mixdog 1.3.0 → 1.3.2

package/src/session-runtime/native-web-search.mjs

@@ -14,7 +14,7 @@ import {
 } from './native-web-search/tool-shape.mjs';
 import { createWebSearchRouteCandidates } from './native-web-search/routes.mjs';
 import { reportNativeWebSearchUsage } from './native-web-search-usage.mjs';
-import { canFallbackRoute } from '../runtime/shared/model-route-fallback.mjs';
+import { canFallbackCapacityRoute } from '../runtime/shared/model-route-fallback.mjs';
 
 export function createNativeWebSearch(deps) {
   const {
@@ -103,7 +103,7 @@ export function createNativeWebSearch(deps) {
       try {
         return await sendCandidate(candidate, toolType, webSearchArgs, signal);
       } catch (err) {
-        if (!canFallbackRoute(err, { signal })) throw err;
+        if (!canFallbackCapacityRoute(err, { signal })) throw err;
         errors.push(
           `${candidate.provider}${candidate.model ? `/${candidate.model}` : ''}/${toolType}: ${err?.message || String(err)}`
         );

package/src/session-runtime/new-session-config.mjs

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from 'node:util';
+import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { flushPendingSessionConfigWrites } from './config-lifecycle.mjs';
 
 // Run only after the lifecycle has established that it needs a NEW session.
@@ -27,7 +28,11 @@ export function createNewSessionConfig({
     if (!initialConfig || typeof initialConfig !== 'object') {
       reloadFullConfig();
       if (!firstSession || !initialRouteExplicit) {
-        rt.route = resolveRoute(rt.config, {});
+        const configured = resolveRoute(rt.config, {});
+        // With no Lead model configured the model picked for this runtime's
+        // still-empty conversation (a session-only choice never writes the
+        // Lead route) stands; the reload must not drop it before the first turn.
+        if (clean(configured?.model) || !clean(rt.route?.model)) rt.route = configured;
       }
     }
     invalidateOutputStyleStatusCache();

package/src/session-runtime/owned-automation-run.mjs

@@ -101,7 +101,7 @@ async function queueResult(row, item, entry, { deliver, recordDelivery, onDelive
 /**
  * `row` is `{ name, ownerAgentId }`; `run({ signal })` resolves `{ sessionId,
  * result }` (`signal` is the caller's cancellation, if any). Resolves the
- * outcome, or `{ skipped: true, reason: 'owner' | 'overlap' | 'backoff' }`
+ * outcome, or `{ skipped: true, reason: 'owner' | 'overlap' | 'backoff' | 'paused' }`
  * (an owner skip also names `ownerProblem` and its `message`); a failed run
  * rejects.
  */
@@ -141,6 +141,13 @@ export async function runOwnedAutomation(kind, row, run, deps = {}) {
       const state = await Promise.resolve()
         .then(() => record.state(name))
         .catch(() => null);
+      // Switched off (by the user, or by the failure limit): the cron claim and
+      // the webhook handler already refuse it, but a one-shot timer or a
+      // dispatch that raced the pause must not run it either.
+      if (state?.enabled === false) {
+        log(`${kind} "${name}": skipped, switched off`);
+        return await skip('paused');
+      }
       const wait = routineBackoffRemaining(state, now(), limits);
       if (wait > 0) {
         log(`${kind} "${name}": skipped, backing off ${Math.ceil(wait / 1000)}s after failures in a row`);

package/src/session-runtime/room-member-gate.mjs

@@ -2,6 +2,9 @@
 // anything that can change files or state asks the user through the ordinary
 // approval flow, whatever the agent's own permission or hook rules say — even
 // an agent that normally runs auto-approved. A hook's deny still wins.
+// Opening a task session (`session create`) runs as freely as in the agent's
+// home thread: it changes nothing itself, and the task session is the user's
+// own coding Lead, whose every side effect follows its usual approval rules.
 import { analyzeShellCommandEffects } from '../runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs';
 
 const READ_ONLY_TOOLS = new Set([
@@ -37,12 +40,22 @@ export async function isReadOnlyRoomCall({ name, args, cwd }, analyze = analyzeS
   }
 }
 
+/** Whether `name(args)` opens a task session (session create). */
+export function isTaskSessionCreate({ name, args }) {
+  return (
+    name === 'session' &&
+    String(args?.action ?? '')
+      .trim()
+      .toLowerCase() === 'create'
+  );
+}
+
 /** The PreToolUse decision for a room member's call: the hook's own `decision`
- *  when it denies or the call only reads; otherwise an approval ask that keeps
- *  any rewrite the hook made. */
+ *  when it denies, the call only reads, or it opens a task session; otherwise
+ *  an approval ask that keeps any rewrite the hook made. */
 export async function roomMemberToolDecision(call, decision, analyze) {
   const action = String(decision?.action || decision?.decision || '').toLowerCase();
   if (action === 'deny' || action === 'block') return decision;
-  if (await isReadOnlyRoomCall(call, analyze)) return decision;
+  if (isTaskSessionCreate(call) || (await isReadOnlyRoomCall(call, analyze))) return decision;
   return { ...(decision && typeof decision === 'object' ? decision : {}), action: 'ask', reason: ROOM_APPROVAL_REASON };
 }

package/src/session-runtime/route-resolution.mjs

@@ -1,5 +1,5 @@
-// Route resolution against the live runtime record: pick a model for a
-// model-less first turn and refresh the route's effort / Fast / context
+// Route resolution against the live runtime record: refuse a model-less first
+// turn (no auto-pick) and refresh the route's effort / Fast / context
 // fields from provider metadata.
 import { ensureProviderEnabled } from '../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
@@ -22,17 +22,15 @@ export function createRouteResolution({ rt, collectProviderModels, ensureProvide
     if (routeHasModel()) return rt.route;
     const models = await runAbortable(signal, () => collectProviderModels());
     throwIfAborted(signal);
-    const picked = models[0] || null;
-    if (!picked) {
+    // A model chosen during the catalog read stands: a new task's reservation
+    // prewarm starts on the empty route, its draft model lands meanwhile, and
+    // the first prompt joins this very prewarm.
+    if (routeHasModel()) return rt.route;
+    if (!models?.length) {
       throw new Error('No provider models available. Open /providers to sign in, then /model to choose a model.');
     }
-    rt.route = {
-      ...rt.route,
-      provider: picked.provider,
-      model: picked.id,
-      preset: null,
-    };
-    return rt.route;
+    // Never auto-pick: the user chooses the model.
+    throw new Error('No model selected. Choose a model with /model first.');
   }
 
   async function refreshRouteEffort(modelMetaOverride = null, expectedRoute = null, signal = null, lease = null) {
@@ -53,15 +51,19 @@ export function createRouteResolution({ rt, collectProviderModels, ensureProvide
       .find((option) => option?.id === 'context')
       ?.options?.find((option) => clean(option?.value) === contextValue);
     const modelDisplay = routeModelDisplay(rt.config, targetRoute, modelMeta);
-    const selectedContextWindow = [contextState.selectedContextWindow, contextOption?.contextWindow]
+    // Without a known window the selection (share, exact tokens, resolved
+    // window) is kept as requested — the session sizes it from the provider's
+    // window; dropping it silently put the route back on the model's default.
+    // With one it is the clamped value, absent when it is the default window.
+    const windowKnown = contextState.contextDefaultPercent !== undefined;
+    const selectedContextWindow = [
+      contextState.selectedContextWindow,
+      contextOption?.contextWindow,
+      windowKnown ? undefined : targetRoute.selectedContextWindow,
+    ]
       .map(Number)
       .find((value) => value > 0);
-    // Without a known window the exact selection is kept as requested; with
-    // one it is the clamped value, absent when it is the default window.
-    const contextTokens =
-      contextState.contextDefaultPercent === undefined
-        ? normalizeContextTokens(targetRoute.contextTokens)
-        : contextState.contextTokens;
+    const contextTokens = windowKnown ? contextState.contextTokens : normalizeContextTokens(targetRoute.contextTokens);
     const { contextTokens: _requestedTokens, ...routeFields } = targetRoute;
     rt.route = {
       ...routeFields,
@@ -69,7 +71,7 @@ export function createRouteResolution({ rt, collectProviderModels, ensureProvide
       fastCapable,
       effectiveEffort,
       effortOptions: effortItemsFor(rt.route.provider, modelMeta, effectiveEffort),
-      contextPercent: contextState.contextPercent,
+      contextPercent: windowKnown ? contextState.contextPercent : targetRoute.contextPercent,
       contextDefaultPercent: contextState.contextDefaultPercent,
       ...(contextTokens ? { contextTokens } : {}),
       ...(selectedContextWindow ? { selectedContextWindow } : {}),

package/src/session-runtime/route-state.mjs

@@ -7,8 +7,6 @@ import {
 import { clean, hasOwn } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { coerceEffortFor } from '../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { fastCapableFor } from '../runtime/agent/orchestrator/runtime-core/model-capabilities.mjs';
-import { providerCachedModelMetadataSync } from '../runtime/agent/orchestrator/providers/provider-catalog-cache.mjs';
-import { contextWindowRange, normalizeContextTokens } from '../runtime/shared/llm/default-context-window.mjs';
 
 export function resolveRouteEffortState(targetRoute = {}, modelMeta = null) {
   const requested = hasOwn(targetRoute, 'effort') ? targetRoute.effort : targetRoute.preset?.effort || null;
@@ -36,63 +34,7 @@ export function selectionFastCapable(provider, modelMeta, effort, modelParameter
   return !modelMetaLooksResolved(modelMeta) || fastCapableFor(provider, modelMeta, effort, modelParameters);
 }
 
-// The persisted provider model rows are the SAME source the picker sized its
-// slider against, so they carry both windows (openai-oauth: 272k default /
-// 1M max). Reading them keeps a percentage saved against the picker's scale
-// meaningful; anything that only knows a single window would silently rescale
-// it (30% of 272k instead of 30% of 1M).
-function cachedRouteWindows(provider, model) {
-  const row = providerCachedModelMetadataSync(provider, model)?.rawProviderModel || null;
-  if (!row) return null;
-  const contextWindow = Number(row.contextWindow ?? row.context_window ?? row.max_input_tokens) || 0;
-  const maxContextWindow = Number(row.maxContextWindow ?? row.max_context_window) || 0;
-  return contextWindow > 0 || maxContextWindow > 0 ? { contextWindow, maxContextWindow } : null;
-}
-
-export function resolveRouteContextState(targetRoute = {}, modelMeta = null, windowLookup = cachedRouteWindows) {
-  // Only providers that implement getCachedModelInfo (openai-oauth, cursor,
-  // openai-compat, opencode-go) hand lookupModelMeta a window; every other one
-  // (anthropic-oauth, grok-oauth, gemini, …) gets the bare `{ id, provider }`
-  // placeholder. Reading the window from that alone yields 0, which dropped the
-  // saved context percentage for the entire session — while resolveSessionContextMeta
-  // went on to size that session from the provider/catalog window (Claude Opus 5:
-  // a full 1M rather than the selected 500k). Read the cached provider row here so
-  // the percentage and the session boundary cannot disagree.
-  const windowMeta =
-    Number(modelMeta?.contextWindow) > 0 || Number(modelMeta?.maxContextWindow) > 0
-      ? modelMeta
-      : windowLookup?.(clean(targetRoute?.provider), clean(targetRoute?.model)) || modelMeta;
-  const { defaultWindow, maxWindow } = contextWindowRange({
-    provider: clean(targetRoute?.provider),
-    contextWindow: windowMeta?.contextWindow,
-    maxContextWindow: windowMeta?.maxContextWindow,
-  });
-  if (!maxWindow) {
-    return { contextPercent: undefined, contextDefaultPercent: undefined, selectedContextWindow: undefined };
-  }
-  const contextDefaultPercent = Math.max(10, Math.min(100, Math.round((defaultWindow / maxWindow) * 10) * 10));
-  // An exact token selection overrides the 10% stops. It is clamped to the
-  // selectable range; one that lands on the default window is the default.
-  const requestedTokens = normalizeContextTokens(targetRoute?.contextTokens);
-  if (requestedTokens) {
-    const contextTokens = Math.max(Math.ceil(maxWindow * 0.1), Math.min(maxWindow, requestedTokens));
-    if (contextTokens === defaultWindow) {
-      return { contextPercent: contextDefaultPercent, contextDefaultPercent, selectedContextWindow: defaultWindow };
-    }
-    const contextPercent = Math.max(10, Math.min(100, Math.round((contextTokens / maxWindow) * 10) * 10));
-    return { contextPercent, contextDefaultPercent, selectedContextWindow: contextTokens, contextTokens };
-  }
-  const requested = Number(targetRoute?.contextPercent);
-  const contextPercent =
-    Number.isFinite(requested) && requested > 0
-      ? Math.max(10, Math.min(100, Math.round(requested / 10) * 10))
-      : contextDefaultPercent;
-  const selectedContextWindow =
-    contextPercent === contextDefaultPercent
-      ? defaultWindow
-      : Math.max(1, Math.floor((maxWindow * contextPercent) / 100));
-  return { contextPercent, contextDefaultPercent, selectedContextWindow };
-}
+export { resolveRouteContextState } from '../runtime/agent/orchestrator/runtime-core/route-context-state.mjs';
 
 /**
  * Human label for the statusline. A display-only user alias

package/src/session-runtime/routine-home-turn.mjs

@@ -9,8 +9,10 @@
  * it rides the thread's queue as its own `routine` entry (one per turn, never
  * merged or steered into another), shows as a routine marker row, and selects
  * skills only from the routine's instructions (`skillSelection`), never from a
- * webhook payload. While it runs the thread counts as unattended, so its
- * approvals are held for the owner (held-requests.mjs). Resolves with the
+ * webhook payload. While it runs the thread counts as an unattended run
+ * (held-requests.mjs): the saved routine is the user's grant, so it never asks
+ * (outbound actions are allowed within the bot's permissions; payments and
+ * permanent deletes are refused, human-gate/run-policy.mjs). Resolves with the
  * reply once the turn ends; rejects when the turn fails, is cancelled, or the
  * caller's `signal` aborts (which also aborts the turn once it runs).
  */
@@ -126,7 +128,7 @@ export async function runRoutineTurn(
       onCommitted: () => {
         if (started) return;
         started = true;
-        // Nobody watches this turn: its approvals are held for the owner.
+        // Nobody watches this turn: it never asks (run-policy.mjs).
         unmark = markUnattendedRun(homeId, { kind, agentId, name });
         if (aborted) void abortTurn();
       },

package/src/session-runtime/runtime-bootstrap.mjs

@@ -13,22 +13,24 @@ import {
   CODE_GRAPH_TOOL_DEFS,
   STATUSLINE_SESSION_ROUTES,
   STANDALONE_ROOT,
-  STANDALONE_DATA_DIR,
+  standaloneDataDir,
 } from './runtime-paths.mjs';
 
 export function prepareStandaloneEnvironment() {
   process.env.MIXDOG_QUIET_SESSION_LOG ??= '1';
   const startedAt = performance.now();
+  // Resolved per runtime start: this start's data folder, not the first one's.
+  const dataDir = standaloneDataDir();
   ensureStandaloneEnvironment({
     rootDir: STANDALONE_ROOT,
-    dataDir: STANDALONE_DATA_DIR,
+    dataDir,
   });
   // Office journals exist only for cross-process crash recovery, so startup just
   // prunes expired ones in the background. Surfacing them as session context made
   // every new session (agents included) re-announce unrelated leftovers for the
   // full 30-day retention window; recovery stays reachable on demand through
   // office action=transactions / action=recover.
-  listOfficeJournals(STANDALONE_DATA_DIR).catch(() => {});
+  listOfficeJournals(dataDir).catch(() => {});
   bootProfile('standalone-env:ready', { ms: (performance.now() - startedAt).toFixed(1) });
 }
 

package/src/session-runtime/runtime-paths.mjs

@@ -1,6 +1,6 @@
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { resolvePluginData } from '../runtime/shared/plugin-paths.mjs';
 
 export const RUNTIME = '../runtime/agent/orchestrator';
 export const WEB_SEARCH_RUNTIME = '../runtime/web-search/index.mjs';
@@ -12,10 +12,16 @@ export const STATUSLINE_SESSION_ROUTES = '../vendor/statusline/src/gateway/sessi
 
 const SESSION_RUNTIME_DIR = dirname(fileURLToPath(import.meta.url));
 export const STANDALONE_ROOT = dirname(SESSION_RUNTIME_DIR);
-const mixdogHome = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
-export const STANDALONE_DATA_DIR = process.env.MIXDOG_DATA_DIR || join(mixdogHome, 'data');
+
+/**
+ * The standalone data directory, resolved from the environment on every call.
+ * A runtime start (a pristine boundary, a second page session) retargets
+ * MIXDOG_DATA_DIR, so a load-time constant would point every later start back
+ * at the first run's folder.
+ */
+export const standaloneDataDir = resolvePluginData;
 
 /** The data directory a runtime writes to: its config module's plugin data dir, else the standalone default. */
 export function pluginDataDir(cfgMod) {
-  return cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
+  return cfgMod.getPluginData?.() || standaloneDataDir();
 }

package/src/session-runtime/runtime-tunables.mjs

@@ -36,6 +36,12 @@ export function readRuntimeTunables() {
     // connected tools fold synchronously; in-flight servers join through the
     // late-tool announcement path. Operators may opt back into a grace window.
     mcpTurnGraceMs: envDelayMs('MIXDOG_MCP_TURN_GRACE_MS', 0, { min: 0, max: 2_000 }),
+    // A spawned agent's first turn may be its only one, so it waits for the
+    // initial connect — but only this long: a slow-but-alive server (a
+    // 20 s handshake is seen in the wild) must not hold the first model
+    // request for its whole startup budget. Later servers join through the
+    // late-tool announcement path on the agent's next turn.
+    mcpAgentGraceMs: envDelayMs('MIXDOG_MCP_AGENT_GRACE_MS', 3_000, { min: 0, max: 30_000 }),
     // Boot-time remote start is deferred past the first frame; see the caller.
     remoteAutoStartDelayMs: envDelayMs('MIXDOG_REMOTE_AUTOSTART_DELAY_MS', 1_500, { min: 0, max: 60_000 }),
     providerWarmupEnabled:

package/src/session-runtime/services/agent-tool/close-flow/close-all.mjs

@@ -5,6 +5,7 @@ import { cancelBackgroundTask, listBackgroundTasks } from '../../../../runtime/s
 import { presentErrorText } from '../../../../runtime/shared/err-text.mjs';
 import { clean } from '../helpers.mjs';
 import { isLeadPoolAgent } from '../worker-rows.mjs';
+import { isUnnotifiedRestartFailure } from '../worker-index/row-liveness.mjs';
 
 export function createCloseAll({ registry, close }) {
   const { tags, tagAgents, tagCwds } = registry;
@@ -17,11 +18,13 @@ export function createCloseAll({ registry, close }) {
 
   // Drop the closed workers' rows: every non-Lead row for an unscoped
   // teardown, only this owner's (plus the rows just closed) for a scoped one.
+  // A row whose owner is still owed its restart failure stays (a process exit
+  // closes every worker; the next process tells the owner).
   function purgeWorkerRows(ownerSessionId, closedSessionIds) {
     registry.flushWorkerIndexMutations();
     registry.writeWorkerRows((byKey, tombstonesByKey) => {
       for (const [key, row] of [...byKey.entries()]) {
-        if (isLeadPoolAgent(row.agent)) continue;
+        if (isLeadPoolAgent(row.agent) || isUnnotifiedRestartFailure(row)) continue;
         if (
           ownerSessionId &&
           clean(row.ownerSessionId) !== ownerSessionId &&
@@ -38,15 +41,20 @@ export function createCloseAll({ registry, close }) {
   // Lead's workers: the worker index and task registry are shared by every
   // Lead in the process, and an unscoped sweep wiped sibling Leads' idle
   // workers mid-window.
+  // A process exit (`scope.processExit`) closes the workers but keeps their
+  // rows: the next process lists the finished ones for their pane window and
+  // settles the ones the exit cut off (restart-notify), exactly as after a
+  // crash. Dropping them emptied every sub-agent list after a daemon restart.
   return async function closeAll(reason = 'cli-agent-close-all', scope = {}) {
     const ownerSessionId = clean(scope.callerSessionId);
+    const keepRows = scope.processExit === true;
     const context = ownerSessionId ? { callerSessionId: ownerSessionId } : {};
     registry.refreshTagsFromSessions({ scanSessions: false, context });
     const closed = [];
     const failed = [];
     for (const { tag, session } of registry.agentSessionEntries({ scanSessions: false, context })) {
       try {
-        closed.push(await close({ sessionId: session.id }, context));
+        closed.push(await close({ sessionId: session.id }, context, { keepRow: keepRows }));
       } catch (err) {
         failed.push({ tag, error: presentErrorText(err, { surface: 'agent' }) });
       }
@@ -57,6 +65,7 @@ export function createCloseAll({ registry, close }) {
       closed.push({ closed: true, tag: task.tag || null, sessionId: task.sessionId || null, task_id: task.task_id });
     }
     if (!ownerSessionId) resetLocalTagState();
+    if (keepRows) return { closed, failed };
     const closedSessionIds = new Set(closed.map((row) => clean(row.sessionId)).filter(Boolean));
     purgeWorkerRows(ownerSessionId, closedSessionIds);
     return { closed, failed };

package/src/session-runtime/services/agent-tool/close-flow.mjs

@@ -37,7 +37,9 @@ export function createCloseFlow({ mgr, registry, views }) {
     }
   }
 
-  async function close(args, context = {}) {
+  /** `keepRow`: a process exit closes the worker but leaves its row (and its
+   *  descendants') for the next process (close-all.mjs). */
+  async function close(args, context = {}, { keepRow = false } = {}) {
     const scopedContext = agentScope(args, context);
     registry.refreshTagsFromSessions({ scanSessions: registry.wantsSessionScan(args), context: scopedContext });
     const taskId = taskIdFromArgs(args);
@@ -73,7 +75,7 @@ export function createCloseFlow({ mgr, registry, views }) {
     if (task?.taskId) cancelBackgroundTask(task.taskId, CLOSE_REASON);
     // Drop the row only once the cancellation is DURABLY recorded: a failed
     // close that still forgot the row would leave no cancelled state behind.
-    if (ok) {
+    if (ok && !keepRow) {
       registry.forgetTerminalSession(tag, sessionId);
       for (const descendantSessionId of descendantSessionIds) {
         registry.removeWorkerRow({ sessionId: descendantSessionId });

package/src/session-runtime/services/agent-tool/execute-send.mjs

@@ -70,6 +70,7 @@ export function createSendDispatch({ registry, defaultCwd, sendFlow, spawnFlow,
   async function send(args, { scopedContext, callerCwd, context, notifyContext }) {
     try {
       const prepared = await sendFlow.prepareSend(args, scopedContext);
+      await sendFlow.adoptCaller(prepared, notifyContext);
       return sendFlow.dispatchToExistingSession(prepared, notifyContext);
     } catch (err) {
       return await respawnDeadTagSend(err, args, { callerCwd, context, notifyContext });

package/src/session-runtime/services/agent-tool/execute-spawn.mjs

@@ -51,6 +51,7 @@ export function createSpawnDispatch({
     }
     if (liveSessionId && registry.getLiveSession(liveSessionId)) {
       const prepared = await sendFlow.prepareSend({ ...args, tag: explicitTag }, scopedContext);
+      await sendFlow.adoptCaller(prepared, notifyContext);
       const route = requestedRoute(args);
       return {
         reused: sendFlow.dispatchToExistingSession(route ? { ...prepared, route } : prepared, notifyContext, {

package/src/session-runtime/services/agent-tool/helpers.mjs

@@ -12,6 +12,8 @@ import {
 import { PRESET_ALIASES } from './tool-def.mjs';
 import { positiveInt } from '../../../runtime/shared/numbers.mjs';
 import { clean } from '../../../runtime/shared/clean.mjs';
+import { readAgentDefinitionKind } from '../../../runtime/shared/agent-kind.mjs';
+import { isStoreBot, userDefinitionDir } from '../../../runtime/shared/agent-store.mjs';
 import { normalizeContextTokens } from '../../../runtime/shared/llm/default-context-window.mjs';
 
 export { positiveInt };
@@ -300,13 +302,18 @@ const _frontmatterPermCache = new Map(); // key -> { value, atMs }
 const FRONTMATTER_PERM_CACHE_TTL_MS = envTimeoutMs('MIXDOG_AGENT_FRONTMATTER_TTL_MS', 5_000);
 
 function agentDeleted(cleanAgent, dataDir) {
-  return Boolean(dataDir) && existsSync(join(dataDir, 'agents', cleanAgent, '.deleted'));
+  return Boolean(dataDir) && existsSync(join(userDefinitionDir(dataDir, cleanAgent), '.deleted'));
 }
 
 /** Where an agent's definition may live, in precedence order: the data dir
  *  (user/custom agents) before the shipped source root. */
 function agentDefinitionFiles(cleanAgent, dataDir, standaloneSourceRoot) {
   const candidates = [];
+  if (dataDir && isStoreBot(dataDir, cleanAgent)) {
+    // A bot of the store: only its own folder (never the agents/ original).
+    candidates.push(join(userDefinitionDir(dataDir, cleanAgent), 'AGENT.md'));
+    return candidates;
+  }
   if (dataDir) {
     candidates.push(join(dataDir, 'agents', cleanAgent, 'AGENT.md'));
     candidates.push(join(dataDir, 'agents', `${cleanAgent}.md`));
@@ -353,13 +360,25 @@ export function readAgentFrontmatterPermission(agent, dataDir, standaloneSourceR
 }
 
 const _frontmatterKindCache = new Map(); // key -> { value, atMs }
+const _frontmatterKindValueCache = new Map(); // key -> { value, atMs }
 
-/** The agent definition's frontmatter `kind` (isContactAgentId reads it), or
- *  null when it sets none. */
+/** The agent definition's kind (isContactAgentId reads it), by the one
+ *  read-only rule (agent-kind.mjs), cached per agent for the frontmatter TTL. */
 export function readAgentFrontmatterKind(agent, dataDir, standaloneSourceRoot) {
-  return cachedFrontmatterValue(_frontmatterKindCache, agent, dataDir, standaloneSourceRoot, (fm) =>
-    typeof fm.kind === 'string' && fm.kind.trim() ? fm.kind.trim() : null
+  const id = clean(agent);
+  if (!id || agentDeleted(id, dataDir)) return null;
+  const cacheKey = `${dataDir}\u0000${id}`;
+  const cached = _frontmatterKindCache.get(cacheKey);
+  if (cached && Date.now() - cached.atMs < FRONTMATTER_PERM_CACHE_TTL_MS) return cached.value;
+  // An explicit kind in the definition in effect (any layout) wins; only an
+  // unmarked user copy goes to the evidence rule.
+  const explicit = cachedFrontmatterValue(_frontmatterKindValueCache, id, dataDir, standaloneSourceRoot, (fm) =>
+    typeof fm.kind === 'string' && fm.kind.trim() ? fm.kind.trim().toLowerCase() : null
   );
+  const value =
+    explicit || (dataDir ? readAgentDefinitionKind({ dataDir, shippedRoot: standaloneSourceRoot, id }) : null);
+  _frontmatterKindCache.set(cacheKey, { value, atMs: Date.now() });
+  return value;
 }
 
 /** The agent definition's `firstResponseTimeoutMs` (a non-negative integer;

package/src/session-runtime/services/agent-tool/restart-notify.mjs

@@ -28,6 +28,16 @@ export function restartNotificationId(row) {
   return `restart:${clean(row.task_id) || `${clean(row.sessionId)}:${clean(row.finishedAt)}`}`;
 }
 
+/** The agent task id an execution id names: a task's own id, or the task a
+ *  restart notification (restartNotificationId) reports; null for one keyed
+ *  by session because its row recorded no task id. */
+export function agentTaskIdOfExecution(executionId) {
+  const id = clean(executionId);
+  if (!id.startsWith('restart:')) return id || null;
+  const rest = id.slice('restart:'.length);
+  return rest && !rest.includes(':') ? rest : null;
+}
+
 /** `pendingRestartFailures()` lists rows whose owner is not yet told;
  *  `markRestartNotified(rows)` stamps them. `mgr` supplies the persisted
  *  pending queue (enqueuePendingMessage / markCompletionEntry /

package/src/session-runtime/services/agent-tool/send-flow.mjs

@@ -16,7 +16,14 @@ import {
   terminalResultHook,
 } from './job-task-reconcile.mjs';
 import { createTurnReviewCollector } from './turn-review.mjs';
+import { handoffContent } from '../../handoff-attachments.mjs';
+import { rebindDelegation } from '../../../runtime/agent/orchestrator/session/human-gate/delegation.mjs';
 import { settledWorkerStatus } from './worker-index/row-liveness.mjs';
+import { whileTurnDispatched } from '../../../runtime/agent/orchestrator/session/manager/runtime-state.mjs';
+
+function workerResultIdentity({ session, tag, sessionId }) {
+  return { tag, sessionId, agent: session.agent || null, provider: session.provider, model: session.model };
+}
 
 // `send` to an existing worker: resolve the live session, run one follow-up
 // turn under the progress watchdog, and reconcile the job/worker row. Busy
@@ -41,11 +48,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return (result) => {
       const abnormalError = abnormalEmptyFinishError(result, session.agent || sendAgent);
       return {
-        tag,
-        sessionId,
-        agent: session.agent || null,
-        provider: session.provider,
-        model: session.model,
+        ...workerResultIdentity({ session, tag, sessionId }),
         content: result?.content || '',
         ...(sessionSurface?.canonical === true ? { handoffOnly: true } : {}),
         ...(abnormalError ? { error: abnormalError } : {}),
@@ -69,12 +72,16 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return hooks;
   }
 
-  function runTurn({ session, sessionId, prompt, args }, turnHooks) {
+  function runTurn({ session, sessionId, prompt: text, args }, turnHooks) {
     const cwd = session.cwd || defaultCwd;
-    if (canUseSessionSurface(session)) {
-      return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd, ...turnHooks });
-    }
-    return mgr.askSession(sessionId, prompt, args.context || null, null, cwd, null, turnHooks);
+    // The caller's forwarded files ride along as attachment parts.
+    const prompt = handoffContent(text, args.attachmentParts);
+    return whileTurnDispatched(sessionId, () => {
+      if (canUseSessionSurface(session)) {
+        return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd, ...turnHooks });
+      }
+      return mgr.askSession(sessionId, prompt, args.context || null, null, cwd, null, turnHooks);
+    });
   }
 
   async function runSend(prepared, notifyContext = null, job = null) {
@@ -107,11 +114,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     const settleCancelled = (error, result = null) => {
       finalStatus = 'cancelled';
       reconcileJobCancelled(job, {
-        tag,
-        sessionId,
-        agent: session.agent || null,
-        provider: session.provider,
-        model: session.model,
+        ...workerResultIdentity({ session, tag, sessionId }),
         content: turnPartialHandoff(error, mgr.getSession(sessionId), handoffMsgStart) || result?.content || '',
       });
     };
@@ -142,11 +145,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       if (partial) {
         finalStatus = 'idle';
         const value = {
-          tag,
-          sessionId,
-          agent: session.agent || null,
-          provider: session.provider,
-          model: session.model,
+          ...workerResultIdentity({ session, tag, sessionId }),
           content: watchdogStoppedHandoff(error, partial),
           stallAbort: true,
         };
@@ -161,7 +160,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       turnReview.complete();
       watchdog?.stop?.();
       registry.upsertWorkerSessionDeferred(session, tag, {
-        ...settledWorkerStatus(finalStatus, stalled),
+        ...settledWorkerStatus(finalStatus, stalled, job),
         finishedAt: new Date().toISOString(),
       });
       reconcileJobFinally(job, finalStatus);
@@ -185,6 +184,14 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return { ...prepared, session: mgr.getSession(sessionId) || session };
   }
 
+  // The calling session hands this worker new work (a `send`, or a spawn of its
+  // tag): from now on the worker acts as that caller does, so a run's worker
+  // asks when the attended chat reuses it and the other way round. Not for a
+  // completion wake, which is the worker's own continuation.
+  function adoptCaller({ sessionId }, notifyContext) {
+    return rebindDelegation(sessionId, notifyContext?.callerSessionId);
+  }
+
   // Shared send dispatch for an already-resolved live session. Used by the
   // `send` branch AND by the `spawn` branch when an explicit tag maps to a
   // live session (reuse path). Busy sessions queue the prompt; idle ones run a
@@ -194,7 +201,11 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     const { session, sessionId, prompt } = prepared;
     const tag = registry.tagForSession(sessionId);
     if (canUseSessionSurface(session) && views.isSessionBusy(sessionId)) {
-      const queued = await sessionSurface.enqueueTurn({ session, prompt, context: prepared.args.context || null });
+      const queued = await sessionSurface.enqueueTurn({
+        session,
+        prompt: handoffContent(prompt, prepared.args.attachmentParts),
+        context: prepared.args.context || null,
+      });
       if (queued) {
         return renderResult({ queued: true, ...extras, tag, sessionId, agent: session.agent || null, ...queued });
       }
@@ -204,7 +215,8 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       views.isSessionBusy(sessionId) &&
       typeof mgr.enqueuePendingMessage === 'function'
     ) {
-      const queueDepth = mgr.enqueuePendingMessage(sessionId, prompt);
+      // The queued follow-up keeps the forwarded files, as the canonical queue does.
+      const queueDepth = mgr.enqueuePendingMessage(sessionId, handoffContent(prompt, prepared.args.attachmentParts));
       return renderResult({ queued: true, ...extras, tag, sessionId, agent: session.agent || null, queueDepth });
     }
     const job = spawnFlow.startJob(
@@ -247,5 +259,5 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return true;
   }
 
-  return { prepareSend, dispatchToExistingSession, wakeIdleWorker };
+  return { prepareSend, adoptCaller, dispatchToExistingSession, wakeIdleWorker };
 }