mixdog 1.3.1 → 1.3.3

package/src/session-runtime/services/agent-tool/worker-index/row-liveness.mjs

@@ -31,10 +31,30 @@ export const PROCESS_RESTART_FAILURE = 'process-restart';
 /** The row's turn was stopped by the progress (stall) watchdog. */
 export const WATCHDOG_STALL_FAILURE = 'stalled';
 
+/** A failed row whose turn a process restart ended and whose owner has not
+ *  been told yet (restart-notify). It is the only record of that owed result,
+ *  so closing the worker never drops it. */
+export const isUnnotifiedRestartFailure = (row) =>
+  row?.status === 'failed' &&
+  row.failureReason === PROCESS_RESTART_FAILURE &&
+  Boolean(clean(row.ownerSessionId)) &&
+  !row.restartNotified;
+
 /** A turn's settled row status and failure reason: a watchdog stop is a
  *  failure whatever partial output it handed back (`finalStatus` may still
- *  read `idle` for the job's sake); everything else keeps `finalStatus`. */
-export function settledWorkerStatus(finalStatus, stalled) {
+ *  read `idle` for the job's sake); a turn the process exit cut off (its `job`
+ *  cancelled with terminalReason PROCESS_RESTART_FAILURE, lifecycle/teardown)
+ *  fails as a restart failure under its task id, which the next process tells
+ *  its owner; everything else keeps `finalStatus`. */
+export function settledWorkerStatus(finalStatus, stalled, job = null) {
+  if (job?.status === 'cancelled' && job.terminalReason === PROCESS_RESTART_FAILURE) {
+    return {
+      status: 'failed',
+      stage: 'failed',
+      failureReason: PROCESS_RESTART_FAILURE,
+      ...(job.taskId ? { task_id: job.taskId } : {}),
+    };
+  }
   return stalled
     ? { status: 'failed', stage: 'failed', failureReason: WATCHDOG_STALL_FAILURE }
     : { status: finalStatus, stage: finalStatus };

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -22,6 +22,7 @@ import {
   createRowLiveness,
   isActiveWorkerRow,
   isStaleApprovalWait,
+  isUnnotifiedRestartFailure,
   PROCESS_RESTART_FAILURE,
   runtimeDied,
 } from './worker-index/row-liveness.mjs';
@@ -101,12 +102,15 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   const rowFromSession = (session, fallbackTag = '', extra = {}) =>
     workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
 
+  // A row whose owner is still owed its restart failure stays: closing the
+  // worker (a process exit closes every one) must not lose that result.
   function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
     const targetTag = clean(tag);
     const targetSessionId = clean(sessionId);
     batch.flush();
     store.write((byKey) => {
       for (const [key, row] of [...byKey.entries()]) {
+        if (isUnnotifiedRestartFailure(row)) continue;
         if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
           byKey.delete(key);
         }
@@ -194,12 +198,6 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return true;
   }
 
-  const isUnnotifiedRestartFailure = (row) =>
-    row.status === 'failed' &&
-    row.failureReason === PROCESS_RESTART_FAILURE &&
-    Boolean(clean(row.ownerSessionId)) &&
-    !row.restartNotified;
-
   /** Rows whose turn a process restart ended and whose owner has not been told
    *  yet — whoever settled the row (this process at startup, or the
    *  predecessor's exit flush). Read-only: the caller enqueues the owner's

package/src/session-runtime/services/agent-tool.mjs

@@ -169,6 +169,12 @@ export function createStandaloneAgent({
     },
     getStatus,
     recoverWorkers,
+    // Daemon start: settle the rows the previous process left running and
+    // queue each owner's failure result; resolves once they are queued.
+    settleRestartFailures: () => {
+      registry.recoverStaleWorkerRows({ deadOnly: true });
+      return notifyRestartFailures();
+    },
     upsertLeadSession: registry.upsertLeadSession,
     updateLeadWorkerCwd: registry.updateLeadWorkerCwd,
     forgetLeadSession: registry.forgetLeadSession,

package/src/session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs

@@ -165,7 +165,7 @@ export function reconcileLostDaemonCaptures({
   for (const name of names) {
     const file = path.join(dir, name);
     const record = readRecord(file);
-    if (!record || record.kind !== 'mixdog-daemon-crash-capture') continue;
+    if (record?.kind !== 'mixdog-daemon-crash-capture') continue;
     if (!record.pid || record.pid === selfPid || record.exitedAt || record.daemonExit || record.exitReason) continue;
     if (pidAlive(record.pid)) continue;
     try {

package/src/session-runtime/services/daemon-crash-capture/retention.mjs

@@ -21,9 +21,10 @@ import { daemonCrashCaptureDir } from './paths.mjs';
 // Prune only files this module creates: `daemon-<yyyymmdd>-<hhmmss>-<pid>-<rand>`.
 const CAPTURE_STEM_RE = /^daemon-\d{8}-\d{6}-\d+-[0-9a-f]{4}$/;
 const CAPTURE_SUFFIXES = ['.err.log', '.json'];
-// Debris from this module's own atomic sidecar writes (writeFileAtomicSync
-// names its temp `.<basename>.<hex>.tmp`), never anyone else's file.
-const CAPTURE_TEMP_RE = /^\.daemon-\d{8}-\d{6}-(\d+)-[0-9a-f]{4}\.json\.[0-9a-f]+\.tmp$/;
+// Debris from this module's own atomic sidecar writes (the atomic writer names
+// its temp `<basename>.mixdog-tmp-<hex>`; older builds `.<basename>.<hex>.tmp`),
+// never anyone else's file.
+const CAPTURE_TEMP_RE = /^\.?daemon-\d{8}-\d{6}-(\d+)-[0-9a-f]{4}\.json\.(?:[0-9a-f]+\.tmp|mixdog-tmp-[0-9a-f]+)$/;
 export const CRASH_CAPTURE_KEEP_BOOTS = 8;
 const CRASH_CAPTURE_KEEP_BYTES = 2 * 1024 * 1024;
 const CRASH_CAPTURE_TAIL_BYTES = 256 * 1024;

package/src/session-runtime/services/hook-bus/config-loader.mjs

@@ -4,8 +4,7 @@
  * file-stamp set, standard events merged, legacy rules collected, and the
  * parse errors both reported and recorded on the result.
  */
-import { readFileSync } from 'node:fs';
-import { applyHookRulePatches, hookFileStamp } from './rule-file.mjs';
+import { applyHookRulePatches, hookFileStamp, readHookDocument } from './rule-file.mjs';
 import {
   hookConfigEntries,
   mergeEvents,
@@ -61,14 +60,24 @@ export function createConfigLoader({ dataDir, rulesPath, emit, pendingPatches })
     for (const entry of entries) {
       const filePath = entry.path;
       let parsed = null;
+      let damaged = false;
       try {
-        parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+        // The rules file is this module's own (written with a `.bak`): a
+        // damaged copy is restored from it. Other hooks files are only read.
+        parsed = readHookDocument(filePath, {
+          restore: filePath === rulesPath,
+          onDamaged: (error) => {
+            damaged = true;
+            errors.push({ file: filePath, error: error?.message || String(error) });
+          },
+        });
       } catch (error) {
-        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') continue;
-        if (!(error instanceof SyntaxError)) cacheable = false;
+        cacheable = false;
         errors.push({ file: filePath, error: error?.message || String(error) });
         continue;
       }
+      // Missing, or damaged without a good copy (reported above): no hooks.
+      if (damaged || parsed === null) continue;
       sources.push(filePath);
       sourceEntries.push({
         path: filePath,

package/src/session-runtime/services/hook-bus/rule-file.mjs

@@ -1,7 +1,11 @@
 import { readFileSync, statSync } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
-import { writeJsonAtomicSync } from '../../../runtime/shared/atomic-file.mjs';
-import { withFileLockSync } from '../../../runtime/shared/file-lock.mjs';
+import {
+  holdsNoData,
+  parseJsonText,
+  readJsonStateSync,
+  updateJsonAtomicSync,
+} from '../../../runtime/shared/atomic-file.mjs';
 import { normalizeRules } from './config.mjs';
 
 export function hookFileStamp(path) {
@@ -14,13 +18,41 @@ export function hookFileStamp(path) {
   }
 }
 
-export function readHookDocument(path) {
+// The hooks document at `path`, or null when it is missing or damaged (empty,
+// NUL-filled after a crash, or not JSON). A damaged file must not turn every
+// tool call into a policy-check failure, and must not silently drop the deny
+// rules of a good copy: with `restore` (the rules file this module writes with
+// a `.bak`), a valid `<path>.bak` is restored and read — the damaged bytes are
+// kept aside as `<path>.corrupt-<ts>`. Without a good copy the file stays in
+// place (a hand-edit can still fix it) and `onDamaged(error)` reports it; the
+// caller then has no rules from it. Hooks files the user or a plugin owns are
+// read with `restore: false`: never moved, locked or replaced. Real I/O errors
+// still throw.
+export function readHookDocument(path, { restore = true, onDamaged } = {}) {
+  let text;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    text = readFileSync(path, 'utf8');
   } catch (error) {
     if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null;
     throw error;
   }
+  let damage;
+  if (holdsNoData(text)) {
+    damage = new SyntaxError('the file holds no data (empty or NUL-filled)');
+  } else {
+    try {
+      return parseJsonText(text);
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      damage = error;
+    }
+  }
+  if (restore) {
+    const restored = readJsonStateSync(path, { fallback: null, keepWithoutBackup: true });
+    if (restored !== null) return restored;
+  }
+  onDamaged?.(damage);
+  return null;
 }
 
 function replaceRules(document, rules) {
@@ -36,13 +68,19 @@ function replaceRules(document, rules) {
 }
 
 export function updateHookRules(path, update) {
-  return withFileLockSync(`${path}.lock`, () => {
-    const document = readHookDocument(path);
-    const rules = normalizeRules(document).filter((rule) => rule && typeof rule === 'object');
-    const next = update(rules);
-    writeJsonAtomicSync(path, replaceRules(document, next), { lock: false });
-    return { stamp: hookFileStamp(path), rules: next };
-  });
+  let next;
+  // A damaged file is kept aside as <path>.corrupt-<ts> (its last good copy
+  // <path>.bak restored) before the update, never overwritten.
+  updateJsonAtomicSync(
+    path,
+    (document) => {
+      const rules = normalizeRules(document).filter((rule) => rule && typeof rule === 'object');
+      next = update(rules);
+      return replaceRules(document, next);
+    },
+    { backup: true }
+  );
+  return { stamp: hookFileStamp(path), rules: next };
 }
 
 export function applyHookRulePatches(rules, patches, { strict = true } = {}) {

package/src/session-runtime/services/plugin-admin.mjs

@@ -3,12 +3,11 @@ import { existsSync, mkdirSync, readdirSync, renameSync, rmSync } from 'node:fs'
 import { basename, dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
-import { withFileLockSync, writeJsonAtomicSync } from '../../runtime/shared/atomic-file.mjs';
+import { readJsonStateSync, updateJsonAtomicSync, withFileLockSync } from '../../runtime/shared/atomic-file.mjs';
 import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { pluginManifest } from '../../runtime/shared/plugin-manifest.mjs';
 import { pluginMetadata } from '../../runtime/shared/plugin-metadata.mjs';
 import { clean } from '../../runtime/shared/clean.mjs';
-import { readJsonSafe } from '../../runtime/shared/json-file.mjs';
 
 const REGISTRY_VERSION = 1;
 
@@ -28,38 +27,39 @@ function installRoot(dataDir = resolvePluginData()) {
   return join(pluginBaseDir(dataDir), 'installed');
 }
 
+const emptyRegistry = () => ({ version: REGISTRY_VERSION, plugins: [] });
+const hasPluginList = (raw) => Boolean(raw && Array.isArray(raw.plugins));
+
+// A damaged registry (empty, NUL-filled after a crash, malformed, or not a
+// plugin list) never blocks the plugin features: its bytes are kept aside as
+// registry.json.corrupt-<ts>, the last good copy registry.json.bak is
+// restored when there is one, else the registry starts empty. I/O errors
+// still throw.
 function loadRegistry(dataDir = resolvePluginData()) {
-  const path = registryPath(dataDir);
-  if (!existsSync(path)) return { version: REGISTRY_VERSION, plugins: [] };
-  const raw = readJsonSafe(path);
-  if (raw && Array.isArray(raw.plugins)) return raw;
-  throw new Error(`plugin registry is corrupt: ${path}`);
+  return readJsonStateSync(registryPath(dataDir), {
+    validate(raw) {
+      if (!hasPluginList(raw)) throw new Error('plugin registry has no plugin list');
+      return raw;
+    },
+    fallback: emptyRegistry(),
+    secret: true,
+  });
 }
 
 function mutateRegistry(dataDir, mutator) {
   const path = registryPath(dataDir);
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  return withFileLockSync(
-    `${path}.lock`,
-    () => {
-      const registry = loadRegistry(dataDir);
-      const result = mutator(registry);
-      writeJsonAtomicSync(
-        path,
-        {
-          version: REGISTRY_VERSION,
-          plugins: Array.isArray(registry.plugins) ? registry.plugins : [],
-        },
-        {
-          lock: false,
-          secret: true,
-          fsyncDir: true,
-        }
-      );
-      return result;
+  let result;
+  updateJsonAtomicSync(
+    path,
+    (raw) => {
+      const registry = hasPluginList(raw) ? raw : emptyRegistry();
+      result = mutator(registry);
+      return { version: REGISTRY_VERSION, plugins: registry.plugins };
     },
-    { secret: true }
+    { secret: true, fsyncDir: true, backup: true }
   );
+  return result;
 }
 
 function displayNameFromUrl(url) {

package/src/session-runtime/services/provider-admin.mjs

@@ -394,7 +394,10 @@ function oauthProviderSetup(p, providers, checkSecrets) {
 
 const CUSTOM_ID_RE = /^custom-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const CUSTOM_TEST_TIMEOUT_MS = 20_000;
-const CUSTOM_DISCOVERY_TIMEOUT_MS = 15_000;
+// A catalog host can sit behind a slow gateway: api.nano-gpt.com's /models
+// answered 503 only after ~44 s, so the wait must outlast that to surface the
+// service's own answer instead of a local timeout.
+const CUSTOM_DISCOVERY_TIMEOUT_MS = 60_000;
 
 export function isCustomProviderConfig(entry) {
   return Boolean(entry) && typeof entry === 'object' && entry.type === 'custom';
@@ -439,6 +442,7 @@ function publicCustomModelRows(rows) {
     model.hidden = item.hidden === true;
     model.manual = item.manual === true;
     for (const key of [
+      'supportsVision',
       'supportsReasoning',
       'reasoningOptions',
       'reasoningLevels',
@@ -585,7 +589,8 @@ async function modelProxyProviderSetup(options) {
       });
   const custom = Object.entries(providers)
     .filter(([id, entry]) => isCustomProviderId(id) && entry?.type === 'custom')
-    .map(([id]) => ({ id, name: id }));
+    // Older desktops advertise no name: the id is the fallback.
+    .map(([id, entry]) => ({ id, name: (typeof entry.name === 'string' && entry.name.trim()) || id }));
   return {
     managedByClient: true,
     api: [...project(API_PROVIDERS, 'api', 'api-key'), ...project(custom, 'api', 'custom')],
@@ -949,7 +954,9 @@ async function withTimeout(run, ms, label) {
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(() => {
       controller.abort();
-      reject(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`));
+      reject(
+        Object.assign(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`), { code: 'EPROVIDERTIMEOUT' })
+      );
     }, ms);
   });
   try {
@@ -1106,7 +1113,15 @@ export async function saveCustomProvider(cfgMod, rawInput) {
   return typed ? serializeCustomKeySave(id, commit) : commit();
 }
 
-const MODEL_PATCH_KEYS = new Set(['manual', 'hidden', 'name', 'contextWindow', 'maxOutputTokens', 'reasoning']);
+const MODEL_PATCH_KEYS = new Set([
+  'manual',
+  'hidden',
+  'name',
+  'contextWindow',
+  'maxOutputTokens',
+  'supportsVision',
+  'reasoning',
+]);
 const REASONING_PATCH_KEYS = new Set(['levels', 'wireFormat', 'wireValues', 'replay']);
 
 // Tri-state merge: undefined preserves, null deletes the property, a value replaces it.
@@ -1330,7 +1345,11 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
   try {
     const { createCustomProvider } = await loadCustomProviderModule();
     const provider = await createCustomProvider(id || 'custom-discovery', { ...config, apiKey });
-    const listed = await withTimeout(() => provider.listModels(), CUSTOM_DISCOVERY_TIMEOUT_MS, 'model discovery');
+    const listed = await withTimeout(
+      (signal) => provider.listModels({ signal, timeoutMs: CUSTOM_DISCOVERY_TIMEOUT_MS }),
+      CUSTOM_DISCOVERY_TIMEOUT_MS,
+      'model discovery'
+    );
     const models = publicCustomModelRows(listed);
     // A failed discovery that still left manual rows reports its error too.
     const failure = provider.customDiscoveryError;
@@ -1343,8 +1362,9 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
 function discoveryErrorView(error, secrets) {
   const status = Number.isInteger(error?.status) ? error.status : undefined;
   const authKind = status === 401 || status === 403 ? 'authentication' : 'request';
+  const kind = status === 404 || status === 405 ? 'unavailable' : authKind;
   return {
-    kind: status === 404 || status === 405 ? 'unavailable' : authKind,
+    kind: error?.code === 'EPROVIDERTIMEOUT' ? 'timeout' : kind,
     ...(status === undefined ? {} : { status }),
     message: sanitizeCustomError(error, secrets).message,
   };

package/src/session-runtime/services/schedule-access.mjs

@@ -11,17 +11,31 @@
 // - a group-room member session is no background run, but it speaks for the
 //   room, not for the user: it creates or changes no agent, automation or
 //   other setting either.
+// - an unattended run — a routine turn in a bot's home chat (Mixy's too), or
+//   work it or a room started (held-requests.mjs unattendedRunOf) — is checked
+//   first and only ever narrows: at most its own bot's agent scope
+//   (`unattended: true`), which manages that bot's own automations and route
+//   and changes no other setting.
 // The app's own panels call channel-admin directly and act for the human.
 import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
 import { mixyDisplayName } from '../../runtime/agent/orchestrator/session/mixy-name.mjs';
 import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+import { unattendedRunOf } from '../held-requests.mjs';
 
 const INTERACTIVE_SOURCE_TYPES = new Set(['', 'lead', 'cli']);
+// What an unattended run may still change: its own bot's automations (each
+// checked by assertAutomationAccess) and its own route (assertOwnAgentSettings).
+const UNATTENDED_OWN_ACTIONS = new Set([
+  'save_automation',
+  'set_automation_enabled',
+  'delete_automation',
+  'run_automation',
+  'set_agent_route',
+]);
 
-/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId? }` of a session record. */
-export function scheduleCallerScope(session) {
-  const id = String(session?.id || '');
+/** The scope by the session's id and record alone. */
+function provenanceScope(session, id) {
   const member = roomMemberOfSession(id);
   if (member) return { kind: 'room-member', agentId: member.agentId };
   const homeAgent = agentIdOfHomeSession(id);
@@ -35,6 +49,17 @@ export function scheduleCallerScope(session) {
   return headless ? { kind: 'headless' } : { kind: 'human' };
 }
 
+/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId?, unattended? }` of a session record. */
+export function scheduleCallerScope(session) {
+  const id = String(session?.id || '');
+  const scope = provenanceScope(session, id);
+  const run = id ? unattendedRunOf(id) : null;
+  if (!run || scope.kind === 'headless' || scope.kind === 'room-member') return scope;
+  if (run.kind === 'room') return { kind: 'room-member', agentId: run.agentId };
+  if (!run.agentId || (scope.kind === 'agent' && scope.agentId !== run.agentId)) return { kind: 'headless' };
+  return { kind: 'agent', agentId: run.agentId, unattended: true };
+}
+
 /** Throws unless `scope` may `action` the `kind` ('schedule' | 'webhook')
  *  automation `current` (null when creating) with `owner` the requested owner
  *  ('' keeps the saved one). `agentIds` are the agents a transfer may name;
@@ -83,8 +108,12 @@ export function assertOwnAgentSettings(scope, agentId, action) {
   }
 }
 
-/** Throws when `scope` is a headless run: it reads settings, never changes them. */
+/** Throws when `scope` is a headless run: it reads settings, never changes
+ *  them; an unattended run changes only its own bot's automations and route. */
 export function assertInteractiveCaller(scope, action) {
+  if (scope?.unattended && !UNATTENDED_OWN_ACTIONS.has(action)) {
+    throw new Error(`An unattended run cannot change settings (setup ${action})`);
+  }
   if (scope?.kind === 'human' || scope?.kind === 'agent') return;
   if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot change settings (setup ${action})`);
   throw new Error(`A background run cannot change settings (setup ${action})`);

package/src/session-runtime/services/seeds.mjs

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { writeFileAtomicSync } from '../../runtime/shared/atomic-file.mjs';
 import { pluginSkillsRoots } from '../../runtime/shared/plugin-manifest.mjs';
 import {
   EMPTY_HISTORY,
@@ -43,7 +44,7 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   retireSeededPackCopies({ rootDir, dataDir, backup, includeHistory });
   if (includeHistory && !backup.failures) {
     try {
-      writeFileSync(markerFile, `${stamp}\n`);
+      writeFileAtomicSync(markerFile, `${stamp}\n`);
     } catch {
       /* marker only; the sweep simply repeats */
     }
@@ -68,7 +69,7 @@ function cleanupRetiredChannelSecrets(dataDir) {
         }
       }
       try {
-        writeFileSync(marker, `${new Date().toISOString()}\n`);
+        writeFileAtomicSync(marker, `${new Date().toISOString()}\n`);
       } catch {
         /* marker only */
       }

package/src/session-runtime/services/usage-dashboard.mjs

@@ -92,7 +92,7 @@ function refreshScope(options) {
  *  then resolve whatever usage the provider — or a local budget fallback — can
  *  supply. The row is appended to `rows` before the first emit so every paint
  *  from here on includes it. */
-async function apiProviderRow(item, { config, providers, preview, refreshFor, snapshotOptions, rows, emit }) {
+async function apiProviderRow(item, { providers, preview, snapshotOptions, rows, emit }) {
   const providerCfg = providers[item.id] || {};
   const row = baseRow(item, 'api', providerCfg);
   row.status = row.authenticated ? 'checking' : 'missing';

package/src/session-runtime/services/usage-stats-model.mjs

@@ -535,7 +535,8 @@ function exportUnpricedModels(state) {
   const rows = [];
   for (const provider of state.providers.values()) {
     for (const model of provider.models.values()) {
-      if (model.turns > 0 && model.costKnownTurns < model.turns) rows.push({ provider: provider.provider, model: model.model });
+      if (model.turns > 0 && model.costKnownTurns < model.turns)
+        rows.push({ provider: provider.provider, model: model.model });
     }
   }
   return rows.sort((a, b) => a.provider.localeCompare(b.provider) || a.model.localeCompare(b.model));

package/src/session-runtime/services/worktree-access.mjs

@@ -0,0 +1,27 @@
+// Who may change worktrees from a chat (the git tool's managed-worktree
+// operations, the daemon's cross-session `worktree` control). A worktree
+// mutation — entering, returning, merging, removing, pruning, `git worktree
+// add/remove`, a snapshot — runs only in a conversation session: a Lead
+// session of the desktop or TUI, or a bot's chat. Unattended runs (schedules,
+// webhooks, routines, room seats) are refused by the run's trusted identity;
+// delegated workers have no worktree host at all. Listing stays open.
+//
+// The scope is the session-level caller scope (schedule-access.mjs
+// scheduleCallerScope: the session's provenance and its unattended-run mark),
+// never anything the model or a message supplies.
+import { scheduleCallerScope } from './schedule-access.mjs';
+
+/** `{ kind, agentId?, unattended?, attended }` of a calling session record. */
+export function worktreeCallerScope(session) {
+  const scope = scheduleCallerScope(session);
+  const attended = (scope.kind === 'human' || scope.kind === 'agent') && scope.unattended !== true;
+  return { ...scope, attended };
+}
+
+/** Throws unless `scope` (worktreeCallerScope) may change worktrees; `what` names the refused action. */
+export function assertWorktreeMutationAllowed(scope, what) {
+  if (scope?.attended === true) return;
+  throw new Error(
+    `${what} changes worktrees only in a conversation session (a Lead session or a bot chat); schedule, webhook, routine and room runs may only list them`
+  );
+}

package/src/session-runtime/session-create/materialize.mjs

@@ -3,7 +3,6 @@
 // event, and the optional WS transport prewarm.
 import { deferredSurfaceModeForLead } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { filterMcpToolsForSession } from '../../runtime/agent/orchestrator/runtime-core/extension-scopes.mjs';
-import { attachSessionHooks } from '../session-hooks.mjs';
 import { applyDeferredToolSurface } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 import { writeStatuslineRoute } from '../statusline-route.mjs';
 import { sessionOptions } from './session-options.mjs';
@@ -42,10 +41,10 @@ function seedToolSurface(deps, reason) {
 
 /** Adopt the provider session and publish it to hooks and statusline. */
 export function materializeSession(deps, reason, coreMemoryContext) {
-  const { rt, adoptSession, mgr, hooks, hookCommonPayload, statusRoutes } = deps;
+  const { rt, adoptSession, mgr, hooks, statusRoutes } = deps;
+  // adoptSession attaches the hook bridge (boot/infrastructure.mjs sessionAdopter).
   adoptSession(mgr.createSession(sessionOptions(deps, coreMemoryContext)));
   rt.reservedSessionId = null;
-  attachSessionHooks(rt.session, { hooks, hookCommonPayload, getCwd: () => rt.currentCwd });
   seedToolSurface(deps, reason);
   writeStatuslineRoute(statusRoutes, rt.session, rt.route);
   hooks.emit('session:create', {

package/src/session-runtime/session-create/session-options.mjs

@@ -9,7 +9,20 @@ import { readAgentFrontmatterPermission } from '../services/agent-tool/helpers.m
 import { LEAD_DISALLOWED_TOOLS } from '../../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { HEADLESS_TOOL_PROFILE } from '../../runtime/agent/orchestrator/runtime-core/tool-profile.mjs';
 import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
-import { MIXY_AGENT_ID } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
+import { unattendedApprovalPort } from '../../runtime/agent/orchestrator/session/human-gate/gate.mjs';
+
+/** Where a bot created its task session, recorded after its id in the
+ *  session's `sourceName` (`agent:<id>@home|room|run`): the desktop lets the
+ *  task act as the bot (its standing allows, "always allow") only when it came
+ *  from the bot's own attended chat. None when the origin is anything else. */
+function taskOriginSuffix(taskOrigin) {
+  const from = clean(taskOrigin?.sessionId);
+  if (roomMemberOfSession(from)) return '@room';
+  if (unattendedApprovalPort()?.runOf?.(from)) return '@run';
+  return agentIdOfHomeSession(from) === clean(taskOrigin?.agentId) ? '@home' : '';
+}
 
 // Ownership and permission fields an agent-owned session inherits from its profile.
 function agentOwnedSessionFields(sessionProfile) {
@@ -83,7 +96,7 @@ export function sessionOptions(deps, coreMemoryContext) {
     sourceName: agentOwned
       ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent'
       : taskOrigin
-        ? `agent:${taskOrigin.agentId}`
+        ? `agent:${taskOrigin.agentId}${taskOriginSuffix(taskOrigin)}`
         : 'main',
     ...(taskOrigin ? { taskOrigin } : {}),
     ...(rt.approvalMode ? { approvalMode: rt.approvalMode } : {}),

package/src/session-runtime/session-hooks.mjs

@@ -5,9 +5,6 @@
 // facade's hookCommonPayload / currentCwd accessor + the session itself. All
 // properties are non-enumerable/configurable/writable so the loop/manager can
 // read them by name without changing session enumeration.
-import { roomMemberOfSession } from '../runtime/agent/orchestrator/session/agent-room.mjs';
-import { roomMemberToolDecision } from './room-member-gate.mjs';
-
 export function attachSessionHooks(session, { hooks, hookCommonPayload, getCwd }) {
   const identity = (input) => ({
     session_id: input?.sessionId || input?.session_id || session?.id,
@@ -28,26 +25,21 @@ export function attachSessionHooks(session, { hooks, hookCommonPayload, getCwd }
   // rejection cannot escape the tool loop or the compaction flow.
   const dispatcher = (event, payload) => (input) => hooks.dispatch(event, hookCommonPayload(payload(input)));
 
-  // PreToolUse bridge. A group-room member's mutating calls always ask the
-  // user (room-member-gate.mjs), whatever the hooks decided short of a deny.
-  define('beforeToolHook', async (input, options = {}) => {
-    const name = input?.name || input?.tool_name;
-    const args = input?.args || input?.tool_input;
-    const cwd = input?.cwd || getCwd();
-    const decision = await hooks.beforeTool(
+  // PreToolUse bridge. A group-room member follows the same rules as its
+  // agent's home thread: no room-only approval on top.
+  define('beforeToolHook', async (input, options = {}) =>
+    hooks.beforeTool(
       hookCommonPayload({
         ...input,
         session_id: input?.sessionId || input?.session_id || session?.id,
-        tool_name: name,
-        tool_input: args,
+        tool_name: input?.name || input?.tool_name,
+        tool_input: input?.args || input?.tool_input,
         tool_use_id: input?.toolCallId || input?.tool_use_id,
-        cwd,
+        cwd: input?.cwd || getCwd(),
       }),
       options
-    );
-    if (!roomMemberOfSession(session?.id)) return decision;
-    return roomMemberToolDecision({ name, args, cwd }, decision);
-  });
+    )
+  );
   // PostToolUse: bridge runtime tool completions to the standard hook bus.
   define('afterToolHook', dispatcher('PostToolUse', toolPayload));
   // PostToolUseFailure: dispatched by loop.mjs only when a tool execution