mixdog 1.2.3 → 1.2.5

package/src/session-runtime/internal-tool-executor.mjs

@@ -34,6 +34,7 @@ export function createInternalToolExecutor({
   getWorkspaceApi,
   getSessionManager,
   getLifecycleApi,
+  executeSessionControl,
 }) {
   const handlers = {
     ...createBridgeToolHandlers({ rt }),
@@ -58,6 +59,7 @@ export function createInternalToolExecutor({
       getWorkspaceApi,
       getSessionManager,
       getLifecycleApi,
+      executeSessionControl,
     }),
   };
 

package/src/session-runtime/lifecycle/cold-heir.mjs

@@ -35,7 +35,6 @@ const SOURCE_RUNTIME_FIELDS = [
   'toolApprovalHook',
   '_providerPrefixGuardState',
   'activeTurnCheckpoint',
-  'remoteAttached',
   'deferredInitialRefreshPending',
   'pendingGoalReminder',
   'goalReminderRevision',

package/src/session-runtime/lifecycle/session-catalog.mjs

@@ -7,7 +7,6 @@ import {
   isAgentOnlySession,
   isRootLeadSession,
 } from '../../runtime/agent/orchestrator/session/store-summary-visibility.mjs';
-import { listSessionHeartbeatMtimes } from '../../runtime/agent/orchestrator/session/store/paths-heartbeat.mjs';
 import {
   sessionMessageText,
   isSessionPreviewNoise,
@@ -58,23 +57,25 @@ function previewOf(s) {
   return { preview, messageCount, realTurnCount };
 }
 
-export function leadSessionRow(s, heartbeatMtimes) {
-  // Durable visibility is the catalog boundary. Apply it before the legacy
-  // lead-shape heuristics so an explicitly agent-only child cannot leak just
-  // because its owner field looks ordinary.
-  if (isAgentOnlySession(s)) return null;
+/** `working`: this session's turn is running in the daemon right now. */
+export function leadSessionRow(s, working = false) {
+  const agentSession = isAgentOnlySession(s) || isAgentOwner(s);
   const owner = clean(s.owner || 'user').toLowerCase();
   // A root Lead can carry Agent ownership plus a self-link after recovery;
   // it remains an ordinary resumable session, not a child dispatch.
-  if (!isRootLeadSession(s) && owner && !VISIBLE_OWNERS.includes(owner)) return null;
+  if (!agentSession && !isRootLeadSession(s) && owner && !VISIBLE_OWNERS.includes(owner)) return null;
   const sourceType = clean(s.sourceType || '').toLowerCase();
   // One-shot `mixdog exec` runs are never resumable conversations.
   if (sourceType === 'exec') return null;
-  if (!isLeadShaped(s, owner, sourceType)) return null;
+  if (!agentSession && !isLeadShaped(s, owner, sourceType)) return null;
   const { preview, messageCount, realTurnCount } = previewOf(s);
   if (!preview && messageCount === 0) return null;
   return {
     id: s.id,
+    agent: s.agent || null,
+    owner,
+    visibility: isAgentOnlySession(s) ? 'agent-only' : 'ordinary',
+    ownerSessionId: s.ownerSessionId || s.parentSessionId || null,
     // Durable provenance the desktop uses to tell a real conversation from
     // resume scratch or synthetic-only rows when no title source survives.
     ...(realTurnCount === null ? {} : { realTurnCount }),
@@ -91,12 +92,10 @@ export function leadSessionRow(s, heartbeatMtimes) {
     messageCount,
     title: cleanSessionPreview(s.title || '', 100),
     preview,
-    // Working indicator: the .hb sidecar ALONE is the liveness signal. Its
-    // deletion at turn end IS the completion signal, so the persisted
-    // lastHeartbeatAt JSON field (refreshed by the final save) must not be
-    // folded in — it pinned desktop spinners on for the full 2-minute TTL
-    // after a turn had already finished.
-    heartbeatAt: Number(heartbeatMtimes.get(s.id)) || 0,
+    // Working indicator: the in-memory runtime state ALONE is the liveness
+    // signal. The persisted lastHeartbeatAt JSON field (refreshed by the final
+    // save) must not be folded in — it outlives the turn it describes.
+    ...(working ? { working: true } : {}),
     desktopSession: s.desktopSession || null,
     // Automation origin: lets the desktop group schedule/webhook runner
     // sessions under the sidebar Automations section instead of Recent.
@@ -108,9 +107,8 @@ export function leadSessionRow(s, heartbeatMtimes) {
 }
 
 export function listLeadSessions(mgr, options = {}) {
-  const heartbeatMtimes = listSessionHeartbeatMtimes();
   return mgr
     .listSessions({ refreshFromStorage: options?.refreshFromStorage === true })
-    .map((s) => leadSessionRow(s, heartbeatMtimes))
+    .map((s) => leadSessionRow(s, mgr.isSessionTurnInFlight?.(s.id) === true))
     .filter(Boolean);
 }

package/src/session-runtime/lifecycle/session-switch/session-delete.mjs

@@ -1,18 +1,19 @@
 /**
- * session-switch/session-delete.mjs — deleting a catalogued session together
- * with its linked agent children, and releasing the work a closing session
- * owns (shared with the context switch).
+ * session-switch/session-delete.mjs — deleting one catalogued session (Lead
+ * or agent), and releasing the execution work a closing session owns
+ * (shared with the context switch).
  */
 import { clean } from '../../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { forgetSessionSearch } from '../../../runtime/session-search/session-search-ingest.mjs';
 import { leadSessionRow } from '../session-catalog.mjs';
-import { getStoreDir } from '../../../runtime/agent/orchestrator/session/store/paths-heartbeat.mjs';
+import { getStoreDir } from '../../../runtime/agent/orchestrator/session/store/session-paths.mjs';
 import {
   STORED_SESSION_UNREADABLE,
   _storedSessionFromFile,
 } from '../../../runtime/agent/orchestrator/session/store/serialize.mjs';
 import { SESSION_ID_PATTERN } from '../shared.mjs';
 import { replacementSessionCwd } from '../../workspace/workspace-state.mjs';
+import { isHistoricalAutomaticClosure } from '../../../runtime/agent/orchestrator/session/historical-session-closure.mjs';
 
 export function createSessionDelete(deps, { cancelBackgroundTasks }) {
   const {
@@ -26,42 +27,22 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     invalidatePreSessionToolSurface,
   } = deps;
 
-  // Cancel the work a closing session owns: background tasks, agent workers,
-  // and its gateway status route.
+  // Release this execution session, not independent sessions it delegated to.
   function releaseSessionWork(sessionId, reason) {
     try {
-      cancelBackgroundTasks({ reason, notify: false, callerSessionId: sessionId });
-    } catch {}
-    try {
-      agentTool?.closeAll?.(reason, { callerSessionId: sessionId });
+      cancelBackgroundTasks({ reason, notify: false, executionSessionId: sessionId });
     } catch {}
     statusRoutes?.clearGatewaySessionRoute?.(sessionId);
   }
 
-  function ownedAgentSessionIds(sessionId) {
-    try {
-      const candidates = mgr.listOwnedAgentSessionIds?.(sessionId);
-      if (!Array.isArray(candidates)) return [];
-      return [
-        ...new Set(
-          candidates
-            .map(clean)
-            .filter((childId) => childId && childId !== sessionId && SESSION_ID_PATTERN.test(childId))
-        ),
-      ];
-    } catch {
-      /* parent deletion remains available if child enumeration fails */
-      return [];
-    }
-  }
-
   // Availability is one strict read of the session's own file, filtered like
-  // the Lead catalog (an unreadable, foreign, closed or non-Lead record is not
-  // deletable). No catalog rebuild, no folder scan.
-  function isAvailableLead(sessionId) {
+  // the session catalog (an unreadable, foreign, closed or non-catalogued
+  // record is not deletable). No catalog rebuild, no folder scan.
+  function isAvailableSession(sessionId) {
     const stored = _storedSessionFromFile(getStoreDir(), `${sessionId}.json`);
-    if (!stored || stored === STORED_SESSION_UNREADABLE || stored.closed === true) return false;
-    return leadSessionRow(stored, new Map()) !== null;
+    if (!stored || stored === STORED_SESSION_UNREADABLE) return false;
+    if (stored.closed === true && !isHistoricalAutomaticClosure(stored)) return false;
+    return leadSessionRow(stored) !== null;
   }
 
   // The deleted task's worktree: the autoCleanup setting decides (clean and
@@ -75,33 +56,25 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
   async function deleteSession(id) {
     const sessionId = clean(id);
     if (!sessionId || !SESSION_ID_PATTERN.test(sessionId)) return false;
-    if (!isAvailableLead(sessionId)) return false;
-    const childIds = ownedAgentSessionIds(sessionId);
+    if (!isAvailableSession(sessionId)) return false;
     const current = getSession();
     const cleanupReason = 'desktop-session-delete';
     if (current?.id !== sessionId) {
       // A turn can still be running in a session that is no longer current.
       // Stop its runtime first (controller abort, shells, generation bump) and
-      // release its lead row, agents and tasks, so nothing can write it back.
+      // release its worker row and its own background tasks, so nothing can
+      // write it back. Sessions it delegated to are independent and keep running.
       if (mgr.closeSession(sessionId, cleanupReason, { tombstone: false }) !== true) return false;
       agentTool?.forgetLeadSession?.(sessionId);
       releaseSessionWork(sessionId, cleanupReason);
       const deleted = mgr.deleteSession(sessionId, { fenceWrites: true }) === true;
       if (!deleted) return false;
       void forgetSessionSearch(sessionId);
-      // The parent is already irreversibly gone, so child cleanup is
-      // best-effort and idempotent. Any vetoed child becomes sweep-eligible
-      // because its retained-parent proof disappeared with the parent.
-      for (const childId of childIds) {
-        try {
-          mgr.deleteSession(childId, { fenceWrites: true });
-        } catch {}
-      }
       void releaseDeletedWorktree(sessionId);
       return true;
     }
-    // Leaving a worktree-bound Lead: the replacement starts in the Project
-    // folder, and the worktree can go once nothing runs in it.
+    // Leaving a worktree-bound current session: the replacement starts in the
+    // Project folder, and the worktree can go once nothing runs in it.
     const projectFolder = replacementSessionCwd(current);
     releaseSessionWork(sessionId, cleanupReason);
     // Active sessions retain a tombstone until the normal sweep. Unlinking
@@ -113,14 +86,6 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     mgr.fenceSessionWrites?.(sessionId);
     agentTool?.forgetLeadSession?.(sessionId);
     void forgetSessionSearch(sessionId);
-    // Active parent deletion uses the same durable tombstone boundary for
-    // every linked child. Their files then mature with the parent instead of
-    // disappearing while the parent task is still retained.
-    for (const childId of childIds) {
-      try {
-        mgr.closeSession(childId, cleanupReason, { tombstone: true });
-      } catch {}
-    }
     setSession(null);
     if (projectFolder) await deps.applyResolvedCwd?.(projectFolder);
     invalidateContextStatusCache();

package/src/session-runtime/lifecycle/session-switch.mjs

@@ -4,7 +4,7 @@
  * session-switch/: session-delete (delete + work release), context-switch
  * (switch + new), resume.
  */
-import { getStoreDir } from '../../runtime/agent/orchestrator/session/store/paths-heartbeat.mjs';
+import { getStoreDir } from '../../runtime/agent/orchestrator/session/store/session-paths.mjs';
 import { toolSpecForMode } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { listLeadSessions } from './session-catalog.mjs';
 import { createSessionDelete } from './session-switch/session-delete.mjs';

package/src/session-runtime/lifecycle/shared.mjs

@@ -12,7 +12,11 @@ export { SESSION_ID_PATTERN } from '../../runtime/agent/orchestrator/runtime-cor
 // message there, not yet in session.messages, so it must also be checked or a
 // first-turn exit could still burn a real session.
 export function isScratchConversation(messages, liveTurnMessages) {
-  return !hasUserConversationMessage(messages) && !hasUserConversationMessage(liveTurnMessages);
+  return [messages, liveTurnMessages].every(
+    (items) =>
+      !hasUserConversationMessage(items) &&
+      !(Array.isArray(items) && items.some((message) => message?.meta?.transcript?.completion))
+  );
 }
 
 export function isScratchSession(session) {
@@ -22,11 +26,6 @@ export function isScratchSession(session) {
 export function createSurfaceSessionCloser(mgr) {
   return function closeSurfaceSession(session, reason, options) {
     if (!session?.id) return false;
-    // A remote-attached session is only a viewer handle owned by this surface.
-    // Closing it through the shared manager bumps the durable generation and
-    // invalidates the real owner's in-flight turn. Viewer exits therefore
-    // detach locally; only the process that owns the runtime may close it.
-    if (session.remoteAttached === true) return true;
     return mgr.closeSession(session.id, reason, options);
   };
 }

package/src/session-runtime/lifecycle/teardown/session-close.mjs

@@ -60,21 +60,22 @@ export function closeOwnSession(deps, closeSurfaceSession, reason) {
   return ok;
 }
 
-/** Plant the ordinary manager/store tombstone barrier for a canonical
- *  child session without running whole-process teardown. */
-export function closeCanonicalSession(deps, reason = 'canonical-session-close') {
+/** Fence a canonical runtime without deleting its conversation.
+ *  Explicit deletion may request a tombstone; blank scratch follows ordinary policy. */
+export function closeCanonicalSession(deps, reason = 'canonical-session-close', options = {}) {
   const { getSession, setSession, mgr, invalidateContextStatusCache, beginCanonicalClose, finishCanonicalClose } = deps;
   // Already terminal: closing is idempotent and keeps the address.
   if (deps.isCanonicallyClosed?.() === true) return true;
   const session = getSession?.();
-  if (!session?.id || session.remoteAttached === true) return false;
+  if (!session?.id) return false;
   // Fence execution admission BEFORE the manager close: that close cancels the
   // session's shells synchronously, and their completions must not be able to
   // enqueue model work or create a conversation.
   const fence = beginCanonicalClose?.(session.id);
   let closed = false;
   try {
-    closed = mgr.closeSession(session.id, reason, { tombstone: true }) === true;
+    closed =
+      mgr.closeSession(session.id, reason, { tombstone: options.tombstone ?? isScratchSession(session) }) === true;
   } finally {
     // Terminal after a durable close; admission restored when it failed.
     finishCanonicalClose?.(fence, closed);

package/src/session-runtime/lifecycle/teardown.mjs

@@ -13,7 +13,7 @@ import { abortRuntime, closeCanonicalSession, closeOwnSession, dispatchSessionEn
 import { settleAll, settleDetached, startRuntimeStops, startWorkStops } from './teardown/runtime-stops.mjs';
 
 const CLOSE_ALL_DEADLINE_MS = 5000;
-const PROCESS_EXIT_REASON =/exit|quit|shutdown|sighup|sigint|sigterm/;
+const PROCESS_EXIT_REASON = /exit|quit|shutdown|sighup|sigint|sigterm/;
 const WARMUP_TIMER_KEYS = [
   'providerSetupWarmupTimer',
   'providerWarmupTimer',
@@ -114,7 +114,7 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
       // A task that dies for a reason its owner never asked for must still be reported.
       cancelBackgroundTasks(
         scope.scopedTeardown
-          ? { reason, notify: true, callerSessionId: scope.closingSessionId }
+          ? { reason, notify: true, executionSessionId: scope.closingSessionId }
           : { reason, notify: false }
       );
     } catch {}
@@ -196,24 +196,15 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
       // session-pinned intent so the resumed session can reclaim it.
       preserveRemoteIntent: true,
     });
-    // Agent workers die with a REAL teardown only (process exit, explicit
-    // close). A keepBackgroundWork dispose (daemon idle eviction) reclaims
-    // memory and must leave workers/rows for the re-materialized owner.
-    // Scoped teardown closes only THIS session's workers — the worker index
-    // is shared across every Lead in the process.
+    // Only process-wide teardown closes delegated sessions. Session-local
+    // disposal already stopped its own execution work above.
     let closing = null;
     while (indexDisposal) await indexDisposal;
-    if (scope.teardownReapsWork) {
-      // Every close runs its OWN scope's closeAll: a scoped close for one Lead
-      // never stands in for a process-wide close. Closing produces final index
-      // writes (settled rows, tombstones); the deadline only bounds how long
-      // teardown waits and does not stop the close.
+    if (scope.teardownReapsWork && !scope.scopedTeardown) {
       const settled = () => {
         outstandingCloses.delete(closing);
       };
-      closing = new Promise((resolve) =>
-        resolve(agentTool.closeAll(reason, scope.scopedTeardown ? { callerSessionId: scope.closingSessionId } : {}))
-      ).then(settled, settled);
+      closing = new Promise((resolve) => resolve(agentTool.closeAll(reason, {}))).then(settled, settled);
       outstandingCloses.add(closing);
       try {
         await withTeardownDeadline(closing, CLOSE_ALL_DEADLINE_MS, false);
@@ -259,7 +250,7 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
   }
 
   return {
-    closeCanonicalSession: (reason) => closeCanonicalSession(deps, reason),
+    closeCanonicalSession: (reason, options) => closeCanonicalSession(deps, reason, options),
     close,
     abort: (reason) => abortRuntime(deps, reason),
   };

package/src/session-runtime/media-api.mjs

@@ -52,6 +52,14 @@ export function createMediaApi() {
     async setMediaDefault(input) {
       return (await defaults()).setMediaDefault(input || {});
     },
+    // Settings → Built-in → Media generation: the default generator the media
+    // tool uses per kind when the chat does not name one.
+    async getMediaPins() {
+      return (await defaults()).getMediaPins();
+    },
+    async setMediaPin(input) {
+      return (await defaults()).setMediaPin(input || {});
+    },
     async startMediaJob(input) {
       return (await jobs()).startMediaJob(input || {});
     },

package/src/session-runtime/model-route/route-ownership.mjs

@@ -0,0 +1,60 @@
+/**
+ * route-ownership.mjs — who a route selection belongs to.
+ *
+ * A runtime holds one conversation at a time; reset, resume, new-session and
+ * close replace it, or leave none. Every such transition advances the session
+ * generation. A selection captures the generation when it is enqueued and
+ * holds a lease on it: once the generation has moved, the selection's route
+ * side effects (adopt, refresh completion, pending registration, session
+ * updates, display rollback) are no-ops, and the current route stands.
+ */
+
+const sessionOwner = (session) => (session ? (session.id ?? session) : null);
+
+/** Make `holder.session` advance `holder.sessionGeneration` whenever another
+ *  conversation (or none) is installed. Re-installing the same conversation
+ *  (a refreshed object for the same id) is not a transition. */
+export function trackSessionGeneration(holder) {
+  let session = holder.session ?? null;
+  let generation = 0;
+  Object.defineProperty(holder, 'session', {
+    enumerable: true,
+    configurable: true,
+    get: () => session,
+    set: (next) => {
+      const installed = next ?? null;
+      if (sessionOwner(installed) !== sessionOwner(session)) generation += 1;
+      session = installed;
+    },
+  });
+  Object.defineProperty(holder, 'sessionGeneration', {
+    enumerable: true,
+    configurable: true,
+    get: () => generation,
+  });
+  return holder;
+}
+
+/** A selection's hold on the generation it was enqueued under. The token is
+ *  compared strictly; an absent token is a token like any other. */
+export function openRouteLease(getGeneration, token = getGeneration()) {
+  const valid = () => getGeneration() === token;
+  return {
+    token,
+    valid,
+    /** The one way a selection touches route or session state: `effect` runs
+     *  only if the lease holds at this very point, else `otherwise()` stands.
+     *  Anything after an `await` (even one that resolved without error) must
+     *  come through here, since a transition can run between the awaited call
+     *  returning and its caller continuing. */
+    run: (effect, otherwise) => (valid() ? effect() : otherwise()),
+  };
+}
+
+/** A selection that is not addressed to a conversation (a default for new
+ *  sessions) belongs to no session and survives every transition. */
+export const UNOWNED_LEASE = Object.freeze({
+  token: undefined,
+  valid: () => true,
+  run: (effect) => effect(),
+});

package/src/session-runtime/model-route/route-persist.mjs

@@ -35,12 +35,13 @@ export function createRoutePersistence(deps) {
         hasSecrets: getConfigHasSecrets(),
       });
     },
-    persistAdoptedModelSettings(route, { keepMainModel = false } = {}) {
+    persistAdoptedModelSettings(route, { keepMainModel } = {}) {
       // saveModelSettings is in-memory only. persistLeadRoute debounce-writes
       // the adopted config (including modelSettings). If the lead preset cannot
       // be normalized, still debounce-persist so effort/fast are not memory-only.
       const leadRoute =
-        keepMainModel || tunesNonMainModel(getRoute(), route, resolveRoute(getConfig(), {}))
+        keepMainModel === true ||
+        (keepMainModel !== false && tunesNonMainModel(getRoute(), route, resolveRoute(getConfig(), {})))
           ? null
           : persistLeadRoute(route);
       if (!leadRoute) saveConfigAndAdopt(getConfig());