMessages',
+  'toolApprovalHook',
+  '_providerPrefixGuardState',
+  'activeTurnCheckpoint',
+  'remoteAttached',
+  'deferredInitialRefreshPending',
+  'pendingGoalReminder',
+  'goalReminderRevision',
+  'pendingCacheBreakIntent',
+  'contextPressureUnanchoredAfterRestart',
+  'contextPressureUnanchoredReason',
+  // Store read-back projections of the SOURCE file.
+  'storageMtimeMs',
+  'storageSize',
+];
+
+// Identity the source owns: its title (the carry decides the heir's), import
+// provenance (a dedupe key), its own inheritance link (the carry sets the
+// heir's), Codex wire identity, lifecycle provenance (a 'cli-resume' detach
+// hides a row from Recent), and every ownership / lineage / visibility link —
+// a self-link copied from a recovered root Lead would point at the source and
+// classify the heir as an agent-only child.
+const SOURCE_IDENTITY_FIELDS = [
+  'title',
+  'titleLocked',
+  'titleSource',
+  'titleUpdatedAt',
+  'importOrigin',
+  'inheritedFromSessionId',
+  'codexWireSessionId',
+  'detachedReason',
+  'sessionVisibility',
+  'task_id',
+  'taskId',
+];
+
+// The heir is an ordinary, user-visible root Lead owned by nobody but itself,
+// whatever the source's ownership history (same identity a new Lead session
+// or an imported conversation gets).
+const ROOT_LEAD_IDENTITY = Object.freeze({
+  owner: 'cli',
+  agent: 'lead',
+  lane: 'cli',
+  sourceType: 'lead',
+  sourceName: 'main',
+  parentSessionId: null,
+  ownerSessionId: null,
+  visibility: null,
+  agentTag: null,
+  taskType: null,
+  permissionMode: null,
+  scopeKey: null,
+});
+
+/**
+ * The source as of its last committed turn. Mid-turn, `messages` already
+ * holds the in-flight user prompt (pre-committed before the provider call)
+ * while `liveTurnMessages` holds the turn's working transcript; the prompt is
+ * not part of the conversation yet, so it does not travel. Never mutates.
+ */
+export function committedSource(source) {
+  const messages = Array.isArray(source?.messages) ? source.messages : [];
+  const live = source?.liveTurnMessages;
+  if (!Array.isArray(live) || live === messages || messages.at(-1)?.role !== 'user') return source;
+  return { ...source, messages: messages.slice(0, -1) };
+}
+
+/** A fresh, empty heir record of `source` — system layer only, nothing saved. */
+export function buildColdHeir(source, now = Date.now()) {
+  const heir = {
+    ...source,
+    id: mintSessionId(),
+    // The heir runs on the very route that built these blocks; copies, so
+    // the heir never shares a message object with the source.
+    messages: structuredClone((source.messages || []).filter((message) => message?.role === 'system')),
+    closed: false,
+    status: 'idle',
+    generation: 0,
+    createdAt: now,
+    updatedAt: now,
+    lastUsedAt: now,
+    lastHeartbeatAt: null,
+    mcpPid: process.pid,
+    clientHostPid: null,
+    providerState: undefined,
+    totalInputTokens: 0,
+    totalOutputTokens: 0,
+    totalToolCalls: 0,
+    reasoningUsage: null,
+    totalCachedReadTokens: 0,
+    totalCacheWriteTokens: 0,
+    tokensCumulative: 0,
+    lastInputTokens: 0,
+    lastOutputTokens: 0,
+    lastCachedReadTokens: 0,
+    lastCacheWriteTokens: 0,
+    lastContextTokens: 0,
+    lastContextTokensUpdatedAt: now,
+    lastContextTokensStaleAfterCompact: false,
+    ...ROOT_LEAD_IDENTITY,
+  };
+  for (const key of [...SOURCE_RUNTIME_FIELDS, ...SOURCE_IDENTITY_FIELDS]) delete heir[key];
+  ensureCodexWireSessionId(heir);
+  // The compaction archive sidecar is keyed by the source id.
+  if (heir.compaction?.archive) {
+    heir.compaction = { ...heir.compaction };
+    delete heir.compaction.archive;
+  }
+  // A worktree belongs to the session that created it: like /new, the heir
+  // starts in the Project folder instead of sharing (and on delete, removing)
+  // the source's worktree.
+  const projectFolder = replacementSessionCwd(source);
+  if (projectFolder) {
+    heir.cwd = projectFolder;
+    heir.workspace = projectWorkspace({ projectPath: projectFolder });
+  }
+  // The source's staged working-folder change (its prompt still rooted at an
+  // earlier folder) is the source's own: the heir's prompt is built for the
+  // folder it actually starts in. Project memory follows the Project, which a
+  // worktree shares, so the source's current memory slice carries over.
+  const pending = source.workspaceReroot;
+  delete heir.workspaceReroot;
+  if ((projectFolder || pending) && heir.cwd) {
+    refreshSessionWorkspaceContext(heir, {
+      cwd: heir.cwd,
+      ...buildWorkspacePromptContext(heir, heir.cwd),
+      coreMemoryContext: pending?.target?.coreMemoryContext,
+    });
+  }
+  invalidateContextUsageSnapshot(heir);
+  invalidateProviderContextBaseline(heir);
+  // The `# Session` block names the session it was stamped for; the heir's
+  // first turn stamps its own.
+  resetSessionBp3Environment(heir);
+  return heir;
+}
+
+/**
+ * Persist the heir durably, then drop it from the same-process live cache:
+ * it is a cold session until someone resumes it. A failed save removes the
+ * half-made record and rejects.
+ */
+export async function persistColdHeir(heir) {
+  try {
+    await saveSessionAsync(heir);
+  } catch (error) {
+    try {
+      deleteSession(heir.id);
+    } catch (cleanupError) {
+      writeStderrBestEffort(`[inherit] cleanup of ${heir.id} failed: ${cleanupError?.message || cleanupError}\n`);
+    }
+    throw error;
+  }
+  evictLiveSession(heir.id);
+}

package/src/session-runtime/lifecycle/inheritance.mjs

@@ -1,7 +1,8 @@
 /**
  * src/session-runtime/lifecycle/inheritance.mjs - session inheritance
  * (/inherit): fit preflight and the carry of another session's conversation
- * into the freshly created heir.
+ * into the freshly created heir — the live one (inheritFrom) or a cold sibling
+ * persisted without switching (inheritToNewSession), through one carry core.
  */
 import { hasUserConversationMessage } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
 import { stripEffortConfiguration } from '../../runtime/agent/orchestrator/providers/effort-configuration.mjs';
@@ -14,6 +15,7 @@ import {
   inheritanceRouteTarget,
 } from '../inheritance-fit.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { buildColdHeir, committedSource, persistColdHeir } from './cold-heir.mjs';
 
 export function createInheritance(deps, { compactConversation, saveSession }) {
   const { getSession, getRoute, mgr, createCurrentSession, invalidateContextStatusCache, getReservedSessionId } = deps;
@@ -143,6 +145,44 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
     };
   }
 
+  /**
+   * The ONE carry every inheritance path shares: measure the source's
+   * conversation on the heir's scale, compact it for the heir when asked to
+   * or when it cannot fit, and append it to the (empty) heir with its
+   * inheritance boundary. Refusals throw before the heir is touched; the
+   * source is never mutated.
+   */
+  async function carryConversation(source, target, { compact = false } = {}) {
+    // System blocks belong to the session that BUILT them: the target's own
+    // prompt was composed for the current model, tool surface, and workflow.
+    // Only the conversation itself travels.
+    let carried = inheritableMessages(source.messages);
+    if (!hasUserConversationMessage(carried)) {
+      throw new Error('inheritFrom: the source session has no conversation to carry');
+    }
+    // Decide BEFORE anything moves, on the heir's own scale. This is the
+    // same function inheritancePreflight() answers with, so the surface that
+    // offered the carry and the runtime that performs it cannot disagree —
+    // and a refusal no longer has to unwind a half-filled transcript.
+    const fit = inheritanceFit(carried, target);
+    let compacted = false;
+    // compact:true summarizes even a conversation that fits; otherwise only
+    // one that cannot fit is compacted.
+    if (compact || (fit.known && !fit.fits)) {
+      const next = await fitConversationForHeir(source, target, carried, fit, { required: compact });
+      compacted = next !== carried;
+      carried = next;
+    }
+    target.messages.push(
+      ...stripEffortConfiguration(inheritedCompatReplayMessages(structuredClone(carried), source.provider))
+    );
+    target.inheritedFromSessionId = source.id;
+    target.updatedAt = Date.now();
+    recordInheritanceBoundary(target, source);
+    if (!clean(target.title) && clean(source.title)) target.title = source.title;
+    return { messages: carried.length, compacted };
+  }
+
   /**
    * Session inheritance (/inherit): carry another session's conversation
    * into THIS freshly created session, so the transcript continues under a
@@ -174,41 +214,45 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
     }
     const source = mgr.getSession(id);
     if (!source) throw new Error(`inheritFrom: session ${id} was not found`);
-    // System blocks belong to the session that BUILT them: the target's own
-    // prompt was composed for the current model, tool surface, and workflow.
-    // Only the conversation itself travels.
-    let carried = inheritableMessages(source.messages);
-    if (!hasUserConversationMessage(carried)) {
-      throw new Error('inheritFrom: the source session has no conversation to carry');
-    }
-    // Decide BEFORE anything moves, on the heir's own scale. This is the
-    // same function inheritancePreflight() answers with, so the surface that
-    // offered the carry and the runtime that performs it cannot disagree —
-    // and a refusal no longer has to unwind a half-filled transcript.
-    const fit = inheritanceFit(carried, target);
-    // compact:true summarizes even a conversation that fits; otherwise only
-    // one that cannot fit is compacted.
-    if (compact || (fit.known && !fit.fits)) {
-      carried = await fitConversationForHeir(source, target, carried, fit, { required: compact });
-    }
-    target.messages.push(
-      ...stripEffortConfiguration(inheritedCompatReplayMessages(structuredClone(carried), source.provider))
-    );
+    const { messages } = await carryConversation(source, target, { compact });
     invalidateContextStatusCache();
-    target.inheritedFromSessionId = source.id;
-    target.updatedAt = Date.now();
-    recordInheritanceBoundary(target, source);
-    if (!clean(target.title) && clean(source.title)) target.title = source.title;
     saveSession(target, { immediate: true });
     invalidateContextStatusCache();
     return {
       sessionId: target.id,
       sourceSessionId: source.id,
-      messages: carried.length,
+      messages,
       provider: target.provider,
       model: target.model,
     };
   }
 
-  return { inheritancePreflight, inheritFrom };
+  /**
+   * Inheritance WITHOUT switching: carry a session's conversation (normally
+   * the live one, possibly mid-turn) into a NEW session on the same route,
+   * cwd and Project, persisted cold for a later resume. The live session
+   * stays the current one and is never mutated; only its committed turns
+   * travel. Same carry, compaction and refusals as inheritFrom().
+   */
+  async function inheritToNewSession(sourceSessionId, { compact = false, titleSuffix = '' } = {}) {
+    const live = getSession();
+    const id = clean(sourceSessionId) || clean(live?.id);
+    if (!id) throw new TypeError('inheritToNewSession: source session id is required');
+    const stored = id === clean(live?.id) ? live : mgr.getSession(id);
+    if (!stored) throw new Error(`inheritFrom: session ${id} was not found`);
+    const source = committedSource(stored);
+    const heir = buildColdHeir(source);
+    const { messages, compacted } = await carryConversation(source, heir, { compact: compact === true });
+    // A suffixed title ("… (Fork)") tells the copy apart in session lists;
+    // locked as a model title so auto-titling keeps it, renames still win.
+    if (titleSuffix && clean(heir.title)) {
+      heir.title = `${clean(heir.title)}${titleSuffix}`;
+      heir.titleLocked = true;
+      heir.titleSource = 'ai';
+    }
+    await persistColdHeir(heir);
+    return { sessionId: heir.id, messages, compacted };
+  }
+
+  return { inheritancePreflight, inheritFrom, inheritToNewSession };
 }

package/src/session-runtime/lifecycle/session-catalog.mjs

@@ -15,6 +15,9 @@ import {
   clean,
 } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 
+import { isRealTurnMessage } from '../../runtime/agent/orchestrator/session/compact/user-message-kind.mjs';
+import { realTurnCount as realTurnCountOf } from '../../runtime/agent/orchestrator/session/store-summary-fields.mjs';
+
 const VISIBLE_OWNERS = ['cli', 'user', 'mixdog'];
 
 function isLeadShaped(s, owner, sourceType) {
@@ -39,7 +42,9 @@ function previewOf(s) {
   const rawPreview = s.preview || '';
   let preview = isSessionPreviewNoise(rawPreview) ? '' : cleanSessionPreview(rawPreview);
   let messageCount = Math.max(0, Number(s.messageCount) || 0);
+  let realTurnCount = realTurnCountOf(s);
   if (!preview && Array.isArray(s.messages)) {
+    realTurnCount = s.messages.filter(isRealTurnMessage).length;
     const msgs = s.messages;
     const userPreviews = msgs
       .filter((m) => m && m.role === 'user')
@@ -50,10 +55,10 @@ function previewOf(s) {
     preview = userPreviews[0] || '';
     messageCount = msgs.filter((m) => m && (m.role === 'user' || m.role === 'assistant')).length;
   }
-  return { preview, messageCount };
+  return { preview, messageCount, realTurnCount };
 }
 
-function leadSessionRow(s, heartbeatMtimes) {
+export function leadSessionRow(s, heartbeatMtimes) {
   // Durable visibility is the catalog boundary. Apply it before the legacy
   // lead-shape heuristics so an explicitly agent-only child cannot leak just
   // because its owner field looks ordinary.
@@ -66,10 +71,14 @@ function leadSessionRow(s, heartbeatMtimes) {
   // One-shot `mixdog exec` runs are never resumable conversations.
   if (sourceType === 'exec') return null;
   if (!isLeadShaped(s, owner, sourceType)) return null;
-  const { preview, messageCount } = previewOf(s);
+  const { preview, messageCount, realTurnCount } = previewOf(s);
   if (!preview && messageCount === 0) return null;
   return {
     id: s.id,
+    // Durable provenance the desktop uses to tell a real conversation from
+    // resume scratch or synthetic-only rows when no title source survives.
+    ...(realTurnCount === null ? {} : { realTurnCount }),
+    ...(s.detachedReason ? { detachedReason: s.detachedReason } : {}),
     updatedAt: s.updatedAt,
     // Conversation-activity timestamp for Recent ordering. Without this the
     // desktop falls back to updatedAt, which detach/resume bookkeeping

package/src/session-runtime/lifecycle/session-switch/resume.mjs

@@ -13,6 +13,8 @@ import { isScratchConversation } from '../shared.mjs';
 import { compactionArchiveRange } from '../../../runtime/agent/orchestrator/session/compaction-archive.mjs';
 import { stampCompactionMessageIds } from '../../../runtime/agent/orchestrator/session/compaction-archive-capture.mjs';
 import { boundWorkspaceCwd, restoreWorkspaceAfterResume } from '../../workspace/workspace-state.mjs';
+import { toolExposureMigrationNeeded } from '../../../runtime/agent/orchestrator/runtime-core/tool-exposure.mjs';
+import { markToolSurfaceMigrated } from '../../../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
 
 export function resolveResumeCwd(session, currentCwd) {
   // A worktree-bound Lead resumes in its worktree whatever its desktop class;
@@ -61,10 +63,14 @@ export function createSessionResume(deps, { ingestSessionIntoMemory, closeSurfac
   } = deps;
 
   function restoreResumedToolSurface(target, targetRoute) {
+    // A surface persisted with another tool exposure (e.g. a pre-bridge
+    // fixed canonical surface) migrates here; legacy selections never widen it.
+    const migrating = toolExposureMigrationNeeded(target, targetRoute.provider);
     applyDeferredToolSurface(target, deferredSurfaceModeForLead(getMode()), getStandaloneTools(), {
       provider: targetRoute.provider,
       model: targetRoute.model,
     });
+    if (migrating) markToolSurfaceMigrated(target);
   }
 
   // The resumed session's OWN effort wins. resolveRoute always returns an