mixdog 1.2.2 → 1.2.4

package/src/session-runtime/setup-tool/executor.mjs

@@ -92,10 +92,12 @@ function routeInput(source) {
   if (clean(source.model)) next.model = clean(source.model);
   if (clean(source.effort)) next.effort = clean(source.effort);
   if (typeof source.fast === 'boolean') next.fast = source.fast;
+  if (typeof source.autoEffort === 'boolean') next.autoEffort = source.autoEffort;
   if (Object.hasOwn(source, 'modelParameters')) next.modelParameters = { ...source.modelParameters };
   if (Object.hasOwn(source, 'contextPercent')) next.contextPercent = source.contextPercent;
   if (Object.hasOwn(source, 'contextTokens')) next.contextTokens = source.contextTokens;
   if (Object.hasOwn(source, 'disabled')) next.disabled = source.disabled;
+  if (Object.hasOwn(source, 'fallbacks')) next.fallbacks = source.fallbacks.map(routeInput);
   return next;
 }
 
@@ -118,6 +120,7 @@ function publicProviderRows(setup) {
     ...extra,
   });
   return {
+    ...(setup?.managedByClient === true ? { managedByClient: true, unavailable: setup.unavailable === true } : {}),
     pendingSecrets: setup?.pendingSecrets === true,
     api: (setup?.api || []).map((row) =>
       pick(row, {
@@ -141,6 +144,37 @@ function publicProviderRows(setup) {
   };
 }
 
+/** Minimal provider rows for the model: only providers with a credential (or
+ *  one needing re-authentication), counts instead of account rosters. Without
+ *  `accountCount` (desktop-owned accounts) no counts are reported. */
+function configuredProviderRows(rows, accountCount) {
+  const providers = [];
+  let notConfigured = 0;
+  for (const [kind, list] of [
+    ['api', rows.api],
+    ['oauth', rows.oauth],
+    ['local', rows.local],
+  ]) {
+    for (const row of list) {
+      if (!row.authenticated && !row.reauthRequired) {
+        notConfigured += 1;
+        continue;
+      }
+      let accounts = {};
+      if (kind === 'oauth' && accountCount) accounts = { accounts: row.authenticated ? accountCount(row.id) : 0 };
+      providers.push({
+        id: row.id,
+        kind,
+        authenticated: row.authenticated,
+        status: row.status,
+        ...(row.reauthRequired ? { reauthRequired: true } : {}),
+        ...accounts,
+      });
+    }
+  }
+  return { ...(rows.pendingSecrets ? { pendingSecrets: true } : {}), providers, notConfigured };
+}
+
 /** OAuth account roster without usage meters or provider-side identities. */
 function publicAccounts(pool) {
   return {
@@ -300,8 +334,14 @@ const SETUP_STATUS_READERS = {
   'local-provider': (rt) => rt.getToolModuleSettings().localProvider,
   features: (rt, { getConfig }) => featureStatus(rt, getConfig),
   shell: (rt) => rt.getSystemShell?.() || {},
-  providers: async (rt) => {
+  providers: async (rt, { detail }) => {
     const rows = publicProviderRows(await rt.getProviderSetup?.({}));
+    // Client mode: the desktop owns accounts, so the server roster is never read.
+    if (rows.managedByClient) {
+      if (detail) return rows;
+      return { managedByClient: true, unavailable: rows.unavailable, ...configuredProviderRows(rows) };
+    }
+    if (!detail) return configuredProviderRows(rows, (id) => rt.getProviderAccounts(id).accounts.length);
     rows.oauth = rows.oauth.map((row) =>
       row.authenticated ? { ...row, accounts: publicAccounts(rt.getProviderAccounts(row.id)) } : row
     );
@@ -339,7 +379,10 @@ function validateSetupInput(args) {
     if (action !== 'set_agent_route' && Object.hasOwn(args.route, 'disabled')) {
       throw new Error('route.disabled is only accepted by set_agent_route');
     }
-    for (const field of ['contextPercent', 'contextTokens']) {
+    if (Object.hasOwn(args.route, 'fallbacks') && !['set_agent_route', 'set_web_search_route'].includes(action)) {
+      throw new Error('route.fallbacks is only accepted by set_agent_route and set_web_search_route');
+    }
+    for (const field of ['contextPercent', 'contextTokens', 'autoEffort']) {
       if (action !== 'set_route' && action !== 'set_agent_route' && Object.hasOwn(args.route, field)) {
         throw new Error(`route.${field} is only accepted by set_route and set_agent_route`);
       }
@@ -401,12 +444,12 @@ const SETUP_ACTION_HANDLERS = {
   status: async (_rt, args, { readStatus, requestDesktop }) => {
     const domain = clean(args.domain) || 'summary';
     requireEnum(domain, SETUP_STATUS_DOMAINS, 'domain');
-    return { domain, ...(await readStatus(domain, requestDesktop)) };
+    return { domain, ...(await readStatus(domain, requestDesktop, args.detail === true)) };
   },
   open: (_rt, args, { openSurface }) => openSurface(args.target),
   set_route: async (rt, args) => {
     const route = routeInput(args.route);
-    const next = await rt.setRoute(route);
+    const next = await rt.setRoute(route, { keepMainModel: false });
     return { route: next, appliesTo: 'next session (a conversation keeps its frozen route)' };
   },
   set_agent_route: async (rt, args) => {
@@ -524,6 +567,7 @@ const SETUP_ACTION_HANDLERS = {
   forget_provider_auth: async (rt, args) => {
     const name = requireText(args.name, 'name');
     const setup = await rt.getProviderSetup({});
+    if (setup?.managedByClient) throw new Error('Manage provider accounts in the local desktop window.');
     if (!(setup?.oauth || []).some((row) => row.id === name)) {
       if (Object.hasOwn(args, 'accountId')) throw new Error('accountId applies only to OAuth providers');
       return rt.forgetProviderAuth(name);
@@ -536,8 +580,12 @@ const SETUP_ACTION_HANDLERS = {
     const accountId = Object.hasOwn(args, 'accountId') ? requireText(args.accountId, 'accountId') : accounts[0].id;
     return { ...(await rt.forgetProviderAuth(name, accountId)), accountId };
   },
-  set_provider_account: async (rt, args) =>
-    publicAccounts(await rt.updateProviderAccounts(requireText(args.name, 'name'), args.providerAccount)),
+  set_provider_account: async (rt, args) => {
+    if ((await rt.getProviderSetup?.({}))?.managedByClient) {
+      throw new Error('Manage provider accounts in the local desktop window.');
+    }
+    return publicAccounts(await rt.updateProviderAccounts(requireText(args.name, 'name'), args.providerAccount));
+  },
   add_mcp_server: async (rt, args) => {
     const server = mcpServerInput(args);
     requireText(server.name, 'server.name');
@@ -631,11 +679,11 @@ export function createSetupToolExecutor({ getApi, getConfig, notifySessionUi, ge
     return facade;
   };
 
-  async function readStatus(domain, requestDesktop) {
+  async function readStatus(domain, requestDesktop, detail) {
     const rt = api();
     if (SETUP_DESKTOP_DOMAINS.includes(domain)) return requestDesktop({ action: 'status', domain });
     if (!Object.hasOwn(SETUP_STATUS_READERS, domain)) throw new Error(`setup: unknown status domain "${domain}"`);
-    return SETUP_STATUS_READERS[domain](rt, { domain, getConfig: () => getConfig?.() || {} });
+    return SETUP_STATUS_READERS[domain](rt, { domain, detail, getConfig: () => getConfig?.() || {} });
   }
 
   function openSurface(target) {
@@ -669,7 +717,7 @@ export function createSetupToolExecutor({ getApi, getConfig, notifySessionUi, ge
     dispose: desktop.dispose,
     async execute(args = {}, options = {}) {
       const result = await execute(args, options);
-      if (READ_ONLY_SETUP_ACTIONS.has(args.action)) return JSON.stringify(result ?? {}, null, 2);
+      if (READ_ONLY_SETUP_ACTIONS.has(args.action)) return JSON.stringify(result ?? {});
       await flushSettings?.();
       // Attached surfaces re-read what changed instead of waiting for their
       // next open or cache expiry.

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -1,11 +1,81 @@
 import { SETUP_EXTENDED_PROPERTIES, SETUP_DESKTOP_ACTIONS } from './settings-contract.mjs';
 import { MEDIA_KINDS } from '../../runtime/media/tool-defs.mjs';
+import { OPENAI_COMPAT_PRESETS } from '../../runtime/agent/orchestrator/providers/openai-compat-presets.mjs';
 
 const own = (value, key) => Object.hasOwn(value || {}, key);
 const pick = (value, keys) => Object.fromEntries(keys.filter((key) => own(value, key)).map((key) => [key, value[key]]));
 const entryKeys = Object.keys(SETUP_EXTENDED_PROPERTIES.entry.properties);
 const definitionKeys = Object.keys(SETUP_EXTENDED_PROPERTIES.definition.properties);
 
+const MODEL_PAGE_DEFAULT = 25;
+
+function providerIndex(rows) {
+  const counts = new Map();
+  for (const row of rows) counts.set(row.provider, (counts.get(row.provider) || 0) + 1);
+  return [...counts].map(([provider, count]) => {
+    const defaultModel = OPENAI_COMPAT_PRESETS[provider]?.defaultModel;
+    return { provider, count, ...(defaultModel ? { defaultModel } : {}) };
+  });
+}
+
+function compactModelRow(row) {
+  const context = row.contextWindow || null;
+  const maxContext = Number(row.maxContextWindow) || 0;
+  return {
+    id: row.id,
+    display: row.display || row.id,
+    context,
+    ...(maxContext > (context || 0) ? { maxContext } : {}),
+    efforts: (row.effortOptions || []).map((option) => option.value),
+    ...(row.fastCapable === true ? { fast: true } : {}),
+    ...(row.supportsVision === true ? { vision: true } : {}),
+  };
+}
+
+const isPresent = (value) =>
+  value != null && value !== '' && value !== false && !(typeof value === 'object' && !Object.keys(value).length);
+
+/** Everything set_route can use for one model; empty and false fields omitted. */
+function modelDetail(row) {
+  const detail = {
+    provider: row.provider,
+    id: row.id,
+    display: row.display || row.id,
+    context: row.contextWindow,
+    maxContext: Number(row.maxContextWindow) > row.contextWindow ? row.maxContextWindow : null,
+    outputTokens: row.outputTokens,
+    vision: row.supportsVision,
+    webSearch: row.supportsWebSearch,
+    reasoning: row.supportsReasoning,
+    effortOptions: (row.effortOptions || []).map(({ value, label }) => ({ value, label })),
+    defaultEffort: row.defaultEffort,
+    fastCapable: row.fastCapable,
+    fastEfforts: row.fastEfforts,
+    defaultFast: row.defaultFast,
+    serviceTiers: row.serviceTiers,
+    defaultServiceTier: row.defaultServiceTier,
+    additionalSpeedTiers: row.additionalSpeedTiers,
+    modelParameterOptions: row.modelParameterOptions,
+    parameterVariants: row.parameterVariants,
+    defaultModelParameters: row.defaultModelParameters,
+    supportsMaxMode: row.supportsMaxMode,
+  };
+  return Object.fromEntries(Object.entries(detail).filter(([, value]) => isPresent(value)));
+}
+
+function findModel(rows, id, provider) {
+  const matches = rows.filter((row) => row.id === id && (!provider || row.provider === provider));
+  if (!matches.length) {
+    throw new Error(
+      `model "${id}" not found${provider ? ` for provider "${provider}"` : ''}; list_models with catalog.provider returns its model ids`
+    );
+  }
+  const providers = [...new Set(matches.map((row) => row.provider))];
+  if (providers.length > 1)
+    throw new Error(`model "${id}" is offered by ${providers.join(', ')}; pass catalog.provider`);
+  return matches[0];
+}
+
 export function publicAutomation(row) {
   const result = {
     ...pick(row, entryKeys),
@@ -136,12 +206,22 @@ async function saveDefinition(rt, args) {
 export const EXTENDED_SETUP_HANDLERS = Object.freeze({
   set_local_context: (rt, args) => rt.setLocalProviderContext(args.modelId, args.localContextWindow),
   async list_models(rt, args) {
-    const options = args.catalog || {};
-    const refresh = options.refresh === true;
-    const models = options.webSearch
-      ? await rt.listWebSearchModels({ refresh })
-      : await rt.listProviderModels({ refresh });
-    return { models: options.provider ? models.filter((model) => model.provider === options.provider) : models };
+    const { provider, model, page = 1, limit = MODEL_PAGE_DEFAULT, webSearch, refresh } = args.catalog || {};
+    const rows = webSearch
+      ? await rt.listWebSearchModels({ refresh: refresh === true })
+      : await rt.listProviderModels({ refresh: refresh === true });
+    if (model) return { model: modelDetail(findModel(rows, model, provider)) };
+    if (!provider) return { providers: providerIndex(rows) };
+    const own = rows.filter((row) => row.provider === provider);
+    const pages = Math.max(1, Math.ceil(own.length / limit));
+    return {
+      provider,
+      total: own.length,
+      page,
+      pages,
+      ...(page < pages ? { nextPage: page + 1 } : {}),
+      models: own.slice((page - 1) * limit, page * limit).map(compactModelRow),
+    };
   },
   set_orchestration_mode: (rt, args) => rt.setOrchestrationMode(args.mode),
   get_mcp_server: async (rt, args) => publicMcpConfig(await rt.getMcpServerConfig(args.name)),

package/src/session-runtime/setup-tool/settings-contract.mjs

@@ -114,9 +114,24 @@ export const SETUP_MCP_SCHEMA = object({
 
 export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
   catalog: object({
-    provider: text,
-    webSearch: boolean,
-    refresh: boolean,
+    provider: {
+      ...text,
+      description: "list_models: omit for the provider index; set for that provider's compact model rows.",
+    },
+    model: {
+      ...text,
+      description:
+        'list_models: one model id; returns its full options (efforts, fast, service tiers, modelParameterOptions, parameterVariants) for set_route. Add provider when several offer the id.',
+    },
+    page: { type: 'integer', minimum: 1, description: 'list_models with provider: 1-based page; default 1.' },
+    limit: {
+      type: 'integer',
+      minimum: 1,
+      maximum: 100,
+      description: 'list_models with provider: rows per page; default 25.',
+    },
+    webSearch: { ...boolean, description: 'list_models: native-search capable models only.' },
+    refresh: { ...boolean, description: 'list_models: refresh the catalog first.' },
   }),
   localContextWindow: {
     type: ['integer', 'null'],

package/src/session-runtime/setup-tool/tool-defs.mjs

@@ -68,7 +68,7 @@ export const SETUP_OPEN_TARGETS = Object.freeze([
 // Runtime dispatch contract. A trailing ? denotes an optional field. Keep
 // this out of the wire schema: field descriptions already name their actions.
 export const SETUP_ACTION_FIELDS = Object.freeze({
-  status: 'domain?',
+  status: 'domain? detail?',
   open: 'target',
   set_route: 'route',
   set_agent_route: 'agent route',
@@ -136,6 +136,10 @@ const ROUTE_SCHEMA = {
     model: { type: 'string' },
     effort: { type: 'string' },
     fast: { type: 'boolean' },
+    autoEffort: {
+      type: 'boolean',
+      description: 'Main and agent routes only: Auto reasoning for this route; omitted = preserved.',
+    },
     modelParameters: { type: 'object', additionalProperties: { type: 'string' } },
     // A typed enum is unrepresentable on Gemini; the bounds project everywhere
     // and the executor rejects values that are not a multiple of 10.
@@ -152,12 +156,23 @@ const ROUTE_SCHEMA = {
   },
 };
 
+ROUTE_SCHEMA.properties.fallbacks = {
+  type: 'array',
+  description: 'Agent and Web Search routes only: ordered fallback models; [] clears the list.',
+  items: {
+    type: 'object',
+    additionalProperties: false,
+    required: ['provider', 'model'],
+    properties: Object.fromEntries(Object.entries(ROUTE_SCHEMA.properties).filter(([key]) => key !== 'disabled')),
+  },
+};
+
 export const SETUP_TOOL_DEFS = Object.freeze([
   {
     name: 'setup',
     title: 'Setup',
     description:
-      "Read or change this Mixdog installation's settings through the runtime. Load the setup skill first (local-provider for managed local-model installation). status reads one domain; open navigates the attached app to a settings surface. Secrets (API keys, OAuth) are never accepted. Changes apply to new sessions unless the result says otherwise.",
+      "Read or change this Mixdog installation's settings through the runtime. Load the setup skill first (local-provider for managed local-model installation). status reads one domain; open navigates the attached app to a settings surface; list_models returns a provider index, then one provider's paged compact rows, then one model's full options (catalog.model). Results are compact JSON. Secrets (API keys, OAuth) are never accepted. Changes apply to new sessions unless the result says otherwise.",
     annotations: {
       title: 'Setup',
       readOnlyHint: false,
@@ -177,6 +192,11 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           enum: [...SETUP_STATUS_DOMAINS],
           description: 'status: which domain to read; default summary.',
         },
+        detail: {
+          type: 'boolean',
+          description:
+            'status providers: full rows for every provider (key URLs, expiry, account ids) instead of configured providers only.',
+        },
         target: {
           type: 'string',
           enum: [...SETUP_OPEN_TARGETS],
@@ -236,7 +256,7 @@ export const SETUP_TOOL_DEFS = Object.freeze([
         accountId: {
           type: 'string',
           description:
-            'forget_provider_auth: OAuth account id from status providers; required when the provider has several accounts.',
+            'forget_provider_auth: OAuth account id from status providers with detail:true; required when the provider has several accounts.',
         },
         providerAccount: {
           type: 'object',
@@ -263,7 +283,8 @@ export const SETUP_TOOL_DEFS = Object.freeze([
               properties: { id: { type: 'string' }, label: { type: 'string', maxLength: 80 } },
             },
           },
-          description: 'set_provider_account: OAuth account change; account ids from status providers.',
+          description:
+            'set_provider_account: OAuth account change; account ids from status providers with detail:true.',
         },
         modelId: {
           type: 'string',

package/src/session-runtime/skills-api.mjs

@@ -46,18 +46,16 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
       }
       return { kind: 'user' };
     };
+    const enabledFlags = contextMod.skillEnabledFlags(skills);
     return {
       cwd,
       count: skills.length,
       tools: getTools().map(({ name }) => ({ name })),
-      skills: skills.map((skill) => {
+      skills: skills.map((skill, index) => {
         const source = sourceForSkill(skill);
         return {
           name: skill.name,
-          enabled: !(
-            contextMod.isSkillDisabled?.(skill.name, null, skills) ||
-            contextMod.skillMissingFeature?.(skill.name, null, skills)
-          ),
+          enabled: enabledFlags[index],
           description: skill.description || '',
           whenToUse: skill.whenToUse || '',
           filePath: skill.filePath || null,

package/src/session-runtime/tool-policy-refresh.mjs

@@ -4,17 +4,23 @@
 // updated policy.
 import { sessionHasConversationMessages } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { toSessionWorkflowMeta } from '../runtime/agent/orchestrator/runtime-core/workflow.mjs';
-import { applyDeferredToolSurface, filterDisallowedTools } from '../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import {
+  applyDeferredToolSurface,
+  filterDisallowedTools,
+} from '../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 import { deferredSurfaceModeForLead } from '../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import {
   applyInitialDeferredToolManifestToBp2,
   composeSystemPrompt,
 } from '../runtime/agent/orchestrator/context/collect.mjs';
+import { _buildBaseRules } from '../runtime/agent/orchestrator/session/manager/rules-cache.mjs';
+import { sessionRolePromptFields } from '../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
 import {
-  _buildBaseRules,
-  _buildLeadRules,
-  _buildLeadLanguageContext,
-} from '../runtime/agent/orchestrator/session/manager/rules-cache.mjs';
+  delegationDisabled,
+  honoredSchemaAllowlist,
+} from '../runtime/agent/orchestrator/session/manager/session-tool-surface.mjs';
+import { finalizeSessionToolList } from '../runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
+import { isAgentOwner } from '../runtime/agent/orchestrator/agent-owner.mjs';
 import { unusedModelEditToolName } from '../runtime/shared/edit-tool-dialect.mjs';
 
 function toolNames(list) {
@@ -69,6 +75,7 @@ export function createToolPolicyRefresh({
   getMode,
   getConfig,
   getDataDir,
+  getActiveTurnCount,
   modelStandaloneTools,
   featureDisallowedTools,
   loadCoreMemoryContext,
@@ -78,13 +85,23 @@ export function createToolPolicyRefresh({
 }) {
   // Denied tools leave every surface, then the deferred surface is rebuilt
   // for the lead's current mode.
-  function applyToolDenials(session, denied) {
+  function applyToolDenials(session, denied, schemaAllowedTools, ownerIsAgent) {
     session.disallowedTools = denied;
     session.tools = filterDisallowedTools(session.tools, denied);
     if (Array.isArray(session.deferredToolCatalog)) {
       session.deferredToolCatalog = filterDisallowedTools(session.deferredToolCatalog, denied);
     }
-    applyDeferredToolSurface(session, deferredSurfaceModeForLead(getMode()), modelStandaloneTools(), {
+    const catalogTools = finalizeSessionToolList(modelStandaloneTools(), {
+      schemaAllowedTools,
+      disallowedTools: denied,
+      ownerIsAgent,
+    });
+    session.tools = finalizeSessionToolList(session.tools, {
+      schemaAllowedTools,
+      disallowedTools: denied,
+      ownerIsAgent,
+    });
+    applyDeferredToolSurface(session, deferredSurfaceModeForLead(getMode()), catalogTools, {
       provider: getRoute()?.provider,
     });
     const catalog = Array.isArray(session.deferredToolCatalog) ? session.deferredToolCatalog : [];
@@ -101,16 +118,40 @@ export function createToolPolicyRefresh({
     }
   }
 
+  // A turn is executing from the moment it opens until it settles, even when
+  // its transcript holds only notifications (which are not conversation
+  // content). Its tool surface is frozen for that whole span.
+  function turnInFlight(session) {
+    return (getActiveTurnCount?.() || 0) > 0 || Array.isArray(session.liveTurnMessages);
+  }
+
+  // Admission: the session is still the current one, no turn is executing and
+  // no conversation has started. Checked before staging and again right
+  // before the staged change is applied.
+  function admitsRefresh(session) {
+    return (
+      getSession?.() === session &&
+      !turnInFlight(session) &&
+      !sessionHasConversationMessages(session) &&
+      !sessionHasConversationMessages({ messages: session.liveTurnMessages })
+    );
+  }
+
   async function refreshEmptySessionToolPolicy() {
     invalidatePreSessionToolSurface?.();
     const session = getSession?.();
     if (!session?.id) return { appliedToCurrentSession: true };
-    if (
-      sessionHasConversationMessages(session) ||
-      sessionHasConversationMessages({ messages: session.liveTurnMessages })
-    ) {
-      return { appliedToCurrentSession: false };
-    }
+    if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
+    // Older records contain only compiled prompt text; rebuilding would guess
+    // away custom instructions. Keep that immutable material for every owner.
+    const identity = session.promptIdentity;
+    if (!identity) return { appliedToCurrentSession: false, reason: 'missing-prompt-identity' };
+    const ownerIsAgent = isAgentOwner(session);
+    const schemaAllowedTools = honoredSchemaAllowlist(session.schemaAllowedTools, {
+      ownerIsAgent,
+      agent: identity.agent,
+    });
+    const toolFreeRole = ownerIsAgent && schemaAllowedTools?.length === 0;
 
     const {
       summary: workflow,
@@ -118,34 +159,44 @@ export function createToolPolicyRefresh({
       packContext,
       orchestrationMode,
     } = activeWorkflowContext(getConfig(), getDataDir());
-    const workflowContext = session.owner === 'agent' ? packContext : leadWorkflowContext;
-    const denied = [...featureDisallowedTools(), ...(workflow?.delegatesAgents === false ? ['agent'] : [])]
+    const workflowContext = ownerIsAgent ? packContext : leadWorkflowContext;
+    const denied = [
+      ...session.callerDisallowedTools,
+      ...featureDisallowedTools(),
+      ...(workflow?.delegatesAgents === false ? ['agent'] : []),
+    ]
       .map((name) => String(name || ''))
       .filter(Boolean);
-    session.workflow = toSessionWorkflowMeta(workflow);
-    session.orchestrationMode = orchestrationMode;
-    applyToolDenials(session, denied);
 
-    const allowsAgents = workflow?.delegatesAgents !== false;
-    const baseRules = _buildBaseRules({
-      omitTools: [...denied, unusedModelEditToolName(getRoute()?.model)],
-      allowTools: session.schemaAllowedTools,
-      provider: getRoute()?.provider,
-      model: getRoute()?.model,
-    });
-    const roleRules = _buildLeadRules({ includeLeadBrief: allowsAgents });
+    // Stage: everything below is computed without touching the session, so a
+    // turn that starts during the async rebuild cannot lose tools to it.
+    const baseRules =
+      identity.skipAgentRules || toolFreeRole
+        ? ''
+        : _buildBaseRules({
+            omitTools: [...denied, unusedModelEditToolName(getRoute()?.model)],
+            allowTools: schemaAllowedTools,
+            provider: getRoute()?.provider,
+            model: getRoute()?.model,
+          });
     const coreMemoryContext = await leadCoreMemoryContext();
     const { sessionMarkerCore } = composeSystemPrompt({
-      roleRules,
-      skipRoleCatalog: true,
+      ...sessionRolePromptFields(identity, {
+        ownerIsAgent,
+        toolFreeRole,
+        delegationFree: delegationDisabled(session, ownerIsAgent),
+      }),
+      provider: getRoute()?.provider,
       workflowContext,
       coreMemoryContext,
       // The rebuilt core keeps (or newly applies) the instruction-files setting.
-      instructionFilesContext: loadInstructionFilesContext?.(session) || null,
-      // BP3 rebuild must keep the trailing language block, or a workflow
-      // switch would silently drop the response-language directive.
-      languageContext: _buildLeadLanguageContext(),
+      instructionFilesContext: toolFreeRole ? null : loadInstructionFilesContext?.(session) || null,
     });
+    // Apply: re-check admission after the await, then mutate synchronously.
+    if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
+    session.workflow = toSessionWorkflowMeta(workflow);
+    session.orchestrationMode = orchestrationMode;
+    applyToolDenials(session, denied, schemaAllowedTools, ownerIsAgent);
     rewriteSystemHeading(session, '# Tool Use', baseRules);
     rewriteBp3Core(session, sessionMarkerCore);
     session.updatedAt = Date.now();

package/src/session-runtime/tool-surface.mjs

@@ -6,6 +6,7 @@ import {
   filterDisallowedTools,
   selectDeferredTools,
 } from '../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { AGENT_WORKER_DENIED_TOOLS } from '../runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
 import { LEAD_DISALLOWED_TOOLS } from '../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { deferredSurfaceModeForLead, toolSpecForMode } from '../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { loadSkillToolDependencies } from '../runtime/agent/orchestrator/runtime-core/skill-tool-loading.mjs';
@@ -52,8 +53,11 @@ export function createToolSurface({
     const workflowTools = hideAgentTool
       ? profileTools.filter((tool) => !agentToolNames.has(String(tool?.name || '')))
       : profileTools;
+    const visibleTools = agentOwned
+      ? workflowTools.filter((tool) => !AGENT_WORKER_DENIED_TOOLS.has(String(tool?.name || '').toLowerCase()))
+      : workflowTools;
     const denied = new Set(getFeatureDisallowedTools().map((name) => String(name || '')));
-    return denied.size ? workflowTools.filter((tool) => !denied.has(String(tool?.name || ''))) : workflowTools;
+    return denied.size ? visibleTools.filter((tool) => !denied.has(String(tool?.name || ''))) : visibleTools;
   }
 
   function disallowedTools() {

package/src/session-runtime/turn/agent-ops.mjs

@@ -3,7 +3,12 @@
  * runtime notifications, and the deferred tool surface (status + selection).
  */
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import { toolRow, toolSearchMatches, sortedNamesByMeasuredUsage, selectDeferredTools } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import {
+  toolRow,
+  toolSearchMatches,
+  sortedNamesByMeasuredUsage,
+  selectDeferredTools,
+} from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 
 function splitToolStatusCounts(rows) {
   const list = Array.isArray(rows) ? rows : [];
@@ -67,6 +72,39 @@ export function createAgentOps(deps) {
     });
   }
 
+  // Explicit user force-release ("Release anyway") of a shell job whose
+  // termination is unconfirmed: drops its workspace hold. The surface has
+  // already asked the user to confirm. The caller session's own holds, and
+  // holds of a closed session whose workspace this session's folder sees.
+  async function releaseShellJob(taskId) {
+    const session = getSession();
+    const { forceReleaseTerminationHold } = await import(
+      '../../runtime/agent/orchestrator/tools/builtin/lib/shell-job-records.mjs'
+    );
+    return forceReleaseTerminationHold(taskId, {
+      callerSessionId: session?.id || null,
+      callerCwd: getCurrentCwd?.() || null,
+    });
+  }
+
+  // This session's live shell jobs (the readout rows), each carrying
+  // `terminationUnconfirmed` when it is held without confirmed termination,
+  // plus held shells a closed session left in a workspace this session sees.
+  async function listShellJobs() {
+    const session = getSession();
+    const { shellJobsStatusFresh, shellJobVisibleFrom } = await import(
+      '../../runtime/shared/statusline/statusline-segments.mjs'
+    );
+    const status = await shellJobsStatusFresh({ clientHostPid: session?.clientHostPid || process.pid });
+    const own = session?.id ? status?.sessions?.[session.id]?.jobs : status?.jobs;
+    const jobs = Array.isArray(own) ? [...own] : [];
+    const cwd = getCurrentCwd?.() || null;
+    for (const job of status?.orphaned || []) {
+      if (shellJobVisibleFrom(job, cwd) && !jobs.some((row) => row.taskId === job.taskId)) jobs.push(job);
+    }
+    return { jobs };
+  }
+
   function onNotification(listener) {
     if (typeof listener !== 'function') return () => {};
     const sessionId = getSession()?.id || getReservedSessionId?.() || '';
@@ -105,5 +143,14 @@ export function createAgentOps(deps) {
     return { ...result, status: toolsStatus() };
   }
 
-  return { agentControl, taskControl, stopShellJob, onNotification, toolsStatus, selectTools };
+  return {
+    agentControl,
+    taskControl,
+    stopShellJob,
+    releaseShellJob,
+    listShellJobs,
+    onNotification,
+    toolsStatus,
+    selectTools,
+  };
 }